@chainpatrol/mcp 1.10.2 → 1.12.0

package/CHANGELOG.md

@@ -1,5 +1,56 @@
 # @chainpatrol/mcp
 
+## 1.12.0
+
+### Minor Changes
+
+- ac640ce: `/detection/list` now returns up to 1000 detections per page (was 100). The
+  default page size stays at 50, and larger result sets still page with
+  `nextCursor`.
+
+  - `@chainpatrol/mcp`: the generated `detection_list` tool accepts `limit` up to
+    1000 and documents `startDate`/`endDate` for incremental syncs.
+
+  Server-side work lives in @chainpatrol/external-trpc and @chainpatrol/database;
+  both are private packages and don't need version bumps.
+
+- 2552904: Add Time to Detection: `getMetricsTimeToDetection` in the SDK,
+  `chainpatrol metrics time-to-detection` in the CLI, and the
+  `metrics_time_to_detection` MCP tool, all backed by the new
+  `POST /metrics/time-to-detection` endpoint. It reports how long threats were
+  already live before the earliest automated detection of the asset, for any
+  organization, per asset type. The clock runs from when the asset was first
+  seen live to its earliest automated detection; a human report does not stop
+  it. Each number is a minimum, published with how many blocked assets are in
+  the sample. Server-side work lives in @chainpatrol/external-trpc,
+  @chainpatrol/validation and @chainpatrol/metrics; those are private packages
+  and need no version bump.
+- 878241c: Adds the `GET /v2/organization/threats` endpoint, which returns every asset an
+  organization has reported together with the lifecycle state of that
+  investigation — report opened, escalated to the customer, blocklisted, takedown
+  submitted, takedown completed — as a state projection a threat-intel platform
+  can poll and upsert on asset ID. Built for the OpenCTI connector. The MCP tool
+  surface is regenerated from the public API schemas, so the new operation shows
+  up there; the handler lives in the private `@chainpatrol/external-trpc` and
+  `@chainpatrol/validation` packages, which changesets ignores.
+
+## 1.11.0
+
+### Minor Changes
+
+- 3895c2f: `/asset/list` no longer requires `type`. Omitting it returns assets of every
+  type on a single pagination cursor, so mirroring the whole blocklist no longer
+  means looping the `AssetType` enum. Supplying `type` behaves exactly as before.
+
+  - `@chainpatrol/sdk`: `listAssets` accepts an input without `type`.
+  - `@chainpatrol/mcp`: the generated `asset_list` tool drops `type` from its
+    required fields.
+
+  Server-side work lives in @chainpatrol/validation and @chainpatrol/external-trpc;
+  both are private packages and don't need version bumps.
+
+- 264c4f7: Expose the new `hasAttachments` filter on both report-list tools, `organization_reports_list` and `get_organization_reports`, so a report search can be narrowed to reports that carry evidence files. Supporting work lives in the private packages @chainpatrol/core, @chainpatrol/external-trpc and @chainpatrol/trpc, which do not need version bumps.
+
 ## 1.10.2
 
 ### Patch Changes

package/dist/{chunk-JBDTADFL.js → chunk-JE3KUTYE.js}

@@ -195,7 +195,7 @@ var tools_default = {
         properties: {
           type: {
             type: "string",
-            description: "Asset type One of 92 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
+            description: "Asset type One of 95 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
           },
           content: {
             type: "string",
@@ -310,7 +310,7 @@ var tools_default = {
       path: "/asset/list",
       pathParams: [],
       title: "List assets",
-      description: "Answers 'which assets of this type does ChainPatrol hold at this status?'. Returns a paginated list for one asset type, defaulting to `BLOCKED`, optionally narrowed to a date range. Built for bulk export and sync \u2014 pass `next_page` from the previous response to continue. To check one specific asset, use `/asset/check` instead; for an organization's own monitored assets, use `/organization/assets`.",
+      description: "Answers 'which assets does ChainPatrol hold at this status?'. Returns a paginated list defaulting to `BLOCKED`, optionally narrowed to a single `type` and to a date range. Omit `type` to sweep every asset type on one cursor, which is the cheapest way to mirror the whole blocklist. Built for bulk export and sync \u2014 pass `next_page` from the previous response to continue. To check one specific asset, use `/asset/check` instead; for an organization's own monitored assets, use `/organization/assets`.",
       tags: [
         "asset"
       ],
@@ -321,7 +321,7 @@ var tools_default = {
         properties: {
           type: {
             type: "string",
-            description: "Asset type One of 92 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
+            description: "Asset type to retrieve. Omit the field entirely to retrieve assets of every type in a single paginated sweep; an explicit null is rejected. One of 95 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
           },
           status: {
             type: "string",
@@ -367,10 +367,7 @@ var tools_default = {
             description: "Cursor for fetching the next page of results"
           }
         },
-        required: [
-          "type"
-        ],
-        description: "List asset request body\n\nDefaults to getting all the updates in the last 1 day.\n\nYou can also choose a `startDate` and `endDate` for the range of asset updates, most \ntimestamp formats should work, we use [Luxon](https://moment.github.io/luxon/#/parsing) \nfor parsing the dates."
