@chainpatrol/mcp 1.11.0 → 1.12.0

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # @chainpatrol/mcp
 
+## 1.12.0
+
+### Minor Changes
+
+- ac640ce: `/detection/list` now returns up to 1000 detections per page (was 100). The
+  default page size stays at 50, and larger result sets still page with
+  `nextCursor`.
+
+  - `@chainpatrol/mcp`: the generated `detection_list` tool accepts `limit` up to
+    1000 and documents `startDate`/`endDate` for incremental syncs.
+
+  Server-side work lives in @chainpatrol/external-trpc and @chainpatrol/database;
+  both are private packages and don't need version bumps.
+
+- 2552904: Add Time to Detection: `getMetricsTimeToDetection` in the SDK,
+  `chainpatrol metrics time-to-detection` in the CLI, and the
+  `metrics_time_to_detection` MCP tool, all backed by the new
+  `POST /metrics/time-to-detection` endpoint. It reports how long threats were
+  already live before the earliest automated detection of the asset, for any
+  organization, per asset type. The clock runs from when the asset was first
+  seen live to its earliest automated detection; a human report does not stop
+  it. Each number is a minimum, published with how many blocked assets are in
+  the sample. Server-side work lives in @chainpatrol/external-trpc,
+  @chainpatrol/validation and @chainpatrol/metrics; those are private packages
+  and need no version bump.
+- 878241c: Adds the `GET /v2/organization/threats` endpoint, which returns every asset an
+  organization has reported together with the lifecycle state of that
+  investigation — report opened, escalated to the customer, blocklisted, takedown
+  submitted, takedown completed — as a state projection a threat-intel platform
+  can poll and upsert on asset ID. Built for the OpenCTI connector. The MCP tool
+  surface is regenerated from the public API schemas, so the new operation shows
+  up there; the handler lives in the private `@chainpatrol/external-trpc` and
+  `@chainpatrol/validation` packages, which changesets ignores.
+
 ## 1.11.0
 
 ### Minor Changes

package/dist/{chunk-7U4RIDQZ.js → chunk-JE3KUTYE.js}

@@ -195,7 +195,7 @@ var tools_default = {
         properties: {
           type: {
             type: "string",
-            description: "Asset type One of 94 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
+            description: "Asset type One of 95 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
           },
           content: {
             type: "string",
@@ -321,7 +321,7 @@ var tools_default = {
         properties: {
           type: {
             type: "string",
-            description: "Asset type to retrieve. Omit the field entirely to retrieve assets of every type in a single paginated sweep; an explicit null is rejected. One of 94 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
+            description: "Asset type to retrieve. Omit the field entirely to retrieve assets of every type in a single paginated sweep; an explicit null is rejected. One of 95 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
           },
           status: {
             type: "string",
@@ -619,7 +619,7 @@ var tools_default = {
           },
           source: {
             type: "string",
-            description: "Detection source key, from `GET /detection/sources`. The source must support the `organization` scope; global-only sources cannot be configured per organization. One of 58 values, e.g. meta_ads_search, telegram_channels_search, telegram_user_search, telegram_channels_search_vetric, telegram_user_search_vetric, facebook_page_search_vetric, facebook_user_search_vetric, facebook_post_search_vetric. Full list: resource chainpatrol://enums/source"
+            description: "Detection source key, from `GET /detection/sources`. The source must support the `organization` scope; global-only sources cannot be configured per organization. One of 59 values, e.g. meta_ads_search, telegram_channels_search, telegram_user_search, telegram_channels_search_vetric, telegram_user_search_vetric, facebook_page_search_vetric, facebook_user_search_vetric, facebook_post_search_vetric. Full list: resource chainpatrol://enums/source"
           },
           status: {
             type: "string",
@@ -994,7 +994,7 @@ var tools_default = {
       path: "/detection/list",
       pathParams: [],
       title: "List threat detection results for organization",
-      description: "List threat detection results for an organization using API key authentication. Returns human-readable confidence levels (none, low, medium, high) and report status. Supports filtering by source, confidence level, asset status, and asset type. Includes pagination and search capabilities.",
+      description: "List threat detection results for an organization using API key authentication, newest first. Returns human-readable confidence levels (none, low, medium, high) and report status. Supports filtering by source, confidence level, asset status, asset type and creation time, plus search. Pages hold up to 1000 results: pass `nextCursor` back as `cursor` until it is absent, and use `startDate` to fetch only detections created since your last sync.",
       tags: [
         "detection"
       ],
@@ -1009,18 +1009,18 @@ var tools_default = {
           },
           cursor: {
             type: "number",
-            description: "Cursor for pagination"
+            description: "Pass the `nextCursor` from the previous response to fetch the next page. Omit it for the first page."
