@bbradar/mcp 0.1.4 → 0.1.6

package/dist/server.js

@@ -31,17 +31,51 @@ const MAX_LOCAL_EXPORT_RESOURCES = 25;
 const EXPORT_PREVIEW_LIMIT = 25;
 const STALE_PROGRAM_ID_RESOLVE_PAGES = 5;
 const STALE_PROGRAM_ID_RESOLVE_BUDGET = 5;
+const MAX_RESOLVE_SEARCH_QUERIES = 4;
 const SDK_VERSION = "1.29.0";
 const WEB3_TAGS = ["web3", "crypto", "blockchain", "smart-contract", "smart contract", "defi", "nft", "ethereum", "solana", "solidity"];
 const WEB3_CONTEST_SIGNALS = ["contest", "audit", "competitive", "code4rena", "sherlock", "cantina", "codehawks", "hats", "spearbit", "warden"];
 const VDP_SIGNALS = ["vdp", "disclosure", "responsible disclosure", "vulnerability disclosure", "no bounty", "non-bounty", "no reward"];
+const PROGRAM_RESOLUTION_STOP_WORDS = new Set([
+    "program",
+    "programs",
+    "target",
+    "targets",
+    "scope",
+    "scopes",
+    "new",
+    "latest",
+    "recent",
+    "recently",
+    "added",
+    "additions",
+    "for",
+    "from",
+    "the",
+    "a",
+    "an",
+    "of",
+    "on",
+    "in",
+    "with",
+    "to",
+    "get",
+    "find",
+    "show",
+    "list",
+    "check",
+    "does",
+    "has",
+    "have",
+    "any"
+]);
 const targetListModeSchema = z.enum(["identifiers", "compact", "full"]);
 const changeListModeSchema = z.enum(["compact", "full"]);
 const programListModeSchema = z.enum(["compact", "full"]);
 const rewardThresholdModeSchema = z.enum(["max_at_least", "min_at_least"]);
 const vdpModeSchema = z.enum(["include", "exclude", "only_likely", "only_known_no_bounty"]);
 const targetMatchModeSchema = z.enum(["contains", "exact", "suffix", "wildcard"]);
-const programNameActionSchema = z.enum(["new_targets", "scope_delta", "brief", "target_breakdown"]);
+const programNameActionSchema = z.enum(["new_targets", "targets", "scope_delta", "brief", "target_breakdown"]);
 const readOnlyAnnotations = {
     readOnlyHint: true,
     destructiveHint: false,
@@ -192,7 +226,8 @@ export function createBbradarServer(client, config) {
         instructions: [
             "Use BBRadar only for passive bug bounty intelligence; never scan or contact targets.",
             "For BBRadar asks, use these tools first and avoid external skills unless methodology is explicitly requested.",
-            "Name + action: run_program_name_action. Name only: resolve_program.",
+            "Partial program name + action: run_program_name_action. Partial program name only: resolve_program.",
+            "Default to bounty-eligible in-scope data. Include out-of-scope, ineligible, VDP, disclosure-only, or no-bounty data only when the user explicitly asks.",
             "Freshness: get_latest_added_targets, check_program_new_targets, check_watchlist_new_targets, find_recent_by_type, get_program_scope_delta.",
             "Discovery: find_program_candidates, find_stack_matches, find_language_programs, find_target_type_programs, find_reward_programs, find_paid_programs, find_vdp_programs, find_web3_contests, find_low_noise_programs.",
             "Details: get_program_brief, get_program_scope_summary, get_program_target_breakdown, find_programs_by_target, compare_programs_compact.",
@@ -208,15 +243,20 @@ export function createBbradarServer(client, config) {
             platforms: stringListSchema,
             tags: stringListSchema,
             updated_since: isoDateTimeSchema.optional().describe("ISO datetime."),
+            vdp_mode: vdpModeSchema.default("exclude").describe("VDP/no-bounty filter mode."),
             page: pageSchema,
             page_size: programsPageSizeSchema
         },
         outputSchema: programListOutputShape,
         annotations: readOnlyAnnotations
     }, (args) => runTool("search_programs", config, rateLimiter, async () => {
-        const api = await client.listPrograms(toQuery(args));
+        const { vdp_mode, ...filters } = args;
+        const api = await client.listPrograms(toQuery(filters));
         const data = readObject(api.data);
-        const programs = readArray(data?.programs).map((program) => addProgramResourceLinks(sanitizeProgram(program, config.webBaseUrl)));
+        const programs = readArray(data?.programs)
+            .map((program) => toProgramCandidate(program, config.webBaseUrl))
+            .filter((candidate) => candidateMatchesVdpMode(candidate, vdp_mode))
+            .map((candidate) => candidate.program);
         return withApiMetadata(api, {
             programs,
             meta: sanitizeJson(data?.meta)
@@ -230,7 +270,8 @@ export function createBbradarServer(client, config) {
         },
         outputSchema: {
             ...apiEnvelopeOutputShape,
-            program: programOutputSchema.optional()
+            program: programOutputSchema.optional(),
+            meta: jsonRecordSchema.optional()
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_program", config, rateLimiter, async () => {
@@ -239,11 +280,19 @@ export function createBbradarServer(client, config) {
             return withApiMetadata(api, {
                 program: addProgramResourceLinks(sanitizeProgram(api.data, config.webBaseUrl))
             });
-        });
+        }, async (indexFallback) => ({
+            request_id: randomUUID(),
+            warnings: [`Returned program metadata from the BBRadar program index because the per-program detail endpoint returned 404 for ${indexFallback.resolvedProgramId}.`],
+            program: indexFallback.program,
+            meta: {
+                detail_source: "program_index",
+                detail_endpoint_unavailable: true
+            }
+        }));
     }));
     server.registerTool("resolve_program", {
         title: "Resolve Program",
-        description: "Resolve name/handle text to likely program_ids.",
+        description: "Resolve partial name/handle text to likely program_ids. Use this when the user gives a program name fragment like Nado.",
         inputSchema: {
             query: searchTextSchema,
             platforms: stringListSchema,
@@ -267,7 +316,7 @@ export function createBbradarServer(client, config) {
     }, (args) => runTool("resolve_program", config, rateLimiter, async () => resolveProgram(client, config, args)));
     server.registerTool("run_program_name_action", {
         title: "Run Program Name Action",
-        description: "Resolve a name, then run new_targets, scope_delta, brief, or target_breakdown.",
+        description: "Resolve a partial program name, then run targets, new_targets, scope_delta, brief, or target_breakdown.",
         inputSchema: {
             query: searchTextSchema,
             action: programNameActionSchema.default("new_targets"),
@@ -319,26 +368,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_program_targets", config, rateLimiter, async () => {
-        return runProgramIdTool(client, config, args.program_id, async (programId) => {
-            const api = await client.getProgramTargets(programId);
-            const data = readObject(api.data);
-            const rawTargets = readArray(data?.targets);
-            const sanitizedTargets = rawTargets.map(sanitizeTarget).filter((target) => targetHasAllowedScope(target, args));
-            const targets = sanitizedTargets.slice(args.offset, args.offset + args.limit);
