@certscore/mcp 0.2.18 → 0.2.20

package/dist/server.d.ts

@@ -1,5 +1,7 @@
+import { type McpCallerInput } from "@website-signal-risk-scanner/shared/dist/mcp-caller-input.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import type { RequestInfo } from "@modelcontextprotocol/sdk/types.js";
+import { type RequestInfo } from "@modelcontextprotocol/sdk/types.js";
+import { type McpTaskContext } from "@website-signal-risk-scanner/shared/dist/mcp-product-context.js";
 export interface CertScoreMcpOptions {
     apiKey?: string;
     baseUrl?: string;
@@ -18,6 +20,27 @@ export type McpToolInvocationRequestContext = {
     headers: RequestInfo["headers"] | null;
 };
 export type McpToolInvocationObservation = {
+    callerInput?: McpCallerInput;
+    captureBasis?: "protocol_request";
+    taskContext?: McpTaskContext;
+    response?: {
+        bytes: number;
+        truncated: boolean | null;
+        effectiveMaxBytes?: number;
+    };
+    requestArguments?: {
+        values: Record<string, string | number | boolean>;
+        omitted: boolean;
+    };
+    rateLimit?: {
+        kind: "scan_creation" | "upstream";
+        retryAfterSeconds?: number;
+        scope?: string;
+        windowId?: string;
+        limit?: number;
+        used?: number;
+        windowSeconds?: number;
+    };
     durationMs: number;
     errorCode: string | null;
     freshness: "latest" | "refresh" | null;
@@ -34,6 +57,11 @@ export type McpToolInvocationObservation = {
     toolName: string;
     transportOutcome: "mcp_result" | "mcp_error";
 };
+/** Retain only bounded tool options; URL paths, queries and unknown/free-text inputs are omitted. */
+export declare function projectMcpTelemetryArguments(args: Record<string, unknown>): {
+    values: Record<string, string | number | boolean>;
+    omitted: boolean;
+};
 export declare function projectMcpToolInvocationObservation(input: {
     args: unknown;
     durationMs: number;

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AAItE,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,wBAAwB,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC,SAAS,CAAC,KAAK,MAAM,GAAG,IAAI,CAAC;IAC9E,gCAAgC,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACvD,wBAAwB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,gBAAgB,CAAC,EAAE,WAAW,GAAG,eAAe,GAAG,IAAI,CAAC;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACxC,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,gBAAgB,CAAC,EAAE,CACjB,WAAW,EAAE,4BAA4B,EACzC,cAAc,EAAE,+BAA+B,KAC5C,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAID,MAAM,MAAM,+BAA+B,GAAG;IAC5C,OAAO,EAAE,WAAW,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;CACxC,CAAC;AA4BF,MAAM,MAAM,4BAA4B,GAAG;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,QAAQ,GAAG,SAAS,GAAG,IAAI,CAAC;IACvC,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,SAAS,GAAG,OAAO,GAAG,cAAc,CAAC;IAC9C,YAAY,EAAE,SAAS,GAAG,cAAc,CAAC;IACzC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,qBAAqB,EAAE,KAAK,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC;IACtE,YAAY,EAAE,QAAQ,GAAG,KAAK,GAAG,aAAa,GAAG,gBAAgB,CAAC;IAClE,QAAQ,EAAE,OAAO,GAAG,OAAO,GAAG,YAAY,GAAG,IAAI,CAAC;IAClD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,YAAY,GAAG,WAAW,CAAC;CAC9C,CAAC;AAqKF,wBAAgB,mCAAmC,CAAC,KAAK,EAAE;IACzD,IAAI,EAAE,OAAO,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,4BAA4B,CAqD/B;AAkBD,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,mBAAwB,aAwZzE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,KAAK,cAAc,EAAE,MAAM,8DAA8D,CAAC;AAG1H,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAyB,KAAK,WAAW,EAAE,MAAM,oCAAoC,CAAC;AAC7F,OAAO,EAA0B,KAAK,cAAc,EAAE,MAAM,iEAAiE,CAAC;AAI9H,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,wBAAwB,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC,SAAS,CAAC,KAAK,MAAM,GAAG,IAAI,CAAC;IAC9E,gCAAgC,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACvD,wBAAwB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,gBAAgB,CAAC,EAAE,WAAW,GAAG,eAAe,GAAG,IAAI,CAAC;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACxC,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,gBAAgB,CAAC,EAAE,CACjB,WAAW,EAAE,4BAA4B,EACzC,cAAc,EAAE,+BAA+B,KAC5C,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAID,MAAM,MAAM,+BAA+B,GAAG;IAC5C,OAAO,EAAE,WAAW,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;CACxC,CAAC;AA4BF,MAAM,MAAM,4BAA4B,GAAG;IACzC,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,QAAQ,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpF,gBAAgB,