           },
           limit: {
             type: "number",
             minimum: 1,
-            maximum: 100,
+            maximum: 1e3,
             default: 50,
-            description: "Number of results to return"
+            description: "Number of results per page, between 1 and 1000. Defaults to 50."
           },
           filters: {
             type: "array",
-            description: "Filters to apply to the results. Each clause filters on one property. Accepted values per property \u2014 `source`: One of 58 values, e.g. meta_ads_search, telegram_channels_search, telegram_user_search, telegram_channels_search_vetric, telegram_user_search_vetric, facebook_page_search_vetric, facebook_user_search_vetric, facebook_post_search_vetric. Full list: resource chainpatrol://enums/source; `confidence`: none, low, medium, high; `liveness`: UNKNOWN, ALIVE, DEAD; `watchlist`: ENABLED, DISABLED; `assetStatus`: UNKNOWN, ALLOWED, BLOCKED; `reported`: reported, not_reported; `assetType`: One of 94 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type; `brand`: number values; `deleted`: string values; `countryCode`: string values.",
+            description: "Filters to apply to the results. Each clause filters on one property. Accepted values per property \u2014 `source`: One of 59 values, e.g. meta_ads_search, telegram_channels_search, telegram_user_search, telegram_channels_search_vetric, telegram_user_search_vetric, facebook_page_search_vetric, facebook_user_search_vetric, facebook_post_search_vetric. Full list: resource chainpatrol://enums/source; `confidence`: none, low, medium, high; `liveness`: UNKNOWN, ALIVE, DEAD; `watchlist`: ENABLED, DISABLED; `assetStatus`: UNKNOWN, ALLOWED, BLOCKED; `reported`: reported, not_reported; `assetType`: One of 95 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type; `brand`: number values; `deleted`: string values; `countryCode`: string values.",
             items: {
               type: "object",
               properties: {
@@ -1075,12 +1075,12 @@ var tools_default = {
           startDate: {
             type: "string",
             format: "date-time",
-            description: "Start date for filtering results"
+            description: "Only return detections created at or after this time (inclusive). For incremental syncs, pass the time your previous sync started minus a few minutes of overlap, and de-duplicate by `id`."
           },
           endDate: {
             type: "string",
             format: "date-time",
-            description: "End date for filtering results"
+            description: "Only return detections created at or before this time (inclusive). Pin it to the time a sync starts so every page of that sync sees the same result set."