-            return withApiMetadata(api, {
-                program_id: programId,
-                targets: formatTargetList(targets, args.output_mode),
-                meta: {
-                    offset: args.offset,
-                    limit: args.limit,
-                    output_mode: args.output_mode,
-                    total_active_targets: rawTargets.length,
-                    total_after_filters: sanitizedTargets.length,
-                    returned: targets.length,
-                    has_more: args.offset + args.limit < sanitizedTargets.length
-                }
-            });
-        });
+        return runProgramIdTool(client, config, args.program_id, async (programId) => getProgramTargetsPayload(client, args, programId), async (indexFallback) => getProgramTargetsExportFallbackPayload(client, args, indexFallback.resolvedProgramId));
     }));
     server.registerTool("get_recent_changes", {
         title: "Get Recent Target Changes",
@@ -390,8 +420,8 @@ export function createBbradarServer(client, config) {
             include_full_target_list: z.boolean().default(true),
             full_target_list_mode: targetListModeSchema.default("identifiers"),
             full_target_limit: z.number().int().min(1).max(MAX_TARGETS_PER_PROGRAM).default(MAX_TARGETS_PER_PROGRAM),
-            full_list_include_out_of_scope: z.boolean().default(true),
-            full_list_include_ineligible: z.boolean().default(true)
+            full_list_include_out_of_scope: z.boolean().default(false),
+            full_list_include_ineligible: z.boolean().default(false)
         },
         outputSchema: {
             ...apiEnvelopeOutputShape,
@@ -412,8 +442,8 @@ export function createBbradarServer(client, config) {
             program_id: programIdSchema,
             target_list_mode: targetListModeSchema.default("identifiers"),
             group_limit: z.number().int().min(1).max(MAX_TARGETS_PER_PROGRAM).default(MAX_TARGETS_PER_PROGRAM),
-            include_out_of_scope: z.boolean().default(true),
-            include_ineligible: z.boolean().default(true)
+            include_out_of_scope: z.boolean().default(false),
+            include_ineligible: z.boolean().default(false)
         },
         outputSchema: {
             ...apiEnvelopeOutputShape,
@@ -423,7 +453,7 @@ export function createBbradarServer(client, config) {
             meta: jsonRecordSchema.optional()
         },
         annotations: readOnlyAnnotations
-    }, (args) => runTool("get_program_scope_summary", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => getProgramScopeSummary(client, config, { ...args, program_id: programId }))));
+    }, (args) => runTool("get_program_scope_summary", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => getProgramScopeSummary(client, config, { ...args, program_id: programId }), (indexFallback) => getProgramScopeSummaryFromIndexFallback(client, indexFallback, { ...args, program_id: indexFallback.resolvedProgramId }))));
     server.registerTool("get_program_target_breakdown", {
         title: "Get Program Target Breakdown",
         description: "Target type, scope tag, language tag, and bucket counts for one program.",
@@ -431,8 +461,8 @@ export function createBbradarServer(client, config) {
             program_id: programIdSchema,
             target_list_mode: targetListModeSchema.default("identifiers"),
             group_limit: z.number().int().min(1).max(MAX_TARGETS_PER_PROGRAM).default(100),
-            include_out_of_scope: z.boolean().default(true),
-            include_ineligible: z.boolean().default(true)
+            include_out_of_scope: z.boolean().default(false),
+            include_ineligible: z.boolean().default(false)
         },
         outputSchema: {
             ...apiEnvelopeOutputShape,
@@ -442,7 +472,7 @@ export function createBbradarServer(client, config) {
             meta: jsonRecordSchema.optional()
         },
         annotations: readOnlyAnnotations
-    }, (args) => runTool("get_program_target_breakdown", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => getProgramTargetBreakdown(client, config, { ...args, program_id: programId }))));
+    }, (args) => runTool("get_program_target_breakdown", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => getProgramTargetBreakdown(client, config, { ...args, program_id: programId }), (indexFallback) => getProgramTargetBreakdownFromIndexFallback(client, indexFallback, { ...args, program_id: indexFallback.resolvedProgramId }))));
     server.registerTool("get_program_scope_delta", {
         title: "Get Program Scope Delta",
         description: "Compact recent scope changes for one program.",
@@ -519,7 +549,7 @@ export function createBbradarServer(client, config) {
             meta: jsonRecordSchema.optional()
         },
         annotations: readOnlyAnnotations
-    }, (args) => runTool("check_program_new_targets", config, rateLimiter, async () => checkProgramNewTargets(client, config, args)));
+    }, (args) => runTool("check_program_new_targets", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => checkProgramNewTargets(client, config, { ...args, program_id: programId }), (indexFallback) => checkProgramNewTargetsFromIndexedProgram(client, config, { ...args, program_id: indexFallback.resolvedProgramId }, indexFallback.program))));
     server.registerTool("check_watchlist_new_targets", {
         title: "Check Watchlist New Targets",
         description: "New in-scope targets across many known program_ids.",
@@ -549,6 +579,7 @@ export function createBbradarServer(client, config) {
             platforms: stringListSchema,
             tags: stringListSchema,
             updated_since: isoDateTimeSchema.optional(),
+            vdp_mode: vdpModeSchema.default("exclude").describe("VDP/no-bounty filter mode."),
             page: pageSchema,
             page_size: programsPageSizeSchema
         },
@@ -558,10 +589,13 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_opportunities", config, rateLimiter, async () => {
-        const { level, ...filters } = args;
+        const { level, vdp_mode, ...filters } = args;
         const api = await client.getOpportunities(level, toQuery(filters));
         const data = readObject(api.data);
-        const programs = readArray(data?.programs).map((program) => addProgramResourceLinks(sanitizeProgram(program, config.webBaseUrl)));
+        const programs = readArray(data?.programs)
+            .map((program) => toProgramCandidate(program, config.webBaseUrl))
+            .filter((candidate) => candidateMatchesVdpMode(candidate, vdp_mode))
+            .map((candidate) => candidate.program);
         return withApiMetadata(api, {
             level,
             programs,
@@ -592,7 +626,7 @@ export function createBbradarServer(client, config) {
             exclude_non_web: z.boolean().default(false),
             has_api_scope: z.boolean().default(false),
             contest_like: z.boolean().default(false).describe("Require contest/audit signals."),
-            vdp_mode: vdpModeSchema.default("include").describe("VDP/no-bounty filter mode."),
