@bbradar/mcp 0.2.5 → 0.3.0

package/benchmark/pro-benchmark.mjs

@@ -0,0 +1,106 @@
+import http from "node:http";
+import { performance } from "node:perf_hooks";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+import { BBRadarClient } from "../dist/bbradarClient.js";
+import { createBbradarServer } from "../dist/server.js";
+
+const counters = { requests: 0, bytes: 0, active: 0, peak: 0 };
+const historyRows = Array.from({ length: 10 }, (_, i) => ({ id: `c${i}`, program: { id: "HackerOne:bench" }, category: "scope", observed_at: "2026-09-24T00:00:00Z" }));
+const responses = {
+  "/pro/history/changes": { changes: historyRows, coverage: { capture_enabled: true }, meta: { has_more: false, next_cursor: null } },
+  "/pro/activity/programs/HackerOne:bench": { program_id: "HackerOne:bench", activity_summary: { additions: 0, last_observed_at: null } },
+  "/pro/analytics/programs/activity": { programs: historyRows.map((row) => ({ id: row.program.id, activity_days: 1 })), meta: { generation: 3, provisional: false, unsupported_metrics: ["repository_changes"] } }
+};
+// Activity catalog: every fifth program passes the Web2, wildcard, competition
+// and fee filters of the combined benchmark question.
+const catalog = Array.from({ length: 250 }, (_, i) => ({ id: `HackerOne:p${i}`, platform: "HackerOne", handle: `p${i}`, name: `Program ${i}`, program_type: "paid", is_active: true,
+  bounty_min: 100, bounty_max: 5000, report_count: 10, competition_risk: i % 5 === 3 ? "High" : "Low",
+  scope_tags: i % 5 === 1 ? ["smart-contract"] : ["domain", "api", "wildcard"], submission_cost: i % 5 === 2 ? { amount: 25, maximum_amount: 25 } : null,
+  target_counts: { total: 30, in_scope: 30, eligible_for_bounty: 30, wildcard: i % 5 === 4 ? 0 : 3 }, payout_summary: { "30d": { amount: "1500", currency: "USD" } } }));
+const catalogEndpoint = { enabled: true, max_page_size: 100, activity_filters: { enabled: true }, catalog_filters: { enabled: true } };
+function catalogPage(url) {
+  const page = Number(url.searchParams.get("page") ?? 1), size = Number(url.searchParams.get("page_size") ?? 50);
+  return { programs: catalog.slice((page - 1) * size, page * size), meta: { page, page_size: size, total: catalog.length, total_pages: Math.ceil(catalog.length / size), activity_snapshot_id: "a".repeat(64) } };
+}
+const api = http.createServer(async (req, res) => {
+  const url = new URL(req.url, "http://fixture");
+  const path = url.pathname.replace(/^\/api\/v1/, "");
+  counters.requests += 1;
+  counters.active += 1;
+  counters.peak = Math.max(counters.peak, counters.active);
+  await new Promise((resolve) => setTimeout(resolve, 5));
+  const payload = path === "/pro/capabilities"
+    ? { contract_version: "2026-10-06", endpoints: { ...Object.fromEntries(["history_changes", "history_change_detail", "program_activity", "analytics_program_activity", "activity_rankings"].map((key) => [key, { enabled: true, history_capture_enabled: true }])), programs: catalogEndpoint, opportunities: catalogEndpoint, program_targets: { max_page_size: 500 } } }
+    : path === "/pro/programs" ? catalogPage(url)
+    : /^\/pro\/programs\/.+\/targets$/.test(path) ? { targets: [{ identifier: "api.example.test", target_type: "domain", in_scope: true, eligible_for_bounty: true }], meta: { total: 1, total_pages: 1 } }
+    : path === "/pro/activity/rankings" ? { tab: "payouts", period: "30d", sort: "paid", direction: "desc", rows: catalog.slice(0, 10).map((program) => ({ program, paid: program.payout_summary["30d"] })), capabilities: { tabs: [{ id: "payouts", views: [] }], facets: { tags: Array.from({ length: 300 }, (_, i) => `tag-${i}`) } }, meta: { total: 250, has_more: true, next_cursor: "next", snapshot_id: "a".repeat(64) } }
+    : path.startsWith("/pro/history/changes/")
+      ? { change: historyRows[0], items: [{ before: null, after: { count: 0 } }], meta: { has_more: false } }
+      : responses[path] ?? { detail: "missing" };
+  const body = JSON.stringify(payload);
+  counters.bytes += Buffer.byteLength(body);
+  res.setHeader("content-type", "application/json");
+  res.setHeader("cache-control", "private, no-store");
+  res.end(body);
+  counters.active -= 1;
+});
+
+await new Promise((resolve) => api.listen(0, "127.0.0.1", resolve));
+const base = `http://127.0.0.1:${api.address().port}/api/v1`;
+const options = { apiKey: "benchmark", apiBaseUrl: base, webBaseUrl: "https://bbradar.io", cacheTtlMs: 30_000, negativeCacheTtlMs: 15_000, cacheMaxEntries: 50, defaultRateLimitPerMinute: 60, exportRateLimitPerMinute: 15, maxConcurrentRequests: 6, compactToolText: true, toolProfile: "core", requestTimeoutMs: 5_000, validateOnStartup: false };