           }
         },
         required: [
@@ -1236,7 +1236,7 @@ var tools_default = {
             type: "array",
             items: {
               type: "string",
-              description: "One of 94 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
+              description: "One of 95 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
             }
           },
           reviewedByUserId: {
@@ -2245,7 +2245,7 @@ var tools_default = {
             type: "array",
             items: {
               type: "string",
-              description: "One of 94 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
+              description: "One of 95 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
             },
             maxItems: 5,
             description: "Break the trend down by these asset types, one series each. Omit for a single series pooled across every asset type"
@@ -2286,6 +2286,60 @@ var tools_default = {
         ]
       }
     },
+    {
+      name: "metrics_time_to_detection",
+      procedure: "metricsTimeToDetection",
+      method: "POST",
+      path: "/metrics/time-to-detection",
+      pathParams: [],
+      title: "Get organization time to detection by asset type",
+      description: "How long threats were already live before the earliest automated detection of the asset, for any organization. Broken down by asset type, for distinct assets this organization blocked in the date range that are still blocked today. The clock runs from when the asset was first seen live to its earliest automated detection; a human report does not stop it. Each median is a minimum.",
+      tags: [
+        "metrics"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            minLength: 1,
+            description: "Organization slug"
+          },
+          startDate: {
+            type: "string",
+            format: "date-time",
+            description: "Only include assets blocked on or after this date. A date-only value (YYYY-MM-DD) starts at midnight UTC"
+          },
+          endDate: {
+            type: "string",
+            format: "date-time",
+            description: "Only include assets blocked on or before this date. A date-only value (YYYY-MM-DD) covers the whole day in UTC; pass a full timestamp for a precise cut-off"
+          },
+          brandIds: {
+            type: "array",
+            items: {
+              type: "integer",
+              exclusiveMinimum: 0
+            },
+            description: "Only include assets belonging to these brands"
+          },
+          countryCodes: {
+            type: "array",
+            items: {
+              type: "string",
+              minLength: 2,
+              maxLength: 2
+            },
+            description: "Only include assets scanned from these ISO 3166-1 alpha-2 countries"
+          }
+        },
+        required: [
+          "slug"
+        ]
+      }
+    },
     {
       name: "operations_queues_snapshot",
       procedure: "operationsQueuesSnapshot",
@@ -2539,7 +2593,7 @@ var tools_default = {
           },
           type: {
             type: "string",
-            description: "Filter by asset type (URL, ADDRESS, etc.) One of 94 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
+            description: "Filter by asset type (URL, ADDRESS, etc.) One of 95 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
           },
           groupId: {
             type: "integer",
@@ -3082,7 +3136,7 @@ var tools_default = {
             type: "array",
             items: {
               type: "string",
-              description: "One of 94 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
+              description: "One of 95 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
             }
           },
           brandIds: {
@@ -3124,6 +3178,63 @@ var tools_default = {
         ]
       }
     },
+    {
+      name: "organization_threats_list",
+      procedure: "organizationThreatsList",
+      method: "GET",
+      path: "/organization/threats",
+      pathParams: [],
+      title: "List organization threats",
+      description: "List every asset your organization has reported, with the lifecycle state of each investigation: report opened, escalated, blocklisted, takedown submitted, takedown completed. Built for threat-intel platforms that poll for changes and upsert on asset ID. Supports pagination.",
+      tags: [
+        "organization"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            description: "Organization slug. Optional for organization-scoped API keys, which resolve the organization from the key itself. Required when your credentials can reach more than one organization."
+          },
+          updatedSince: {
+            type: "string",
+            description: "Only return threats touched at or after this ISO 8601 timestamp. Compared against the most recent change to the asset, its reports, and its takedown \u2014 whichever is latest. Omit for a full backfill. Overlap your windows by a few minutes: writes that land mid-request can otherwise fall between two polls."
+          },
+          assetType: {
+            type: "string",
+            description: "Filter by asset type. Omit to return every type. One of 95 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
+          },
+          per_page: {
+            type: "integer",
+            minimum: 1,
+            maximum: 1e3,
+            default: 100,
+            description: "The number of threats to return per page (max 1000)"
+          },
+          next_page: {
+            anyOf: [
+              {
+                anyOf: [
+                  {
+                    not: {}
+                  },
+                  {
+                    type: "string"
+                  }
+                ]
+              },
+              {
+                type: "null"
+              }
+            ],
+            description: "Cursor for fetching the next page of results"
+          }
+        },
+        description: "List organization threats request body\n\nReturns every asset this organization has filed a report against, together with\nthe lifecycle state of that investigation \u2014 report opened, escalated, blocked,\ntakedown submitted, takedown completed.\n\nThis is a projection of current state, not an event stream: each threat is\nreturned with the facts as they stand right now, so a consumer that upserts on\n`id` converges regardless of which intermediate transitions it saw. Results are\nordered by asset ID ascending and paginated with `next_page`."