+        description: "List asset request body\n\nWith no `startDate`, this returns every matching asset regardless of age \u2014 there\nis no implicit one-day window. Pass `startDate` to get a delta instead.\n\nYou can also choose a `startDate` and `endDate` for the range of asset updates, most \ntimestamp formats should work, we use [Luxon](https://moment.github.io/luxon/#/parsing) \nfor parsing the dates."
       }
     },
     {
@@ -622,7 +619,7 @@ var tools_default = {
           },
           source: {
             type: "string",
-            description: "Detection source key, from `GET /detection/sources`. The source must support the `organization` scope; global-only sources cannot be configured per organization. One of 57 values, e.g. meta_ads_search, telegram_channels_search, telegram_user_search, telegram_channels_search_vetric, telegram_user_search_vetric, facebook_page_search_vetric, facebook_user_search_vetric, facebook_post_search_vetric. Full list: resource chainpatrol://enums/source"
+            description: "Detection source key, from `GET /detection/sources`. The source must support the `organization` scope; global-only sources cannot be configured per organization. One of 59 values, e.g. meta_ads_search, telegram_channels_search, telegram_user_search, telegram_channels_search_vetric, telegram_user_search_vetric, facebook_page_search_vetric, facebook_user_search_vetric, facebook_post_search_vetric. Full list: resource chainpatrol://enums/source"
           },
           status: {
             type: "string",
@@ -997,7 +994,7 @@ var tools_default = {
       path: "/detection/list",
       pathParams: [],
       title: "List threat detection results for organization",
-      description: "List threat detection results for an organization using API key authentication. Returns human-readable confidence levels (none, low, medium, high) and report status. Supports filtering by source, confidence level, asset status, and asset type. Includes pagination and search capabilities.",
+      description: "List threat detection results for an organization using API key authentication, newest first. Returns human-readable confidence levels (none, low, medium, high) and report status. Supports filtering by source, confidence level, asset status, asset type and creation time, plus search. Pages hold up to 1000 results: pass `nextCursor` back as `cursor` until it is absent, and use `startDate` to fetch only detections created since your last sync.",
       tags: [
         "detection"
       ],
@@ -1012,18 +1009,18 @@ var tools_default = {
           },
           cursor: {
             type: "number",
-            description: "Cursor for pagination"
+            description: "Pass the `nextCursor` from the previous response to fetch the next page. Omit it for the first page."
           },
           limit: {
             type: "number",
             minimum: 1,
-            maximum: 100,
+            maximum: 1e3,
             default: 50,
-            description: "Number of results to return"
+            description: "Number of results per page, between 1 and 1000. Defaults to 50."
           },
           filters: {
             type: "array",
-            description: "Filters to apply to the results. Each clause filters on one property. Accepted values per property \u2014 `source`: One of 57 values, e.g. meta_ads_search, telegram_channels_search, telegram_user_search, telegram_channels_search_vetric, telegram_user_search_vetric, facebook_page_search_vetric, facebook_user_search_vetric, facebook_post_search_vetric. Full list: resource chainpatrol://enums/source; `confidence`: none, low, medium, high; `liveness`: UNKNOWN, ALIVE, DEAD; `watchlist`: ENABLED, DISABLED; `assetStatus`: UNKNOWN, ALLOWED, BLOCKED; `reported`: reported, not_reported; `assetType`: One of 92 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type; `brand`: number values; `deleted`: string values; `countryCode`: string values.",
+            description: "Filters to apply to the results. Each clause filters on one property. Accepted values per property \u2014 `source`: One of 59 values, e.g. meta_ads_search, telegram_channels_search, telegram_user_search, telegram_channels_search_vetric, telegram_user_search_vetric, facebook_page_search_vetric, facebook_user_search_vetric, facebook_post_search_vetric. Full list: resource chainpatrol://enums/source; `confidence`: none, low, medium, high; `liveness`: UNKNOWN, ALIVE, DEAD; `watchlist`: ENABLED, DISABLED; `assetStatus`: UNKNOWN, ALLOWED, BLOCKED; `reported`: reported, not_reported; `assetType`: One of 95 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type; `brand`: number values; `deleted`: string values; `countryCode`: string values.",
             items: {
               type: "object",
               properties: {
@@ -1078,12 +1075,12 @@ var tools_default = {
           startDate: {
             type: "string",
             format: "date-time",
-            description: "Start date for filtering results"
+            description: "Only return detections created at or after this time (inclusive). For incremental syncs, pass the time your previous sync started minus a few minutes of overlap, and de-duplicate by `id`."