+const upstream = new BBRadarClient(options);
+await upstream.negotiateCapabilities();
+const server = createBbradarServer(upstream, options);
+const client = new Client({ name: "pro-benchmark", version: "1" });
+const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+await Promise.all([server.connect(serverTransport), client.connect(clientTransport)]);
+
+function reset() { counters.requests = 0; counters.bytes = 0; counters.peak = 0; }
+function percentile(values, p) { const sorted = [...values].sort((a, b) => a - b); return Math.round(sorted[Math.min(sorted.length - 1, Math.ceil(p * sorted.length) - 1)] * 100) / 100; }
+async function measure(name, args) {
+  reset();
+  const timings = [];
+  let result;
+  const heapBefore = process.memoryUsage().heapUsed;
+  for (let i = 0; i < 20; i += 1) {
+    const start = performance.now();
+    result = await client.callTool({ name, arguments: args });
+    timings.push(performance.now() - start);
+    if (result.isError) throw new Error(`${name} failed`);
+  }
+  return { calls: 20, upstream_requests: counters.requests, upstream_bytes: counters.bytes, model_text_bytes: Buffer.byteLength(result.content[0].text), structured_bytes: Buffer.byteLength(JSON.stringify(result.structuredContent)), p50_ms: percentile(timings, .5), p95_ms: percentile(timings, .95), heap_delta_bytes: process.memoryUsage().heapUsed - heapBefore };
+}
+
+async function measureDirect(path) {
+  reset();
+  const timings = [];
+  for (let i = 0; i < 20; i += 1) {
+    const start = performance.now();
+    const response = await fetch(base + path, { headers: { authorization: "Bearer benchmark" } });
+    await response.arrayBuffer();
+    timings.push(performance.now() - start);
+  }
+  return { calls: 20, upstream_requests: counters.requests, upstream_bytes: counters.bytes, p50_ms: percentile(timings, .5), p95_ms: percentile(timings, .95) };
+}
+
+try {
+  const directHistory = await measureDirect("/pro/history/changes?limit=10");
+  const history = await measure("get_history_changes", { limit: 10 });
+  const detail = await measure("get_history_change_detail", { change_id: "c0", limit: 1 });
+  const activity = await measure("get_program_activity", { program_id: "HackerOne:bench" });
+  const analytics = await measure("get_analytics_program_activity", { limit: 10 });
+  const activityRanking = await measure("get_activity_rankings", { tab: "payouts", period: "30d", limit: 10 });
+  // "Recent payouts, low competition, new scope, wide Web2 scope, no submission fee" in one call.
+  const question = { payout_period: "30d", payout_positive: true, scope_period: "30d", scope_added_min: 1, exclude_web3: true, min_wildcards: 1, competition_risks: ["Low"], free_submission_only: true };
+  const combinedQuestion = await measure("find_programs", { ...question, max_results: 10 });
+  const combinedHunt = await measure("find_hunt_targets", { payout_period: "30d", payout_positive: true, scope_period: "30d", scope_added_min: 1, surface_mode: "web2", min_wildcards: 1, free_submission_only: true, include_recent_changes: false, max_results: 5 });
+  reset();
+  const heapBefore = process.memoryUsage().heapUsed;
+  const parallel = await Promise.all(Array.from({ length: 10 }, (_, i) => client.callTool({ name: "get_history_changes", arguments: { search: `bench${i}`, limit: 1 } })));
+  const concurrency = { calls: parallel.length, upstream_requests: counters.requests, peak_upstream_requests: counters.peak, heap_delta_bytes: process.memoryUsage().heapUsed - heapBefore };
+  if ([history, detail, activity, analytics, activityRanking, combinedQuestion].some((entry) => entry.upstream_requests !== 20) || concurrency.peak_upstream_requests > 2 || concurrency.upstream_requests !== 10) throw new Error("Pro request-count or shared-concurrency regression");
+  // The candidate pool's catalog pages plus one exact target sample per finalist.
+  if (combinedHunt.upstream_requests > 20 * (3 + 5)) throw new Error(`Activity hunt request-count regression: ${combinedHunt.upstream_requests}`);
+  process.stdout.write(JSON.stringify({ fixture: true, simulated_upstream_delay_ms: 5, direct_history: directHistory, estimated_mcp_overhead_p50_ms: Math.round((history.p50_ms - directHistory.p50_ms) * 100) / 100, history_lazy_detail: { eager_baseline_requests: 11, feed_only_requests: 1, requested_detail_requests: 2 }, tools: { history, detail, activity, analytics, activity_ranking: activityRanking, combined_question: combinedQuestion, combined_hunt: combinedHunt }, concurrency }, null, 2) + "\n");
+} finally { await client.close(); await server.close(); api.close(); }