+      }
+    },
     {
       name: "report_create",
       procedure: "reportCreate",
@@ -3225,7 +3336,7 @@ var tools_default = {
                     properties: {
                       type: {
                         type: "string",
-                        description: "Enrichment type One of 45 values, e.g. content_and_metadata, browser_capture, ownership_and_registration, geolocation_and_ip, dns, tls, tcp, hostname_first_seen. Full list: resource chainpatrol://enums/asset_scan_enrichment_type"
+                        description: "Enrichment type One of 49 values, e.g. content_and_metadata, browser_capture, ownership_and_registration, geolocation_and_ip, dns, tls, tcp, hostname_first_seen. Full list: resource chainpatrol://enums/asset_scan_enrichment_type"
                       },
                       source: {
                         type: "string",
@@ -3396,7 +3507,7 @@ var tools_default = {
             type: "array",
             items: {
               type: "string",
-              description: "One of 94 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
+              description: "One of 95 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
             },
             description: "Filter by asset types"
           },
@@ -3556,7 +3667,7 @@ var tools_default = {
             type: "array",
             items: {
               type: "string",
-              description: "One of 94 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
+              description: "One of 95 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
             },
             description: "Filter by asset types"
           },
@@ -3812,7 +3923,7 @@ var tools_default = {
                 type: "array",
                 items: {
                   type: "string",
-                  description: "One of 94 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
+                  description: "One of 95 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
                 },
                 minItems: 1
               }
@@ -4035,6 +4146,7 @@ var tools_default = {
         "apple_app_store_listing",
         "google_play_store_listing",
         "mozilla_addon",
+        "github_comment",
         "reddit_subreddit",
         "email_validation",
         "phone_lookup",
@@ -4056,7 +4168,10 @@ var tools_default = {
         "meta_ad",
         "google_ad",
         "adlibrary_ad",
-        "contract_deployer"
+        "contract_deployer",
+        "threat_intel",
+        "list_membership",
+        "threat_score"
       ],
       usedBy: [
         "report_create.type"
@@ -4158,7 +4273,8 @@ var tools_default = {
         "SMARTMONEYMATCH",
         "APK_GOLD",
         "GLASSDOOR",
-        "PUMP_FUN"
+        "PUMP_FUN",
+        "TUMBLR"
       ],
       usedBy: [
         "asset_changelog.type",
@@ -4168,6 +4284,7 @@ var tools_default = {
         "metrics_takedown_time_trend.assetTypes",
         "organization_assets_list.type",
         "organization_reports_list.assetTypes",
+        "organization_threats_list.assetType",
         "takedowns_list.assetType",
         "threats_list.assetType",
         "user_orgs.assetTypes"
@@ -4196,6 +4313,7 @@ var tools_default = {
         "blocklist",
         "apple_app_store",
         "google_ads_search",
+        "google_ads_transparency_search",
         "mozilla_addon_search",
         "reddit_subreddit_search",
         "asset_check",
@@ -4536,7 +4654,7 @@ var package_default = {
   name: "@chainpatrol/mcp",
   description: "The official ChainPatrol MCP server \u2014 every public API capability as an MCP tool",
   author: "ChainPatrol <support@chainpatrol.io>",
-  version: "1.11.0",
+  version: "1.12.0",
   license: "UNLICENSED",
   homepage: "https://chainpatrol.com/docs/mcp",
   keywords: [
@@ -4613,4 +4731,4 @@ export {
   toolsFromEnvironment,
   PACKAGE_VERSION
 };
-//# sourceMappingURL=chunk-7U4RIDQZ.js.map
+//# sourceMappingURL=chunk-JE3KUTYE.js.map