           },
           endDate: {
             type: "string",
             format: "date-time",
-            description: "End date for filtering results"
+            description: "Only return detections created at or before this time (inclusive). Pin it to the time a sync starts so every page of that sync sees the same result set."
           }
         },
         required: [
@@ -1239,7 +1236,7 @@ var tools_default = {
             type: "array",
             items: {
               type: "string",
-              description: "One of 92 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
+              description: "One of 95 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
             }
           },
           reviewedByUserId: {
@@ -1300,6 +1297,10 @@ var tools_default = {
           hasMxRecords: {
             type: "boolean"
           },
+          hasAttachments: {
+            type: "boolean",
+            description: "Filter on evidence files uploaded with the report. `true` returns only reports with at least one attachment that has not been removed; `false` returns only reports with none. Useful for finding phone number or email reports that came with supporting evidence."
+          },
           sources: {
             type: "array",
             items: {
@@ -1814,6 +1815,60 @@ var tools_default = {
         ]
       }
     },
+    {
+      name: "metrics_false_positive_rate",
+      procedure: "metricsFalsePositiveRate",
+      method: "POST",
+      path: "/metrics/false-positive-rate",
+      pathParams: [],
+      title: "Get organization false positive rate by asset type",
+      description: "Get the share of blocks that were later reversed, broken down by asset type, for a date range. Every asset type blocked in the range is returned, including ones with no false positives. The range bounds when the asset was blocked; whether the block still stands is read as of now, so a recent range reads low simply because its reversals have not happened yet.",
+      tags: [
+        "metrics"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            minLength: 1,
+            description: "Organization slug"
+          },
+          startDate: {
+            type: "string",
+            format: "date-time",
+            description: "Only include assets blocked on or after this date. A date-only value (YYYY-MM-DD) starts at midnight UTC"
+          },
+          endDate: {
+            type: "string",
+            format: "date-time",
+            description: "Only include assets blocked on or before this date. A date-only value (YYYY-MM-DD) covers the whole day in UTC; pass a full timestamp for a precise cut-off"
+          },
+          brandIds: {
+            type: "array",
+            items: {
+              type: "integer",
+              exclusiveMinimum: 0
+            },
+            description: "Only include assets belonging to these brands"
+          },
+          countryCodes: {
+            type: "array",
+            items: {
+              type: "string",
+              minLength: 2,
+              maxLength: 2
+            },
+            description: "Only include assets scanned from these ISO 3166-1 alpha-2 countries"
+          }
+        },
+        required: [
+          "slug"
+        ]
+      }
+    },
     {
       name: "metrics_found",
       procedure: "metricsFound",
@@ -2190,7 +2245,7 @@ var tools_default = {
             type: "array",
             items: {
               type: "string",
-              description: "One of 92 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
+              description: "One of 95 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
             },
             maxItems: 5,
             description: "Break the trend down by these asset types, one series each. Omit for a single series pooled across every asset type"
@@ -2231,6 +2286,60 @@ var tools_default = {
         ]
       }
     },
+    {
+      name: "metrics_time_to_detection",
+      procedure: "metricsTimeToDetection",
+      method: "POST",
+      path: "/metrics/time-to-detection",
+      pathParams: [],
+      title: "Get organization time to detection by asset type",
+      description: "How long threats were already live before the earliest automated detection of the asset, for any organization. Broken down by asset type, for distinct assets this organization blocked in the date range that are still blocked today. The clock runs from when the asset was first seen live to its earliest automated detection; a human report does not stop it. Each median is a minimum.",
+      tags: [
+        "metrics"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            minLength: 1,
+            description: "Organization slug"
+          },
+          startDate: {
+            type: "string",
+            format: "date-time",
+            description: "Only include assets blocked on or after this date. A date-only value (YYYY-MM-DD) starts at midnight UTC"
+          },
+          endDate: {
+            type: "string",
+            format: "date-time",
+            description: "Only include assets blocked on or before this date. A date-only value (YYYY-MM-DD) covers the whole day in UTC; pass a full timestamp for a precise cut-off"
+          },
+          brandIds: {
+            type: "array",
+            items: {
+              type: "integer",
+              exclusiveMinimum: 0