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAC3F,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,eAAe,GAAG,UAAU,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzK,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,QAAQ,GAAG,SAAS,GAAG,IAAI,CAAC;IACvC,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,SAAS,GAAG,OAAO,GAAG,cAAc,CAAC;IAC9C,YAAY,EAAE,SAAS,GAAG,cAAc,CAAC;IACzC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,qBAAqB,EAAE,KAAK,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC;IACtE,YAAY,EAAE,QAAQ,GAAG,KAAK,GAAG,aAAa,GAAG,gBAAgB,CAAC;IAClE,QAAQ,EAAE,OAAO,GAAG,OAAO,GAAG,YAAY,GAAG,IAAI,CAAC;IAClD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,YAAY,GAAG,WAAW,CAAC;CAC9C,CAAC;AAqKF,qGAAqG;AACrG,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;EAwBzE;AAED,wBAAgB,mCAAmC,CAAC,KAAK,EAAE;IACzD,IAAI,EAAE,OAAO,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,4BAA4B,CAuD/B;AAiCD,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,mBAAwB,aA2azE"}

package/dist/server.js

@@ -1,6 +1,9 @@
+import { captureMcpCallerInput } from "@website-signal-risk-scanner/shared/dist/mcp-caller-input.js";
 import { CertScoreClient } from "@certscore/sdk";
 import { certScoreMcpToolContracts, isCanonicalScanId } from "@certscore/api-contracts";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { CallToolRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+import { sanitizeMcpTaskContext } from "@website-signal-risk-scanner/shared/dist/mcp-product-context.js";
 import { CERTSCORE_MCP_VERSION } from "./version.js";
 import { boundEvidencePacket, buildScanBundle, exportFindings, findingListText, limitPreConsentRows, markdownReportText, MAX_EVIDENCE_PACKET_CHARS, normalizeDetail, normalizeFormat, paginateFindingList, preConsentInventoryText, pulseReportText, scanBundleText, scanSiteText, scanStatusText, toInvalidArgumentsToolError, toInvalidScanIdToolError, toToolError, toToolResult, withMcpAgentGuidance, withMcpScanProvenanceGuidance } from "./tools.js";
 const LIGHT_MCP_BUNDLE_RESPONSE_CEILING_BYTES = 25_000;
@@ -159,6 +162,38 @@ function isCertScoreCanaryUrl(value) {
         return false;
     }
 }
+/** Retain only bounded tool options; URL paths, queries and unknown/free-text inputs are omitted. */
+export function projectMcpTelemetryArguments(args) {
+    const values = {};
+    const options = {
+        freshness: ["latest", "refresh"], scanFrom: ["eu_de", "eu_ie", "california"],
+        detail: ["tiny", "quick", "standard", "full", "summary", "evidence", "findings"], format: ["json", "markdown"],
+    };
+    for (const [key, allowed] of Object.entries(options)) {
+        if (typeof args[key] === "string" && allowed.includes(args[key]))
+            values[key] = args[key];
+    }
+    for (const key of ["scanId", "jobId", "findingId"]) {
+        const token = boundedTelemetryToken(args[key], 128);
+        if (token)
+            values[key] = token;
+    }
+    for (const key of ["maxWaitSeconds", "maxBytes", "maxFindings", "maxPreConsentRows", "maxRows", "limit", "offset"]) {
+        const value = args[key];
+        if (typeof value === "number" && Number.isInteger(value) && value >= 0 && value <= 1_000_000)
+            values[key] = value;
+    }
+    if (typeof args.waitForCompletion === "boolean")
+        values.waitForCompletion = args.waitForCompletion;
+    const url = telemetryUrl(args.url);
+    if (url)
+        values.url = url;
+    const domain = telemetryHostname(args.domain);
+    if (domain && /^[a-z0-9.-]+$/.test(domain))
+        values.domain = domain;
+    const omitted = Object.keys(args).some((key) => !(key in values) || args[key] !== values[key]);
+    return { values, omitted };
+}
 export function projectMcpToolInvocationObservation(input) {
     const args = input.args && typeof input.args === "object" && !Array.isArray(input.args)
         ? input.args
@@ -192,6 +227,8 @@ export function projectMcpToolInvocationObservation(input) {
                     ? "new"
                     : "unavailable";
     return {
+        requestArguments: projectMcpTelemetryArguments(args),
+        ...(rateLimited ? { rateLimit: projectMcpRateLimit(error ?? result) } : {}),
         durationMs: Math.max(0, Math.min(Math.round(input.durationMs), 3_600_000)),
         errorCode: rateLimited ? "rate_limited" : errorCode,
         freshness: args.freshness === "refresh" ? "refresh" : input.toolName === "certscore_scan_site" ? "latest" : null,
@@ -212,6 +249,22 @@ export function projectMcpToolInvocationObservation(input) {