package/dist/activityContract.d.ts

@@ -0,0 +1,2 @@
+/** Catalog metadata stays available when Activity computation is disabled. */
+export declare function requiresActivityQuery(input?: Record<string, unknown>): boolean;

package/dist/activityContract.js

@@ -0,0 +1,15 @@
+const ACTIVITY_FILTERS = new Set([
+    "payout_metric", "payout_period", "payout_currency", "payout_precision", "payout_min", "payout_max",
+    "payout_positive", "payout_activity", "scope_period", "scope_added_min", "scope_removed_min",
+    "scope_net_min", "scope_net_max", "reward_period", "reward_change", "reward_change_min_pct",
+    "updates_period", "active_days_min", "changes_min", "change_category", "reports_period",
+    "reports_min", "reports_max", "reports_change", "reports_change_min_pct", "launched_within",
+    "resolved_period", "resolved_min", "last_resolved_within", "first_response_max_hours",
+    "time_to_bounty_max_hours", "status_period", "status_change", "current_status", "activity_labels",
+]);
+/** Catalog metadata stays available when Activity computation is disabled. */
+export function requiresActivityQuery(input = {}) {
+    return Object.entries(input).some(([key, value]) => value !== undefined && value !== null
+        && (key === "sort_by" ? value !== "updated" : ACTIVITY_FILTERS.has(key)));
+}
+//# sourceMappingURL=activityContract.js.map

package/dist/activityContract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"activityContract.js","sourceRoot":"","sources":["../src/activityContract.ts"],"names":[],"mappings":"AAAA,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,YAAY,EAAE,YAAY;IACnG,iBAAiB,EAAE,iBAAiB,EAAE,cAAc,EAAE,iBAAiB,EAAE,mBAAmB;IAC5F,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,uBAAuB;IAC3F,gBAAgB,EAAE,iBAAiB,EAAE,aAAa,EAAE,iBAAiB,EAAE,gBAAgB;IACvF,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,iBAAiB;IAC3F,iBAAiB,EAAE,cAAc,EAAE,sBAAsB,EAAE,0BAA0B;IACrF,0BAA0B,EAAE,eAAe,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB;CAClG,CAAC,CAAC;AAEH,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB,CAAC,QAAiC,EAAE;IACvE,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;WACpF,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC"}