+            vdp_mode: vdpModeSchema.default("exclude").describe("VDP/no-bounty filter mode."),
             fresh_launch_days: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).optional(),
             min_wildcards: z.number().int().min(0).max(1000).default(0),
             min_eligible_targets: z.number().int().min(0).optional(),
@@ -800,7 +834,7 @@ export function createBbradarServer(client, config) {
             min_reward: z.number().int().min(0).optional(),
             reward_threshold_mode: rewardThresholdModeSchema.default("max_at_least"),
             require_bounty: z.boolean().default(false),
-            exclude_vdp: z.boolean().default(false),
+            exclude_vdp: z.boolean().default(true),
             max_public_report_count: z.number().int().min(0).optional(),
             require_known_report_count: z.boolean().default(false),
             include_unknown_report_count: z.boolean().default(true),
@@ -830,7 +864,7 @@ export function createBbradarServer(client, config) {
             require_bounty: z.boolean().default(false),
             fresh_only: z.boolean().default(false),
             min_added_7d: z.number().int().min(0).optional(),
-            exclude_vdp: z.boolean().default(false),
+            exclude_vdp: z.boolean().default(true),
             max_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
             max_results: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(10),
             include_target_samples: z.boolean().default(false),
@@ -899,7 +933,7 @@ export function createBbradarServer(client, config) {
             web3: z.boolean().default(false),
             contest_like: z.boolean().default(false),
             require_bounty: z.boolean().default(false),
-            exclude_vdp: z.boolean().default(false),
+            exclude_vdp: z.boolean().default(true),
             max_public_report_count: z.number().int().min(0).optional(),
             min_eligible_targets: z.number().int().min(0).optional(),
             fresh_only: z.boolean().default(false),
@@ -978,8 +1012,8 @@ export function createBbradarServer(client, config) {
             use_api_search: z.boolean().default(true),
             max_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(2),
             max_results: z.number().int().min(1).max(25).default(10),
-            include_out_of_scope: z.boolean().default(true),
-            include_ineligible: z.boolean().default(true),
+            include_out_of_scope: z.boolean().default(false),
+            include_ineligible: z.boolean().default(false),
             max_targets_per_program: z.number().int().min(1).max(50).default(10),
             target_list_mode: targetListModeSchema.default("identifiers"),
             upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(30)
@@ -1472,7 +1506,7 @@ async function getProgramWithIdFallback(client, config, requestedProgramId) {
         };
     }
 }
-async function runProgramIdTool(client, config, requestedProgramId, callback) {
+async function runProgramIdTool(client, config, requestedProgramId, callback, indexFallbackCallback) {
     try {
         return await callback(requestedProgramId);
     }
@@ -1482,12 +1516,74 @@ async function runProgramIdTool(client, config, requestedProgramId, callback) {
         }
         const fallback = await resolveStaleProgramId(client, config, requestedProgramId, error);
         if (!fallback) {
-            throw error;
+            if (!indexFallbackCallback) {
+                throw error;
+            }
+            const indexFallback = await resolveIndexedProgramId(client, config, requestedProgramId, error);
+            if (!indexFallback) {
+                throw error;
+            }
+            const payload = await indexFallbackCallback(indexFallback);
+            return withProgramIndexFallbackMetadata(payload, indexFallback);
+        }
+        try {
+            const payload = await callback(fallback.resolvedProgramId);
+            return withProgramIdFallbackMetadata(payload, fallback);
+        }
+        catch (fallbackError) {
+            if (!isProgramNotFoundError(fallbackError) || !indexFallbackCallback) {
+                throw fallbackError;
+            }
+            const indexFallback = await resolveIndexedProgramId(client, config, fallback.resolvedProgramId, fallbackError);
+            if (!indexFallback) {
+                throw fallbackError;
+            }
+            const combinedFallback = {
+                ...indexFallback,
+                requestedProgramId,
+                sourceRequests: [...fallback.sourceRequests, ...indexFallback.sourceRequests],
+                warnings: uniqueStrings([...fallback.warnings, ...indexFallback.warnings])
+            };
+            const payload = await indexFallbackCallback(combinedFallback);
+            return withProgramIndexFallbackMetadata(payload, combinedFallback);
         }
-        const payload = await callback(fallback.resolvedProgramId);
-        return withProgramIdFallbackMetadata(payload, fallback);
     }
 }
+async function resolveIndexedProgramId(client, config, requestedProgramId, staleError) {
+    const query = programSearchText(requestedProgramId);
+    if (query.length < 2) {
+        return undefined;
+    }
+    const resolution = await resolveProgram(client, config, {
+        query,
+        platforms: [],
+        tags: [],
+        opportunity_levels: [],
+        max_pages: STALE_PROGRAM_ID_RESOLVE_PAGES,
+        max_results: 5,
+        output_mode: "full",
+        upstream_request_budget: STALE_PROGRAM_ID_RESOLVE_BUDGET
+    });
+    const match = selectProgramIndexFallbackMatch(requestedProgramId, resolution);
+    if (!match) {
+        return undefined;
+    }
+    const sourceRequests = readArray(resolution.source_requests).filter((request) => readObject(request) !== undefined);
+    const warnings = readArray(resolution.warnings).filter((warning) => typeof warning === "string");
+    const staleApiError = staleError instanceof BBRadarApiError ? staleError : undefined;
+    const indexWarning = `program_id ${requestedProgramId} exists in the BBRadar program index, but the per-program detail endpoint returned 404.`;
+    return {
+        requestedProgramId,
+        resolvedProgramId: match.resolvedProgramId,
+        query,
+        staleRequestId: staleApiError?.requestId,
+        staleUpstreamRequestId: staleApiError?.upstreamRequestId,
+        sourceRequests,
+        warnings: uniqueStrings([...warnings, indexWarning]),
+        resolution,
+        program: match.program
+    };
+}
 async function resolveStaleProgramId(client, config, requestedProgramId, staleError) {
     const query = programSearchText(requestedProgramId);
     if (query.length < 2) {
@@ -1525,6 +1621,7 @@ async function resolveStaleProgramId(client, config, requestedProgramId, staleEr
 function selectProgramIdFallbackMatch(requestedProgramId, resolution) {
     const requestedHandle = normalizeTag(programHandleText(requestedProgramId));
     const requestedSearchText = normalizeTag(programSearchText(requestedProgramId));
+    const requestedPlatform = normalizeTag(programPlatformText(requestedProgramId));
     const candidates = readArray(resolution.matches)