         transportOutcome: isError ? "mcp_error" : "mcp_result",
     };
 }
+function projectMcpRateLimit(error) {
+    const creation = error.creationRateLimit && typeof error.creationRateLimit === "object" && !Array.isArray(error.creationRateLimit)
+        ? error.creationRateLimit : null;
+    const projected = { kind: creation ? "scan_creation" : "upstream" };
+    for (const key of ["scope", "windowId"]) {
+        const value = boundedTelemetryToken(creation?.[key], 128);
+        if (value)
+            projected[key] = value;
+    }
+    for (const key of ["retryAfterSeconds", "limit", "used", "windowSeconds"]) {
+        const value = key === "retryAfterSeconds" ? error[key] : creation?.[key];
+        if (typeof value === "number" && Number.isInteger(value) && value >= 0 && value <= 1_000_000)
+            projected[key] = value;
+    }
+    return projected;
+}
 function observeToolInvocation(observer, observation, requestContext) {
     if (!observer)
         return;
@@ -259,43 +312,67 @@ export function createCertScoreMcpServer(options = {}) {
         "certscore_get_scan_status",
         "certscore_list_findings",
     ]);
-    const registerMcpTool = server.registerTool.bind(server);
-    const registerTool = (name, contract, handler) => {
-        if (options.toolProfile === "light" && !lightTools.has(name)) {
-            return;
-        }
-        const typedHandler = handler;
-        registerMcpTool(name, contract, async (input, extra) => {
+    // Intercept SDK registration through its public API so lookup/validation errors
+    // and original arguments are observed once, before SDK normalization. Restore
+    // the registration method after constructing this server; no private handler map.
+    const registerRequest = server.server.setRequestHandler.bind(server.server);
+    server.server.setRequestHandler = ((schema, handler) => {
+        if (schema !== CallToolRequestSchema)
+            return registerRequest(schema, handler);
+        return registerRequest(CallToolRequestSchema, async (request, extra) => {
             const startedAt = Date.now();
+            const name = request.params.name;
+            const args = request.params.arguments ?? {};
+            const known = certScoreMcpToolContracts.some(tool => tool.name === name)
+                && (options.toolProfile !== "light" || lightTools.has(name));
+            let result;
             try {
-                const scanId = input && typeof input === "object" && !Array.isArray(input)
-                    ? input.scanId
-                    : null;
-                const result = scanIdTools.has(name) && !isCanonicalScanId(scanId)
-                    ? toInvalidScanIdToolError()
-                    : await typedHandler(input, extra);
-                observeToolInvocation(options.onToolInvocation, projectMcpToolInvocationObservation({
-                    args: input,
-                    durationMs: Date.now() - startedAt,
-                    result,
-                    toolName: name,
-                }), { headers: extra.requestInfo?.headers ?? null });
+                result = await handler(request, extra);
                 return result;
             }
             catch (error) {
-                observeToolInvocation(options.onToolInvocation, {
-                    ...projectMcpToolInvocationObservation({
-                        args: input,
-                        durationMs: Date.now() - startedAt,
-                        result: { isError: true, structuredContent: { error: { code: "handler_exception" } } },
-                        toolName: name,
-                    }),
-                    errorCode: "handler_exception",
-                    outcome: "error",
-                    transportOutcome: "mcp_error",
-                }, { headers: extra.requestInfo?.headers ?? null });
+                result = { isError: true, structuredContent: { error: { code: "handler_exception" } } };
                 throw error;
             }
+            finally {
+                try {
+                    const observation = projectMcpToolInvocationObservation({ args, durationMs: Date.now() - startedAt, result, toolName: name });
+                    if (!known)
+                        observation.errorCode = "unknown_tool";
+                    else if (observation.outcome === "error" && !observation.errorCode)
+                        observation.errorCode = "protocol_error";
+                    const payload = telemetryResultRecord(result);