package/dist/bbradarClient.d.ts

@@ -9,8 +9,9 @@ export type ApiRequestOptions = {
     coalesce?: boolean;
     staleWhileRevalidateMs?: number;
     timeoutMs?: number;
+    signal?: AbortSignal;
 };
-export type ApiReadControls = Pick<ApiRequestOptions, "cache" | "coalesce" | "timeoutMs">;
+export type ApiReadControls = Pick<ApiRequestOptions, "cache" | "coalesce" | "timeoutMs" | "signal">;
 export type ApiResult<T> = {
     data: T;
     requestId: string;
@@ -21,6 +22,7 @@ export type ApiResult<T> = {
     fetchedAt: string;
     cacheExpiresAt?: string | undefined;
     stale?: boolean | undefined;
+    noStore?: boolean | undefined;
 };
 type CapabilityNegotiationState = {
     status: "not_started" | "negotiated" | "legacy" | "failed";
@@ -37,6 +39,7 @@ export declare class BBRadarApiError extends Error {
     readonly cached: boolean;
     readonly coalesced: boolean;
     readonly cacheExpiresAt: string | undefined;
+    readonly cacheAllowed: boolean;
     constructor(params: {
         message: string;
         requestId: string;
@@ -47,6 +50,7 @@ export declare class BBRadarApiError extends Error {
         cached?: boolean | undefined;
         coalesced?: boolean | undefined;
         cacheExpiresAt?: string | undefined;
+        cacheAllowed?: boolean | undefined;
         cause?: unknown;
     });
 }
@@ -55,6 +59,8 @@ export declare class BBRadarClient {
     private readonly cache;
     private readonly negativeCache;
     private readonly inFlight;
+    private readonly sharedRequests;
+    private readonly requestContext;
     private readonly endpointMetrics;
     private readonly requestQueue;
     private readonly endpointRequestQueues;
@@ -67,6 +73,7 @@ export declare class BBRadarClient {
     private capabilityNegotiation;
     private capabilityState;
     constructor(config: ServerConfig);
+    withRequestContext<T>(signal: AbortSignal, callback: () => T | Promise<T>, snapshotStart?: boolean): Promise<T>;
     diagnostics(): {
         response_cache: {
             entries: number;
@@ -192,8 +199,21 @@ export declare class BBRadarClient {
     getRepositoryChanges(query: Record<string, QueryValue>, controls?: ApiReadControls): Promise<ApiResult<unknown>>;
     searchTargets(query: Record<string, QueryValue>, controls?: ApiReadControls): Promise<ApiResult<unknown>>;
     getOpportunities(level: string, query: Record<string, QueryValue>): Promise<ApiResult<unknown>>;
+    getHistoryChanges(query: Record<string, QueryValue>): Promise<ApiResult<unknown>>;
+    getHistoryChangeDetail(changeId: string, query: Record<string, QueryValue>): Promise<ApiResult<unknown>>;
+    getProgramHistory(programId: string, query: Record<string, QueryValue>): Promise<ApiResult<unknown>>;
+    getProgramActivity(programId: string): Promise<ApiResult<unknown>>;
+    getActivityCapabilities(query?: Record<string, QueryValue>): Promise<ApiResult<unknown>>;
+    getActivitySnapshot(): Promise<ApiResult<unknown>>;
+    getActivityRankings(query: Record<string, QueryValue>): Promise<ApiResult<unknown>>;
+    getActivityChangeDetail(eventId: string, query: Record<string, QueryValue>): Promise<ApiResult<unknown>>;
+    getProgramPayouts(programId: string, query?: Record<string, QueryValue>): Promise<ApiResult<unknown>>;
+    getAnalyticsPlatformSeries(platform: string, query: Record<string, QueryValue>): Promise<ApiResult<unknown>>;
+    getAnalyticsProgramActivity(query: Record<string, QueryValue>): Promise<ApiResult<unknown>>;
+    getAnalyticsProgramDetail(programId: string, query: Record<string, QueryValue>): Promise<ApiResult<unknown>>;
     exportTargets(body: Record<string, unknown>): Promise<ApiResult<unknown>>;
     request<T = unknown>(options: ApiRequestOptions): Promise<ApiResult<T>>;
+    private requestWithSignal;
     private fetchFromApi;
     private refreshInBackground;
     private withRequestSlot;