         .map((entry) => readObject(entry))
         .filter((entry) => entry !== undefined)
@@ -1533,17 +1630,29 @@ function selectProgramIdFallbackMatch(requestedProgramId, resolution) {
         const resolvedProgramId = stringField(entry, "program_id") ?? stringField(program, "id");
         const candidateHandle = normalizeTag(stringField(program, "handle") ?? "");
         const candidateSearchText = resolvedProgramId ? normalizeTag(programSearchText(resolvedProgramId)) : "";
+        const candidatePlatform = normalizeTag(stringField(program, "platform") ?? (resolvedProgramId ? programPlatformText(resolvedProgramId) : ""));
         const score = readNumber(entry.score) ?? 0;
         const exactHandleMatch = candidateHandle === requestedHandle ||
             candidateHandle === requestedSearchText ||
             candidateSearchText === requestedSearchText;
+        const partialHandleMatch = requestedHandle.length >= 4 &&
+            requestedPlatform.length > 0 &&
+            candidatePlatform === requestedPlatform &&
+            (candidateHandle.startsWith(`${requestedHandle}_`) ||
+                candidateHandle.startsWith(`${requestedHandle}-`) ||
+                candidateSearchText.startsWith(`${requestedSearchText}_`) ||
+                candidateSearchText.startsWith(`${requestedSearchText}-`));
         return {
             resolvedProgramId,
             score,
-            exactHandleMatch
+            exactHandleMatch,
+            partialHandleMatch
         };
     })
-        .filter((entry) => entry.resolvedProgramId !== undefined && entry.resolvedProgramId !== requestedProgramId && entry.exactHandleMatch && entry.score >= 80)
+        .filter((entry) => entry.resolvedProgramId !== undefined &&
+        normalizeTag(entry.resolvedProgramId) !== normalizeTag(requestedProgramId) &&
+        (entry.exactHandleMatch || entry.partialHandleMatch) &&
+        entry.score >= 80)
         .sort((left, right) => right.score - left.score || left.resolvedProgramId.localeCompare(right.resolvedProgramId));
     if (candidates.length === 0) {
         return undefined;
@@ -1556,6 +1665,48 @@ function selectProgramIdFallbackMatch(requestedProgramId, resolution) {
         resolvedProgramId: best.resolvedProgramId
     };
 }
+function selectProgramIndexFallbackMatch(requestedProgramId, resolution) {
+    const requestedId = normalizeTag(requestedProgramId);
+    const requestedHandle = normalizeTag(programHandleText(requestedProgramId));
+    const requestedPlatform = normalizeTag(programPlatformText(requestedProgramId));
+    const candidates = readArray(resolution.matches)
+        .map((entry) => readObject(entry))
+        .filter((entry) => entry !== undefined)
+        .map((entry) => {
+        const program = readObject(entry.program);
+        const resolvedProgramId = stringField(entry, "program_id") ?? stringField(program, "id");
+        const candidateHandle = normalizeTag(stringField(program, "handle") ?? (resolvedProgramId ? programHandleText(resolvedProgramId) : ""));
+        const candidatePlatform = normalizeTag(stringField(program, "platform") ?? (resolvedProgramId ? programPlatformText(resolvedProgramId) : ""));
+        const score = readNumber(entry.score) ?? 0;
+        const idMatch = resolvedProgramId !== undefined && normalizeTag(resolvedProgramId) === requestedId;
+        const platformHandleMatch = requestedPlatform.length > 0 &&
+            candidatePlatform === requestedPlatform &&
+            candidateHandle === requestedHandle;
+        const partialPlatformHandleMatch = requestedHandle.length >= 4 &&
+            requestedPlatform.length > 0 &&
+            candidatePlatform === requestedPlatform &&
+            (candidateHandle.startsWith(`${requestedHandle}_`) || candidateHandle.startsWith(`${requestedHandle}-`));
+        return {
+            resolvedProgramId,
+            program,
+            score,
+            exactMatch: idMatch || platformHandleMatch || partialPlatformHandleMatch
+        };
+    })
+        .filter((entry) => entry.resolvedProgramId !== undefined && entry.program !== undefined && entry.exactMatch && entry.score >= 80)
+        .sort((left, right) => right.score - left.score || left.resolvedProgramId.localeCompare(right.resolvedProgramId));
+    if (candidates.length === 0) {
+        return undefined;
+    }
+    const [best, next] = candidates;
+    if (!best || (next && best.score === next.score && normalizeTag(next.resolvedProgramId) !== normalizeTag(best.resolvedProgramId))) {
+        return undefined;
+    }
+    return {
+        resolvedProgramId: best.resolvedProgramId,
+        program: addProgramResourceLinks(best.program)
+    };
+}
 function withProgramIdFallbackMetadata(payload, fallback) {
     const sourceRequests = readArray(payload.source_requests).filter((request) => readObject(request) !== undefined);
     const warnings = readArray(payload.warnings).filter((warning) => typeof warning === "string");
@@ -1576,6 +1727,17 @@ function withProgramIdFallbackMetadata(payload, fallback) {
         program_id_resolution: resolution
     });
 }
+function withProgramIndexFallbackMetadata(payload, fallback) {
+    const enriched = withProgramIdFallbackMetadata(payload, fallback);
+    const resolution = readObject(enriched.program_id_resolution);
+    return {
+        ...enriched,
+        program_id_resolution: stripUndefined({
+            ...(resolution ?? {}),
+            reason: "program_index_detail_404"
+        })
+    };
+}
 async function resolveProgram(client, config, input) {
     const warnings = [];
     const budget = {
@@ -1583,10 +1745,11 @@ async function resolveProgram(client, config, input) {
         remaining: input.upstream_request_budget
     };
     const maxPages = clampLimit("max_pages", input.max_pages, MAX_FIND_PROGRAM_PAGES, warnings);
-    const collected = await collectPrograms(client, {
+    const searchQueries = programResolutionSearchQueries(input.query);
+    const collected = await collectProgramsForResolution(client, {
+        searchQueries,
         platforms: input.platforms,
         tags: input.tags,
-        updated_since: undefined,
         opportunity_levels: input.opportunity_levels,
         max_pages: maxPages,
         budget,
@@ -1608,6 +1771,7 @@ async function resolveProgram(client, config, input) {
         warnings: warnings.length > 0 ? warnings : undefined,
         query: {
             text: input.query,
+            search_queries: searchQueries,
             platforms: input.platforms.length > 0 ? input.platforms : undefined,
             tags: input.tags.length > 0 ? input.tags : undefined
         },
@@ -1715,6 +1879,31 @@ async function runResolvedProgramAction(client, config, programId, input) {
             include_ineligible: input.include_ineligible
         });
     }
+    if (input.action === "targets") {
+        const api = await client.getProgramTargets(programId);
+        const data = readObject(api.data);
+        const rawTargets = readArray(data?.targets);
+        const sanitizedTargets = rawTargets
+            .map(sanitizeTarget)
+            .filter((target) => targetHasAllowedScope(target, {
+            include_out_of_scope: input.include_out_of_scope,