+                    const metadata = payload.mcpMetadata;
+                    const taskContext = sanitizeMcpTaskContext(args.taskContext);
+                    observeToolInvocation(options.onToolInvocation, {
+                        ...observation,
+                        captureBasis: "protocol_request",
+                        callerInput: captureMcpCallerInput(args, request.params._meta),
+                        ...(taskContext ? { taskContext } : {}),
+                        response: {
+                            bytes: Math.min(10_000_000, Buffer.byteLength(JSON.stringify(result ?? null))),
+                            truncated: typeof metadata?.truncated === "boolean" ? metadata.truncated : null,
+                            ...(typeof metadata?.effectiveMaxBytes === "number" ? { effectiveMaxBytes: metadata.effectiveMaxBytes } : {}),
+                        },
+                    }, { headers: extra.requestInfo?.headers ?? null });
+                }
+                catch {
+                    // Best-effort telemetry must never replace a tool response or its error.
+                    console.error("[certscore-mcp] telemetry projection failed");
+                }
+            }
+        });
+    });
+    const registerMcpTool = server.registerTool.bind(server);
+    const registerTool = (name, contract, handler) => {
+        if (options.toolProfile === "light" && !lightTools.has(name))
+            return;
+        const typedHandler = handler;
+        registerMcpTool(name, contract, async (input, extra) => {
+            const scanId = input && typeof input === "object" && !Array.isArray(input)
+                ? input.scanId : null;
+            return scanIdTools.has(name) && !isCanonicalScanId(scanId)
+                ? toInvalidScanIdToolError() : typedHandler(input, extra);
         });
     };
     registerTool("certscore_scan_site", toolContract("certscore_scan_site"), async (input, extra) => {
@@ -560,5 +637,6 @@ export function createCertScoreMcpServer(options = {}) {
             return toToolError(error);
         }
     });
+    server.server.setRequestHandler = registerRequest;
     return server;
 }

package/dist/tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAkB,KAAK,WAAW,EAAE,KAAK,SAAS,EAAE,KAAK,yBAAyB,EAAE,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAG5M,eAAO,MAAM,yBAAyB,SAAU,CAAC;AAiBjD,KAAK,sBAAsB,GAAG,eAAe,GAAG,aAAa,GAAG,UAAU,CAAC;AAE3E,KAAK,kBAAkB,GAAG,kBAAkB,GAAG,gCAAgC,GAAG,yBAAyB,GAAG,SAAS,CAAC;AAcxH,KAAK,eAAe,GAAG;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AA0CF,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,cAAc,CAa5E;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,CAsD1D;AAED,wBAAgB,2BAA2B,CAAC,YAAY,EAAE,MAAM,GAAG,cAAc,CA0ChF;AAED,wBAAgB,wBAAwB,IAAI,cAAc,CAczD;AA2GD,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAChE,KAAK,EAAE,CAAC,EACR,sBAAsB,GAAE,kBAA8B,EACtD,mBAAmB,GAAE,sBAAmC,GACvD,CAAC,GAAG;IACL,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;IAC9B,yBAAyB,EAAE,MAAM,CAAC;CACnC,CAuDA;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,sBAAsB,EAAE,kBAAkB;;;;;;;;WA3D3G,eAAe,GAAG,IAAI;+BACF,MAAM;EAgElC;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,kBAAkB,SAA4B,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA0C9H;AA6XD,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,WAAW,CAE5E;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,WAAW,CAE5E;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,iBAEjD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,iBAGlD;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,WAAW,GAAG,UAAU,EAAE,CAQpE;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW;;;;;;;;;;;;;;;;;;;;EAsBjD;AAED,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnE,OAAO,EAAE,CAAC,EACV,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAChD,CAAC,CAoBH;AAED,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnE,OAAO,EAAE,CAAC,EACV,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GACjC,CAAC,CA2BH;AA2KD,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,UAexD;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,YAAY,GAAE,MAAM,EAAO,UAiBnF;AAqJD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,SAAiC,UAcjG;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,UAqBjE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,SAAqB,UAoBrF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,UAS5D;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,UA+HzD;AA2ED,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,MAAM,CAAC,EAAE,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,MAAM,CAAC;IACtD,QAAQ,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC9B,QAAQ,EAAE,WAAW,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yBAAyB,CAAC,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC7D,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,IAAI,EAAE,YAAY,CAAC;CACpB,uBA2YA;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiCpE"}