+            },
+            description: "Only include assets belonging to these brands"
+          },
+          countryCodes: {
+            type: "array",
+            items: {
+              type: "string",
+              minLength: 2,
+              maxLength: 2
+            },
+            description: "Only include assets scanned from these ISO 3166-1 alpha-2 countries"
+          }
+        },
+        required: [
+          "slug"
+        ]
+      }
+    },
     {
       name: "operations_queues_snapshot",
       procedure: "operationsQueuesSnapshot",
@@ -2484,7 +2593,7 @@ var tools_default = {
           },
           type: {
             type: "string",
-            description: "Filter by asset type (URL, ADDRESS, etc.) One of 92 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
+            description: "Filter by asset type (URL, ADDRESS, etc.) One of 95 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
           },
           groupId: {
             type: "integer",
@@ -3002,6 +3111,10 @@ var tools_default = {
           reportedByCustomer: {
             type: "boolean"
           },
+          hasAttachments: {
+            type: "boolean",
+            description: "Filter on evidence files uploaded with the report. `true` returns only reports with at least one attachment that has not been removed; `false` returns only reports with none."
+          },
           needsCustomerReview: {
             type: "boolean",
             description: "Filter to reports waiting on your organization's own approval \u2014 the same queue your Review page shows. `true` returns only reports with at least one pending proposal that is yours to action; `false` returns only reports that are not. A pending proposal counts when ChainPatrol staff escalated it to you and you have not answered yet. Answering means approving, rejecting, or escalating it back to ChainPatrol. Two things do not put a report here: reports your organization sourced itself (ChainPatrol triages those and staff approval blocks the asset without you, though you still see them in the unfiltered list), and Obligatory Organization Admin Approval (a proposal ChainPatrol has not triaged yet is still waiting on our review, and reaches you only once staff escalate it)."
@@ -3023,7 +3136,7 @@ var tools_default = {
             type: "array",
             items: {
               type: "string",
-              description: "One of 92 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
+              description: "One of 95 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
             }
           },
           brandIds: {
@@ -3065,6 +3178,63 @@ var tools_default = {
         ]
       }
     },
+    {
+      name: "organization_threats_list",
+      procedure: "organizationThreatsList",
+      method: "GET",
+      path: "/organization/threats",
+      pathParams: [],
+      title: "List organization threats",
+      description: "List every asset your organization has reported, with the lifecycle state of each investigation: report opened, escalated, blocklisted, takedown submitted, takedown completed. Built for threat-intel platforms that poll for changes and upsert on asset ID. Supports pagination.",
+      tags: [
+        "organization"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            description: "Organization slug. Optional for organization-scoped API keys, which resolve the organization from the key itself. Required when your credentials can reach more than one organization."
+          },
+          updatedSince: {
+            type: "string",
+            description: "Only return threats touched at or after this ISO 8601 timestamp. Compared against the most recent change to the asset, its reports, and its takedown \u2014 whichever is latest. Omit for a full backfill. Overlap your windows by a few minutes: writes that land mid-request can otherwise fall between two polls."
+          },
+          assetType: {
+            type: "string",
+            description: "Filter by asset type. Omit to return every type. One of 95 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
+          },
+          per_page: {
+            type: "integer",
+            minimum: 1,
+            maximum: 1e3,
+            default: 100,
+            description: "The number of threats to return per page (max 1000)"
+          },
+          next_page: {
+            anyOf: [
+              {
+                anyOf: [
+                  {
+                    not: {}
+                  },
+                  {
+                    type: "string"
+                  }
+                ]
+              },
+              {
+                type: "null"
+              }
+            ],
+            description: "Cursor for fetching the next page of results"
+          }
+        },
+        description: "List organization threats request body\n\nReturns every asset this organization has filed a report against, together with\nthe lifecycle state of that investigation \u2014 report opened, escalated, blocked,\ntakedown submitted, takedown completed.\n\nThis is a projection of current state, not an event stream: each threat is\nreturned with the facts as they stand right now, so a consumer that upserts on\n`id` converges regardless of which intermediate transitions it saw. Results are\nordered by asset ID ascending and paginated with `next_page`."