+            include_ineligible: input.include_ineligible,
+            strict_scope_filter: true
+        }));
+        const targets = sanitizedTargets.slice(0, input.max_targets);
+        return withApiMetadata(api, {
+            program_id: programId,
+            targets: formatTargetList(targets, input.target_list_mode),
+            meta: {
+                limit: input.max_targets,
+                output_mode: input.target_list_mode,
+                total_active_targets: rawTargets.length,
+                total_after_filters: sanitizedTargets.length,
+                returned: targets.length,
+                has_more: sanitizedTargets.length > targets.length
+            }
+        });
+    }
     return checkProgramNewTargets(client, config, {
         program_id: programId,
         since: input.since,
@@ -2080,7 +2269,7 @@ function findLowNoisePrograms(client, config, input) {
         exclude_mobile_only: false,
         exclude_non_web: false,
         has_api_scope: false,
-        vdp_mode: input.require_bounty ? "exclude" : "include",
+        vdp_mode: "exclude",
         fresh_launch_days: undefined,
         min_wildcards: 0,
         min_eligible_targets: input.min_eligible_targets,
@@ -2616,11 +2805,132 @@ async function getLatestAddedTargets(client, config, input) {
         })
     });
 }
+async function getProgramTargetsPayload(client, input, programId) {
+    const api = await client.getProgramTargets(programId);
+    const data = readObject(api.data);
+    const rawTargets = readArray(data?.targets);
+    const sanitizedTargets = rawTargets.map(sanitizeTarget).filter((target) => targetHasAllowedScope(target, input));
+    const targets = sanitizedTargets.slice(input.offset, input.offset + input.limit);
+    return withApiMetadata(api, {
+        program_id: programId,
+        targets: formatTargetList(targets, input.output_mode),
+        meta: {
+            offset: input.offset,
+            limit: input.limit,
+            output_mode: input.output_mode,
+            total_active_targets: rawTargets.length,
+            total_after_filters: sanitizedTargets.length,
+            returned: targets.length,
+            has_more: input.offset + input.limit < sanitizedTargets.length,
+            target_source: "program_targets"
+        }
+    });
+}
+async function getProgramTargetsExportFallbackPayload(client, input, programId) {
+    const exportLookup = await fetchProgramTargetsFromExportFallback(client, programId);
+    const sanitizedTargets = exportLookup.rawTargets.filter((target) => targetHasAllowedScope(target, input));
+    const targets = sanitizedTargets.slice(input.offset, input.offset + input.limit);
+    return stripUndefined({
+        request_id: exportLookup.requestId,
+        upstream_request_id: exportLookup.upstreamRequestId,
+        fetched_at: exportLookup.fetchedAt,
+        cache: exportLookup.cache,
+        source_requests: exportLookup.sourceRequests,
+        warnings: exportLookup.warnings.length > 0 ? uniqueStrings(exportLookup.warnings) : undefined,
+        program_id: programId,
+        targets: formatTargetList(targets, input.output_mode),
+        meta: stripUndefined({
+            offset: input.offset,
+            limit: input.limit,
+            output_mode: input.output_mode,
+            total_active_targets: exportLookup.rawTargets.length,
+            total_after_filters: sanitizedTargets.length,
+            returned: targets.length,
+            has_more: input.offset + input.limit < sanitizedTargets.length,
+            target_source: exportLookup.source,
+            target_list_unavailable: exportLookup.unavailable,
+            fallback_error: exportLookup.error
+        })
+    });
+}
+async function fetchProgramTargetsFromExportFallback(client, programId) {
+    try {
+        const api = await client.exportTargets({
+            program_ids: [programId],
+            include_out_of_scope: true,
+            include_ineligible: true,
+            format: "json",
+            limit: MAX_TARGET_EXPORT
+        });
+        const rawTargets = readExportTargetRows(api.data).map((row) => sanitizeTarget(readObject(row)?.target ?? row));
+        return {
+            requestId: api.requestId,
+            upstreamRequestId: api.upstreamRequestId,
+            fetchedAt: api.fetchedAt,
+            cache: readObject(stripUndefined({
+                hit: api.cached,
+                coalesced_live_request: api.coalesced,
+                expires_at: api.cacheExpiresAt
+            })),
+            source: "target_export",
+            rawTargets,
+            sourceRequests: [
+                {
+                    source: "target_export",
+                    program_id: programId,
+                    request_id: api.requestId,
+                    upstream_request_id: api.upstreamRequestId,
+                    ...apiSourceMetadata(api)
+                }
+            ],
+            warnings: [`Used target export fallback because the per-program targets endpoint returned 404 for ${programId}.`],
+            unavailable: false
+        };
+    }
+    catch (error) {
+        return {
+            requestId: randomUUID(),
+            source: "unavailable",
+            rawTargets: [],
+            sourceRequests: [
+                {
+                    source: "target_export",
+                    program_id: programId,
+                    failed: true,
+                    error: programFetchError(programId, error)
+                }
+            ],
+            warnings: [
+                `The BBRadar program index contains ${programId}, but both the per-program targets endpoint and target export fallback were unavailable. Exact targets cannot be returned from the current API response.`
+            ],
+            unavailable: true,
+            error: programFetchError(programId, error)
+        };
+    }
+}
+function readExportTargetRows(data) {
+    if (Array.isArray(data)) {
+        return data;
+    }
+    const object = readObject(data);
+    if (!object) {
+        return [];
+    }
+    return [object.targets, object.results, object.data]
+        .map(readArray)
+        .find((rows) => rows.length > 0) ?? [];
+}
 async function getProgramScopeSummary(client, config, input) {
     const [programApi, targetsApi] = await Promise.all([client.getProgram(input.program_id), client.getProgramTargets(input.program_id)]);
     const targetsData = readObject(targetsApi.data);
     const rawTargets = readArray(targetsData?.targets);
-    const targets = rawTargets.map(sanitizeTarget);
+    const targets = rawTargets
+        .map(sanitizeTarget)
+        .filter((target) => targetHasAllowedScope(target, {
+        include_out_of_scope: input.include_out_of_scope,
+        include_ineligible: input.include_ineligible,
+        strict_scope_filter: false
+    }));
     return {
         request_id: randomUUID(),
         source_requests: [
@@ -2641,11 +2951,39 @@ async function getProgramScopeSummary(client, config, input) {
         scope: buildTargetScopeSummary(targets, input.target_list_mode, input.group_limit, input.include_out_of_scope, input.include_ineligible),