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAkB,KAAK,WAAW,EAAE,KAAK,SAAS,EAAE,KAAK,yBAAyB,EAAE,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAG5M,eAAO,MAAM,yBAAyB,SAAU,CAAC;AAiBjD,KAAK,sBAAsB,GAAG,eAAe,GAAG,aAAa,GAAG,UAAU,CAAC;AAE3E,KAAK,kBAAkB,GAAG,kBAAkB,GAAG,gCAAgC,GAAG,yBAAyB,GAAG,SAAS,CAAC;AAcxH,KAAK,eAAe,GAAG;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AA4CF,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,cAAc,CAa5E;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,CAsD1D;AAED,wBAAgB,2BAA2B,CAAC,YAAY,EAAE,MAAM,GAAG,cAAc,CA0ChF;AAED,wBAAgB,wBAAwB,IAAI,cAAc,CAczD;AA2GD,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAChE,KAAK,EAAE,CAAC,EACR,sBAAsB,GAAE,kBAA8B,EACtD,mBAAmB,GAAE,sBAAmC,GACvD,CAAC,GAAG;IACL,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;IAC9B,yBAAyB,EAAE,MAAM,CAAC;CACnC,CAuDA;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,sBAAsB,EAAE,kBAAkB;;;;;;;;WA3D3G,eAAe,GAAG,IAAI;+BACF,MAAM;EAgElC;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,kBAAkB,SAA4B,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA0C9H;AA6XD,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,WAAW,CAE5E;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,WAAW,CAE5E;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,iBAEjD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,iBAGlD;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,WAAW,GAAG,UAAU,EAAE,CAQpE;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW;;;;;;;;;;;;;;;;;;;;EAsBjD;AAED,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnE,OAAO,EAAE,CAAC,EACV,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAChD,CAAC,CAoBH;AAED,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnE,OAAO,EAAE,CAAC,EACV,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GACjC,CAAC,CA2BH;AAoMD,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,UAiBxD;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,YAAY,GAAE,MAAM,EAAO,UAmBnF;AAqJD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,SAAiC,UAcjG;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,UAqBjE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,SAAqB,UAsBrF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,UAS5D;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,UAiIzD;AA2ED,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,MAAM,CAAC,EAAE,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,MAAM,CAAC;IACtD,QAAQ,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC9B,QAAQ,EAAE,WAAW,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yBAAyB,CAAC,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC7D,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,IAAI,EAAE,YAAY,CAAC;CACpB,uBAwZA;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiCpE"}

package/dist/tools.js

@@ -30,6 +30,9 @@ function toolResultSummary(payload) {
         return "CertScore tool call completed. Read structuredContent for the result.";
     }
     const record = payload;
+    const noGoText = canonicalNoGoText(record);
+    if (noGoText)
+        return noGoText;
     const type = typeof record.type === "string" ? record.type : "result";
     const status = typeof record.status === "string" ? `; status=${record.status}` : "";
     const scanId = typeof record.scanId === "string" ? `; scanId=${record.scanId}` : "";
@@ -991,7 +994,34 @@ function canonicalScanProvenanceText(value) {
     const numeric = (field) => typeof field === "number" && Number.isFinite(field) ? String(field) : "unavailable";
     return `Canonical scan provenance: scanId=${present(extractScanId(value))}; scanFrom/execution region=${present(value.scanFrom)}; completedAt=${present(value.completedAt)}; startedAt=${present(value.startedAt)}; createdAt=${present(value.createdAt)}; retrieval mode=${present(value.provenance?.retrievalMode)}; original creation decision=${present(value.provenance?.creationDecision)}; scan age seconds=${numeric(value.provenance?.scanAgeSeconds)}; compatibility provenance mode=${present(value.provenance?.mode)}.`;
 }
+/** Present only the API's retained disposition; never infer blockers from raw evidence. */