+      }
+    },
     {
       name: "report_create",
       procedure: "reportCreate",
@@ -3166,7 +3336,7 @@ var tools_default = {
                     properties: {
                       type: {
                         type: "string",
-                        description: "Enrichment type One of 40 values, e.g. content_and_metadata, browser_capture, ownership_and_registration, geolocation_and_ip, dns, tls, tcp, post. Full list: resource chainpatrol://enums/asset_scan_enrichment_type"
+                        description: "Enrichment type One of 49 values, e.g. content_and_metadata, browser_capture, ownership_and_registration, geolocation_and_ip, dns, tls, tcp, hostname_first_seen. Full list: resource chainpatrol://enums/asset_scan_enrichment_type"
                       },
                       source: {
                         type: "string",
@@ -3337,7 +3507,7 @@ var tools_default = {
             type: "array",
             items: {
               type: "string",
-              description: "One of 92 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
+              description: "One of 95 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
             },
             description: "Filter by asset types"
           },
@@ -3497,7 +3667,7 @@ var tools_default = {
             type: "array",
             items: {
               type: "string",
-              description: "One of 92 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
+              description: "One of 95 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
             },
             description: "Filter by asset types"
           },
@@ -3753,7 +3923,7 @@ var tools_default = {
                 type: "array",
                 items: {
                   type: "string",
-                  description: "One of 92 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
+                  description: "One of 95 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
                 },
                 minItems: 1
               }
@@ -3960,6 +4130,7 @@ var tools_default = {
         "dns",
         "tls",
         "tcp",
+        "hostname_first_seen",
         "post",
         "profile",
         "twitter_followers",
@@ -3975,6 +4146,7 @@ var tools_default = {
         "apple_app_store_listing",
         "google_play_store_listing",
         "mozilla_addon",
+        "github_comment",
         "reddit_subreddit",
         "email_validation",
         "phone_lookup",
@@ -3985,14 +4157,21 @@ var tools_default = {
         "vimeo_profile",
         "stackblitz_page",
         "leetcode_page",
+        "tumblr_blog",
+        "tumblr_post",
+        "tumblr_community",
         "npm_package",
         "pypi_package",
         "rust_package",
         "linkedin_profile",
+        "pump_fun_token",
         "meta_ad",
         "google_ad",
         "adlibrary_ad",
-        "contract_deployer"
+        "contract_deployer",
+        "threat_intel",
+        "list_membership",
+        "threat_score"
       ],
       usedBy: [
         "report_create.type"
@@ -4092,7 +4271,10 @@ var tools_default = {
         "FIVE_HUNDRED_PX",
         "LUMA",
         "SMARTMONEYMATCH",
-        "APK_GOLD"
+        "APK_GOLD",
+        "GLASSDOOR",
+        "PUMP_FUN",
+        "TUMBLR"
       ],
       usedBy: [
         "asset_changelog.type",
@@ -4102,6 +4284,7 @@ var tools_default = {
         "metrics_takedown_time_trend.assetTypes",
         "organization_assets_list.type",
         "organization_reports_list.assetTypes",
+        "organization_threats_list.assetType",
         "takedowns_list.assetType",
         "threats_list.assetType",
         "user_orgs.assetTypes"
@@ -4130,6 +4313,7 @@ var tools_default = {
         "blocklist",
         "apple_app_store",
         "google_ads_search",
+        "google_ads_transparency_search",
         "mozilla_addon_search",
         "reddit_subreddit_search",
         "asset_check",
@@ -4166,7 +4350,8 @@ var tools_default = {
         "adlibrary_ads_search",
         "dnsdb",
         "daily_motion_search",
-        "watchlist"
+        "watchlist",
+        "github_search"
       ],
       usedBy: [
         "detection_configs_create.source",
@@ -4469,7 +4654,7 @@ var package_default = {
   name: "@chainpatrol/mcp",
   description: "The official ChainPatrol MCP server \u2014 every public API capability as an MCP tool",
   author: "ChainPatrol <support@chainpatrol.io>",
-  version: "1.10.2",
+  version: "1.12.0",
   license: "UNLICENSED",
   homepage: "https://chainpatrol.com/docs/mcp",
   keywords: [
@@ -4546,4 +4731,4 @@ export {
   toolsFromEnvironment,
   PACKAGE_VERSION
 };
-//# sourceMappingURL=chunk-JBDTADFL.js.map
+//# sourceMappingURL=chunk-JE3KUTYE.js.map