         meta: {
             total_active_targets: rawTargets.length,
+            total_after_filters: targets.length,
             target_list_mode: input.target_list_mode,
             group_limit: input.group_limit
         }
     };
 }
+async function getProgramScopeSummaryFromIndexFallback(client, indexFallback, input) {
+    const exportLookup = await fetchProgramTargetsFromExportFallback(client, input.program_id);
+    const targets = exportLookup.rawTargets.filter((target) => targetHasAllowedScope(target, {
+        include_out_of_scope: input.include_out_of_scope,
+        include_ineligible: input.include_ineligible,
+        strict_scope_filter: false
+    }));
+    return stripUndefined({
+        request_id: exportLookup.requestId,
+        upstream_request_id: exportLookup.upstreamRequestId,
+        fetched_at: exportLookup.fetchedAt,
+        cache: exportLookup.cache,
+        source_requests: exportLookup.sourceRequests,
+        warnings: exportLookup.warnings.length > 0 ? uniqueStrings(exportLookup.warnings) : undefined,
+        program: formatProgram(indexFallback.program, "compact"),
+        scope: buildTargetScopeSummary(targets, input.target_list_mode, input.group_limit, input.include_out_of_scope, input.include_ineligible),
+        meta: stripUndefined({
+            total_active_targets: exportLookup.rawTargets.length,
+            total_after_filters: targets.length,
+            target_list_mode: input.target_list_mode,
+            group_limit: input.group_limit,
+            target_source: exportLookup.source,
+            target_list_unavailable: exportLookup.unavailable,
+            fallback_error: exportLookup.error
+        })
+    });
+}
 async function getProgramTargetBreakdown(client, config, input) {
     const [programApi, targetsApi] = await Promise.all([client.getProgram(input.program_id), client.getProgramTargets(input.program_id)]);
     const targetsData = readObject(targetsApi.data);
@@ -2692,6 +3030,42 @@ async function getProgramTargetBreakdown(client, config, input) {
         }
     };
 }
+async function getProgramTargetBreakdownFromIndexFallback(client, indexFallback, input) {
+    const exportLookup = await fetchProgramTargetsFromExportFallback(client, input.program_id);
+    const targets = exportLookup.rawTargets.filter((target) => targetHasAllowedScope(target, {
+        include_out_of_scope: input.include_out_of_scope,
+        include_ineligible: input.include_ineligible,
+        strict_scope_filter: false
+    }));
+    const scope = buildTargetScopeSummary(targets, input.target_list_mode, input.group_limit, input.include_out_of_scope, input.include_ineligible);
+    return stripUndefined({
+        request_id: exportLookup.requestId,
+        upstream_request_id: exportLookup.upstreamRequestId,
+        fetched_at: exportLookup.fetchedAt,
+        cache: exportLookup.cache,
+        source_requests: exportLookup.sourceRequests,
+        warnings: exportLookup.warnings.length > 0 ? uniqueStrings(exportLookup.warnings) : undefined,
+        program: formatProgram(indexFallback.program, "compact"),
+        breakdown: {
+            target_counts: readObject(scope.target_counts),
+            by_target_type: countTargetValues(targets, (target) => stringField(target, "target_type")),
+            by_scope_tag: countTargetValues(targets, (target) => readStringArrayField(target, "scope_tags")),
+            by_language_tag: countTargetValues(targets, (target) => readStringArrayField(target, "language_tags")),
+            group_counts: readObject(scope.group_counts),
+            group_has_more: readObject(scope.group_has_more),
+            groups: readObject(scope.groups)
+        },
+        meta: stripUndefined({
+            total_active_targets: exportLookup.rawTargets.length,
+            total_after_filters: targets.length,
+            target_list_mode: input.target_list_mode,
+            group_limit: input.group_limit,
+            target_source: exportLookup.source,
+            target_list_unavailable: exportLookup.unavailable,
+            fallback_error: exportLookup.error
+        })
+    });
+}
 async function getProgramScopeDelta(client, config, input) {
     const programApi = await client.getProgram(input.program_id);
     const program = addProgramResourceLinks(sanitizeProgram(programApi.data, config.webBaseUrl));
@@ -2903,6 +3277,77 @@ async function checkProgramNewTargets(client, config, input) {
     });
     return programLookup.fallback ? withProgramIdFallbackMetadata(payload, programLookup.fallback) : payload;
 }
+async function checkProgramNewTargetsFromIndexedProgram(client, config, input, indexedProgram) {
+    const programId = input.program_id;
+    const handle = programSearchText(programId);
+    const api = await client.getRecentChanges({
+        change_type: "added",
+        include_removed: false,
+        include_ineligible: input.include_ineligible,
+        include_out_of_scope: false,
+        search: handle.length >= 2 ? handle : programId,
+        tags: input.target_type ? [input.target_type] : [],
+        page: 1,
+        page_size: input.page_size
+    });
+    const data = readObject(api.data);
+    const upstreamMeta = readObject(sanitizeJson(data?.meta));
+    const sinceTimestamp = input.since ? Date.parse(input.since) : undefined;
+    const changes = readArray(data?.results).map((change) => sanitizeChange(change, config.webBaseUrl));
+    const matchingChanges = changes
+        .filter((change) => {
+        const target = readObject(change.target);
+        const changedAt = timestampField(change, "changed_at");
+        return (stringField(change, "change_type") === "added" &&
+            stringField(readObject(change.program), "id") === programId &&
+            target !== undefined &&
+            (sinceTimestamp === undefined || changedAt >= sinceTimestamp) &&
+            (!input.target_type || targetMatchesRequestedType(target, input.target_type)) &&
+            targetHasAllowedScope(target, {
+                include_out_of_scope: false,
+                include_ineligible: input.include_ineligible,
+                strict_scope_filter: true
+            }));
+    })
+        .sort((left, right) => timestampField(right, "changed_at") - timestampField(left, "changed_at"));
+    const limitedChanges = matchingChanges.slice(0, input.max_targets);
+    const targets = limitedChanges
+        .map((change) => readObject(change.target))
+        .filter((target) => target !== undefined);
+    const latest = matchingChanges[0];
+    return stripUndefined({
+        request_id: randomUUID(),
+        source_requests: [
+            {
+                source: "recent_changes",
+                request_id: api.requestId,
+                upstream_request_id: api.upstreamRequestId,
+                ...apiSourceMetadata(api)
+            }
+        ],
+        program_id: programId,
+        program: latest
+            ? formatProgram(addProgramResourceLinks(readObject(latest.program) ?? {}), "compact")
+            : formatProgram(indexedProgram, "compact"),
+        has_new_targets: matchingChanges.length > 0,
+        new_target_count: matchingChanges.length,