+function canonicalNoGo(value) {
+    return value.resultDisposition === "no_go" && value.noGo && typeof value.noGo === "object" && !Array.isArray(value.noGo)
+        ? value.noGo
+        : null;
+}
+function canonicalNoGoText(value) {
+    const noGo = canonicalNoGo(value);
+    if (!noGo)
+        return null;
+    return [
+        `CertScore scan: ${boundedText(noGo.title, 240) ?? "Scan access limitation"}; status=${value.status ?? "completed_limited"}; Not scored.`,
+        boundedText(noGo.explanation, 1_200),
+        boundedText(noGo.summary, 600),
+        noGo.evidenceExcerpt ? `Retained evidence: ${boundedText(noGo.evidenceExcerpt, 1_200)}` : null,
+        noGo.recommendedNextAction ? `Next: ${boundedText(noGo.recommendedNextAction, 1_000)}` : null,
+        typeof noGo.retryLikelyToHelp === "boolean" ? `Retry likely to help: ${noGo.retryLikelyToHelp ? "yes" : "no"}.` : null,
+        value.mcpMetadata?.truncated ? "Additional retained details were omitted to fit the response budget; see omission metadata and the report URL." : null,
+        canonicalScanProvenanceText(value),
+        `Full report: ${reportUrlFor(value) ?? "not available"}.`,
+        OBSERVATION_ONLY_DISCLAIMER,
+        SCAN_PROVENANCE_GROUNDING,
+    ].filter(Boolean).join("\n");
+}
 export function scanStatusText(value) {
+    const noGoText = canonicalNoGoText(value);
+    if (noGoText)
+        return noGoText;
     const reportUrl = reportUrlFor(value);
     const nextAction = typeof value.recommendedNextAction === "string" && value.recommendedNextAction.trim()
         ? value.recommendedNextAction.trim()
@@ -1008,6 +1038,9 @@ export function scanStatusText(value) {
     ]);
 }
 export function scanSiteText(value, leadingLines = []) {
+    const noGoText = canonicalNoGoText(value);
+    if (noGoText)
+        return noGoText;
     const scanId = extractScanId(value) ?? "unknown";
     const active = value.status === "queued" || value.status === "running" || value.status === "finalizing";
     const nextAction = typeof value.recommendedNextAction === "string" && value.recommendedNextAction.trim()
@@ -1203,6 +1236,9 @@ export function preConsentInventoryText(value) {
     return boundedResultText(`Pre-consent cookie/tracker evidence for ${domain}; scanId=${scanId}; ${returned} of ${total} rows returned${truncated ? " (truncated)" : ""}. Enumerate only these observed rows.`, rows.map((row) => preConsentRowText(compactPreConsentRow(row))), value);
 }
 export function pulseReportText(value, label = "CertScore report") {
+    const noGoText = canonicalNoGoText(value);
+    if (noGoText)
+        return noGoText;
     const scanId = extractScanId(value) ?? "unknown";
     const domain = typeof value.domain === "string" ? value.domain : "unknown domain";
     const score = typeof value.summary?.score === "number"
@@ -1226,6 +1262,9 @@ export function markdownReportText(value) {
     return boundedResultText(`CertScore report for scanId=${extractScanId(value) ?? "unknown"}. The following is a bounded canonical report excerpt.`, excerpt ? [excerpt] : ["No Markdown report body was returned."], value);
 }
 export function scanBundleText(bundle) {
+    const noGoText = canonicalNoGoText(bundle);
+    if (noGoText)
+        return noGoText;
     const score = typeof bundle.score === "number" ? `; CertScore score=${bundle.score}` : "";
     const footer = [OBSERVATION_ONLY_DISCLAIMER, SCAN_BUNDLE_INTERPRETATION_STATEMENT];
     const lines = [
@@ -1516,7 +1555,7 @@ export function buildScanBundle(input) {
         ...(detail === "evidence" || detail === "full"
             ? { evidenceSummary: bundleEvidenceSummary(evidence, allFindings, links, detail === "full") }
             : {}),
-        ...(detail === "full" ? {
+        ...(detail === "full" && Object.keys(report).length > 0 ? {
             fullReport: compactEvidenceValue(deduplicatedReport.residual, {
                 arrayItems: 50,
                 depth: 8,
@@ -1588,14 +1627,27 @@ export function buildScanBundle(input) {
         bundle.mcpMetadata.nextRecommendedMaxBytes = completeBytes <= responseCeilingBytes
             ? Math.max(5_000, Math.ceil(completeBytes / 1_000) * 1_000)
             : null;
-        bundle.recommendedNextAction = canonicalFindingsComplete
+        bundle.recommendedNextAction = canonicalNoGo(bundle)?.recommendedNextAction ?? (canonicalFindingsComplete
             ? "Canonical findings complete; retry only for omitted envelope detail."