+        latest_added_at: latest ? stringField(latest, "changed_at") : undefined,
+        new_targets: formatTargetList(targets, input.target_list_mode),
+        meta: stripUndefined({
+            recent_changes_scanned: changes.length,
+            returned: targets.length,
+            has_more: matchingChanges.length > targets.length,
+            since: input.since,
+            target_type: input.target_type,
+            in_scope_only: true,
+            include_ineligible: input.include_ineligible,
+            target_list_mode: input.target_list_mode,
+            program_detail_source: "program_index",
+            upstream_total_pages: readNumber(upstreamMeta?.total_pages),
+            scan_may_be_incomplete: (readNumber(upstreamMeta?.total_pages) ?? 1) > 1
+        })
+    });
+}
 async function checkWatchlistNewTargets(client, config, input) {
     const watchlist = new Set(input.program_ids);
     const api = await client.getRecentChanges({
@@ -3573,8 +4018,9 @@ function candidateLooksLikeVdp(candidate) {
     return candidateHasKnownNoBounty(candidate) || tagIncludesAnyNormalized(candidate.normalizedSearchSignals, VDP_SIGNALS);
 }
 function programResolutionMatch(candidate, query) {
-    const normalizedQuery = normalizeTag(query);
-    const queryTokens = tokenSet(normalizedQuery);
+    const queryVariants = programResolutionQueryVariants(query);
+    const primaryQuery = queryVariants[0] ?? normalizeTag(query);
+    const queryTokens = meaningfulProgramQueryTokens(query);
     const fields = [
         { name: "id", value: stringField(candidate.program, "id") },
         { name: "handle", value: stringField(candidate.program, "handle") },
@@ -3592,16 +4038,23 @@ function programResolutionMatch(candidate, query) {
         }
         const normalizedValue = normalizeTag(field.value);
         const fieldTokens = tokenSet(normalizedValue);
-        if (normalizedValue === normalizedQuery) {
-            score = Math.max(score, field.name === "id" || field.name === "handle" ? 100 : 95);
-            matchedFields.add(field.name);
-            reasons.add(`${field.name} exact match`);
-            continue;
-        }
-        if (normalizedValue.includes(normalizedQuery)) {
-            score = Math.max(score, field.name === "name" || field.name === "handle" ? 80 : 65);
-            matchedFields.add(field.name);
-            reasons.add(`${field.name} contains query`);
+        for (const queryVariant of queryVariants) {
+            if (normalizedValue === queryVariant) {
+                score = Math.max(score, field.name === "id" || field.name === "handle" ? 100 : 95);
+                matchedFields.add(field.name);
+                reasons.add(queryVariant === primaryQuery ? `${field.name} exact match` : `${field.name} exact meaningful-query match`);
+                continue;
+            }
+            if (normalizedValue.includes(queryVariant)) {
+                const containsScore = field.name === "name" || field.name === "handle"
+                    ? queryVariant.includes("-") || queryVariant.includes(" ")
+                        ? 90
+                        : 85
+                    : 70;
+                matchedFields.add(field.name);
+                score = Math.max(score, containsScore);
+                reasons.add(queryVariant === primaryQuery ? `${field.name} contains query` : `${field.name} contains meaningful query`);
+            }
         }
         const tokenOverlap = [...queryTokens].filter((token) => fieldTokens.has(token)).length;
         if (tokenOverlap > 0) {
@@ -3611,10 +4064,12 @@ function programResolutionMatch(candidate, query) {
             reasons.add(`${field.name} token match`);
         }
     }
-    if (candidate.normalizedSearchSignals.some((signal) => signal.includes(normalizedQuery))) {
-        score = Math.max(score, 55);
-        matchedFields.add("search_signals");
-        reasons.add("program search signals contain query");
+    for (const queryVariant of queryVariants) {
+        if (candidate.normalizedSearchSignals.some((signal) => signal.includes(queryVariant))) {
+            score = Math.max(score, queryVariant === primaryQuery ? 55 : 65);
+            matchedFields.add("search_signals");
+            reasons.add(queryVariant === primaryQuery ? "program search signals contain query" : "program search signals contain meaningful query");
+        }
     }
     return {
         score,
@@ -3622,6 +4077,25 @@ function programResolutionMatch(candidate, query) {
         reasons: [...reasons]
     };
 }
+function programResolutionSearchQueries(query) {
+    return programResolutionQueryVariants(query).slice(0, MAX_RESOLVE_SEARCH_QUERIES);
+}
+function programResolutionQueryVariants(query) {
+    const normalized = normalizeTag(query);
+    const meaningfulTokens = [...meaningfulProgramQueryTokens(query)];
+    const meaningfulPhrase = meaningfulTokens.join(" ");
+    const values = [
+        normalized,
+        meaningfulPhrase,
+        meaningfulTokens.join("-"),
+        ...meaningfulTokens
+    ];
+    return uniqueStrings(values.filter((value) => value.length >= 2));
+}
+function meaningfulProgramQueryTokens(query) {
+    const tokens = [...tokenSet(normalizeTag(query))].filter((token) => !PROGRAM_RESOLUTION_STOP_WORDS.has(token));
+    return new Set(tokens.length > 0 ? tokens : [...tokenSet(normalizeTag(query))]);
+}
 function normalizedCandidateValues(program, normalizedScopeTags) {
     return [
         stringField(program, "id"),
@@ -3672,9 +4146,14 @@ function programHandleText(programId) {
     const colonIndex = programId.indexOf(":");
     return colonIndex >= 0 ? programId.slice(colonIndex + 1) : programId;
 }
+function programPlatformText(programId) {
+    const colonIndex = programId.indexOf(":");
+    return colonIndex >= 0 ? programId.slice(0, colonIndex) : "";
+}
 function normalizeFindProgramsInput(input) {
     const warnings = [];
     const normalized = { ...input };
+    normalized.vdp_mode ??= "exclude";
     normalized.max_pages = clampLimit("max_pages", normalized.max_pages, MAX_FIND_PROGRAM_PAGES, warnings);
     normalized.max_results = clampLimit("max_results", normalized.max_results, MAX_FIND_PROGRAM_RESULTS, warnings);
     normalized.target_sample_programs = clampLimit("target_sample_programs", normalized.target_sample_programs, MAX_FIND_TARGET_SAMPLE_PROGRAMS, warnings);
@@ -3805,6 +4284,55 @@ async function collectPrograms(client, options) {
         totalPagesBySource
     };
 }
+async function collectProgramsForResolution(client, options) {
+    const collections = [];
+    const queries = options.searchQueries.length > 0 ? options.searchQueries : [undefined];
+    for (const search of queries) {
+        if (options.budget.remaining <= 0) {
+            addUniqueWarning(options.warnings, "Upstream request budget was exhausted before all program name search variants could be checked.");
+            break;
+        }
+        collections.push(await collectPrograms(client, {
+            search,
+            platforms: options.platforms,
+            tags: options.tags,
+            updated_since: undefined,
+            opportunity_levels: options.opportunity_levels,
+            max_pages: options.max_pages,
+            budget: options.budget,
+            warnings: options.warnings
+        }));
+    }
+    if (collections.length === 0) {
+        return {
+            programs: [],
+            sourceRequests: [],
+            requestsScanned: 0,
+            programsScanned: 0,
+            totalPagesBySource: {}
+        };
+    }
+    return mergeProgramCollections(collections);
+}
+function mergeProgramCollections(collections) {
+    const programs = new Map();
+    const totalPagesBySource = {};
+    for (const collection of collections) {
+        for (const program of collection.programs) {
+            programs.set(programKey(program, programs.size), program);
+        }
+        for (const [sourceName, totalPages] of Object.entries(collection.totalPagesBySource)) {
+            totalPagesBySource[sourceName] = totalPages;
+        }
+    }
+    return {
+        programs: [...programs.values()],
+        sourceRequests: collections.flatMap((collection) => collection.sourceRequests),
+        requestsScanned: collections.reduce((total, collection) => total + collection.requestsScanned, 0),
+        programsScanned: programs.size,
+        totalPagesBySource
+    };
+}
 async function collectProgramSources(client, sources, options) {
     const pages = [];
     await mapWithConcurrency(sources.map((source, sourceIndex) => ({ source, sourceIndex })), PROGRAM_COLLECTION_CONCURRENCY, async ({ source, sourceIndex }) => {
@@ -3849,6 +4377,7 @@ async function fetchProgramPage(client, source, sourceIndex, page, options) {
     const runWithSlot = options.runWithProgramPageSlot ?? runImmediately;
     return runWithSlot(async () => {
         const query = toQuery({
+            search: options.search,
             platforms: options.platforms,
             tags: options.tags,
             updated_since: options.updated_since,
@@ -3864,14 +4393,16 @@ async function fetchProgramPage(client, source, sourceIndex, page, options) {
         const data = readObject(api.data);
         const meta = readObject(data?.meta);
         const sourceName = source.kind === "opportunity" ? `opportunities:${source.level}` : "programs";
+        const labeledSourceName = options.search ? `${sourceName}:search:${normalizeTag(options.search)}` : sourceName;
         return {
-            sourceName,
+            sourceName: labeledSourceName,
             sourceIndex,
             page,
             programs: readArray(data?.programs),
             totalPages: readNumber(meta?.total_pages),
             sourceRequest: stripUndefined({
-                source: sourceName,
+                source: labeledSourceName,
+                search: options.search,
                 request_id: api.requestId,
                 upstream_request_id: api.upstreamRequestId,
                 ...apiSourceMetadata(api),
@@ -3994,13 +4525,7 @@ function programCandidateMatches(candidate, filters) {
     if (filters.contest_like === true && !candidateLooksContestLike(candidate)) {
         return false;
     }
-    if (filters.vdp_mode === "exclude" && candidateLooksLikeVdp(candidate)) {
-        return false;
-    }
-    if (filters.vdp_mode === "only_likely" && !candidateLooksLikeVdp(candidate)) {
-        return false;
-    }
-    if (filters.vdp_mode === "only_known_no_bounty" && !candidateHasKnownNoBounty(candidate)) {
+    if (!candidateMatchesVdpMode(candidate, filters.vdp_mode ?? "exclude")) {
         return false;
     }
     if (filters.fresh_launch_days !== undefined) {
@@ -4061,6 +4586,18 @@ function compareProgramCandidates(left, right, sortBy) {
         right.firstSeenTime - left.firstSeenTime ||
         right.lastUpdatedTime - left.lastUpdatedTime);
 }
+function candidateMatchesVdpMode(candidate, vdpMode) {
+    if (vdpMode === "exclude") {
+        return !candidateLooksLikeVdp(candidate);
+    }
+    if (vdpMode === "only_likely") {
+        return candidateLooksLikeVdp(candidate);
+    }
+    if (vdpMode === "only_known_no_bounty") {
+        return candidateHasKnownNoBounty(candidate);
+    }
+    return true;
+}
 async function collectTargetSamples(client, candidates, input, budget) {
     const samples = {};
     const sampleCandidates = candidates.slice(0, input.target_sample_programs);
@@ -4263,7 +4800,7 @@ function registerPrompts(server) {
 
 Find the best BBRadar program candidates.
 - Start with find_program_candidates unless the user needs custom filters; pass opportunity_levels from this JSON array unless the user asked for a broader search: ${promptJson([args.opportunity_level ?? "elite"])}.
-- Use find_language_programs for language asks, find_target_type_programs for API/mobile/source-code/domain asks, find_reward_programs or find_paid_programs for reward asks, find_vdp_programs for VDP/no-bounty asks, find_web3_contests for Web3 contest/audit asks, find_web3_programs for general Web3 requests, and find_wildcard_programs for wildcard-specific requests.
+- Use find_language_programs for language asks, find_target_type_programs for API/mobile/source-code/domain asks, find_reward_programs or find_paid_programs for reward asks, find_vdp_programs only for explicit VDP/no-bounty asks, find_web3_contests for Web3 contest/audit asks, find_web3_programs for general Web3 requests, and find_wildcard_programs for wildcard-specific requests.
 - Apply platform filters from this JSON string if provided: ${promptJson(args.platforms ?? "")}.
 - Apply tag filters from this JSON string if provided: ${promptJson(args.tags ?? "")}.
 - Keep the shortlist to this JSON value: ${promptJson(args.max_programs ?? "10")}.
@@ -4273,16 +4810,16 @@ Find the best BBRadar program candidates.
 - Stay passive-only; do not recommend scanning, probing, exploit attempts, or direct contact with targets.`));
     server.registerPrompt("summarize_program_scope", {
         title: "Summarize Program Scope",
-        description: "Summarize in-scope and out-of-scope BBRadar target data for one program.",
+        description: "Summarize BBRadar target data for one program.",
         argsSchema: {
             program_id: programIdSchema
         }
-    }, (args) => promptResult(`Use get_program for the program_id in this JSON string: ${promptJson(args.program_id)}. Then use get_program_targets with include_out_of_scope=true, include_ineligible=true, and limit=${MAX_TARGETS_PER_PROGRAM}.
+    }, (args) => promptResult(`Use get_program for the program_id in this JSON string: ${promptJson(args.program_id)}. Then use get_program_targets with include_out_of_scope=false, include_ineligible=false, and limit=${MAX_TARGETS_PER_PROGRAM}. Only request out-of-scope or ineligible targets if the user explicitly asks for them.
 
 Summarize the program scope:
 - Program name, platform, reward range, public report count, first seen date, last updated date, and BBRadar URL.
 - In-scope bounty-eligible target categories.
-- Out-of-scope or ineligible target categories.
+- Out-of-scope or ineligible target categories only if explicitly requested.
 - Wildcards, high-severity target labels, and notable language or scope tags.
 - Recent target update signals if present.
 - Do not contact, scan, probe, or validate any listed target.`));