             : bundle.mcpMetadata.nextRecommendedMaxBytes
                 ? `Retry with maxBytes=${bundle.mcpMetadata.nextRecommendedMaxBytes} to retrieve the complete requested tier, or open ${bundle.reportUrl ? "the report URL" : "an available content URL"}.`
-                : `The complete requested tier exceeds the MCP byte ceiling; open ${bundle.reportUrl ? "the report URL" : "an available content URL"}.`;
+                : `The complete requested tier exceeds the MCP byte ceiling; open ${bundle.reportUrl ? "the report URL" : "an available content URL"}.`);
         refresh();
     };
     captureFullPayloadBytes();
+    // Access disposition and its remedy outrank optional lane detail in a no-go envelope.
+    // Retained evidence remains available through the reported content URLs.
+    if (canonicalNoGo(bundle)) {
+        for (const section of ["gpcResponse", "postAcceptObservation", "postRefusalObservation"]) {
+            if (bundle.mcpMetadata.actualBytes <= maxBytes)
+                break;
+            if (bundle[section]) {
+                markBudgetOmitted(section, "lane_detail_omitted_to_preserve_no_go");
+                delete bundle[section];
+                refresh();
+            }
+        }
+    }
     if (bundle.mcpMetadata.actualBytes > maxBytes && bundle.fullReport) {
         markBudgetOmitted("fullReport", "full_report_omitted_to_byte_limit");
         delete bundle.fullReport;
@@ -1728,6 +1780,7 @@ export function buildScanBundle(input) {
             scanId: bundle.scanId,
             domain: bundle.domain,
             url: bundle.url,
+            scanFrom: bundle.scanFrom,
             status: bundle.status,
             score: bundle.score,
             scoreLabel: bundle.scoreLabel,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@certscore/mcp",
-  "version": "0.2.18",
+  "version": "0.2.20",
   "mcpName": "ai.certscore/mcp",
   "private": false,
   "description": "MCP server for CertScore public website risk-signal workflows.",
@@ -69,6 +69,7 @@
   },
   "devDependencies": {
     "@certscore/api-contracts": "workspace:*",
-    "@certscore/sdk": "workspace:*"
+    "@certscore/sdk": "workspace:*",
+    "@website-signal-risk-scanner/shared": "workspace:*"
   }
 }

package/server-light.json

@@ -24,7 +24,7 @@
       "theme": "dark"
     }
   ],
-  "version": "0.2.18",
+  "version": "0.2.20",
   "remotes": [
     {
       "type": "streamable-http",

package/server.json

@@ -8,7 +8,7 @@
     "url": "https://github.com/ergoveritas1-alt/certscore.ai",
     "source": "github"
   },
-  "version": "0.2.18",
+  "version": "0.2.20",
   "remotes": [
     {
       "type": "streamable-http",
@@ -20,7 +20,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@certscore/mcp",
-      "version": "0.2.18",
+      "version": "0.2.20",
       "transport": {
         "type": "stdio"
       },