@cliwant/mcp-sam-gov 1.13.0 → 1.13.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cliwant/mcp-sam-gov",
-  "version": "1.13.0",
+  "version": "1.13.2",
   "mcpName": "io.github.cliwant/mcp-sam-gov",
   "description": "Most comprehensive keyless-first MCP server for US federal + state/local (SLED) contracting + spending + regulation: SAM.gov, USAspending, Federal Register, eCFR, Grants.gov, plus SLED procurement bids (OpenGov, Bonfire, ArcGIS, Socrata 53 hosts). 152 tools (147 need no API key), plug into Claude Desktop / Claude Code / Codex CLI / Cursor / Continue / Gemini CLI.",
   "keywords": [

package/src/feedback.ts

@@ -20,6 +20,13 @@
  *   • Non-nagging. Error links are attached only to the two "something may be
  *     broken" kinds (schema_drift, upstream_unavailable) — never to expected
  *     outcomes (not_found, invalid_input, rate_limited).
+ *   • Countable. Every prefilled body starts with one fixed HTML comment,
+ *     `<!-- mcp-sam-gov:tool-report v=<server version> kind=<report kind> -->`
+ *     (invisible once the issue renders). GitHub drops a prefilled `labels=`
+ *     for filers without triage rights, so the repo's label-tool-reports
+ *     workflow reads this marker instead and applies `from-tool`. The marker
+ *     holds only the server version and the report kind — never a tool
+ *     argument, query, key, path, or the caller's summary.
  */
 
 export const REPO_URL = "https://github.com/cliwant/mcp-sam-gov";
@@ -30,6 +37,27 @@ export type FeedbackKind = "bug" | "feature" | "wrong_output";
 const REDACT_NOTE =
   "⚠️ This is a PUBLIC issue. Do NOT paste API keys, credentials, personal data, or sensitive query values — redact anything private before you submit.";
 
+/** The fixed token the label-tool-reports workflow looks for in an issue body. */
+export const TOOL_REPORT_MARKER_TOKEN = "mcp-sam-gov:tool-report";
+
+// Both marker values come from closed sets (SERVER_VERSION, an error kind or a
+// FeedbackKind), but they are still checked here so the marker can never carry
+// anything else, and can never close the HTML comment early.
+const MARKER_KIND_RE = /^[a-z][a-z_]{0,39}$/;
+const MARKER_VERSION_RE = /^\d{1,4}\.\d{1,4}\.\d{1,4}(?:-[0-9A-Za-z.]{1,20})?$/;
+
+/**
+ * The one-line, PII-free HTML comment put at the top of every prefilled body:
+ * `<!-- mcp-sam-gov:tool-report v=<version> kind=<kind> -->`. A value that does
+ * not match its pattern is written as `unknown`. It goes FIRST in the body so a
+ * URL cut short at the end still keeps it, and it adds under 100 URL characters.
+ */
+export function toolReportMarker(kind: string, version: string): string {
+  const v = MARKER_VERSION_RE.test(version) ? version : "unknown";
+  const k = MARKER_KIND_RE.test(kind) ? kind : "unknown";
+  return `<!-- ${TOOL_REPORT_MARKER_TOKEN} v=${v} kind=${k} -->`;
+}
+
 /**
  * Build a GitHub "new issue" URL with a prefilled title/body/labels. Everything
  * is URL-encoded via URLSearchParams. A prefilled label that does not exist in
@@ -54,6 +82,7 @@ export function reportUrlForError(tool: string, kind: string, version: string):
       ? "schema_drift means the government API very likely changed its response shape, so the wrapper needs updating — this is the single most useful thing to report."
       : "upstream_unavailable is often a transient government-side outage; please report only if it PERSISTS or the endpoint appears to have permanently moved.";
   const body = [
+    toolReportMarker(kind, version),
     "**Reporting a tool problem** (this link was suggested by the server).",
     "",
     `- **Tool:** \`${tool}\``,
@@ -120,12 +149,16 @@ export type FeedbackResult = {
  * report into a PREFILLED GitHub new-issue URL for the HUMAN to open and submit.
  * Pure + keyless: no network, no posting. `summary` is caller-supplied free text
  * and is trusted to be non-sensitive (the description + privacy note say so).
+ * `version` is the server version, used only in the tool-report marker.
  */
-export function feedbackTool(input: {
-  kind?: FeedbackKind;
-  tool?: string;
-  summary?: string;
-}): FeedbackResult {
+export function feedbackTool(
+  input: {
+    kind?: FeedbackKind;
+    tool?: string;
+    summary?: string;
+  },
+  version: string,
+): FeedbackResult {
   const kind: FeedbackKind = input.kind ?? "bug";
   const toolPart = input.tool ? `[${input.tool}] ` : "";
   const summary = (input.summary ?? "").trim();
@@ -135,19 +168,20 @@ export function feedbackTool(input: {
       ? "**What I want to be able to do:**"
       : "**What I did, expected, and got:**";
   const body = [
-    `**Type:** ${KIND_TITLE[kind]}`,
-    input.tool ? `**Tool:** \`${input.tool}\`` : "",
-    "",
-    `${lead} ${summary || "_(describe)_"}`,
-    "",
-    kind === "feature"
-      ? "**Why it matters / use case:** _(describe)_"
-      : "**Steps to reproduce:** _(describe — no sensitive values)_",
-    "",
-    REDACT_NOTE,
-  ]
-    .filter((line, i) => !(line === "" && i === 2 && !input.tool))
-    .join("\n");
+    toolReportMarker(kind, version),
+    ...[
+      `**Type:** ${KIND_TITLE[kind]}`,
+      input.tool ? `**Tool:** \`${input.tool}\`` : "",
+      "",
+      `${lead} ${summary || "_(describe)_"}`,
+      "",
+      kind === "feature"
+        ? "**Why it matters / use case:** _(describe)_"
+        : "**Steps to reproduce:** _(describe — no sensitive values)_",
+      "",
+      REDACT_NOTE,
+    ].filter((line, i) => !(line === "" && i === 2 && !input.tool)),
+  ].join("\n");
   return {
     reportUrl: buildIssueUrl({ title, body, labels: KIND_LABELS[kind] }),
     repo: REPO_URL,
@@ -155,6 +189,6 @@ export function feedbackTool(input: {
     instructions:
       "Open reportUrl in a browser and submit the issue yourself — the server does NOT post anything automatically. Edit the prefilled title/body first if you like.",
     privacy:
-      "The link prefills only your summary + tool name — no API keys, query values, or personal data. Keep it that way; the issue is public.",
+      "The link prefills only your summary, tool name, server version and report kind — no API keys, query values, or personal data. Keep it that way; the issue is public.",
   };
 }

package/src/server.ts

@@ -108,7 +108,7 @@ import { realpathSync } from "node:fs";
 const SERVER_NAME = "mcp-sam-gov";
 // Kept in lockstep with package.json / manifest.json / server.json.
 // Keep in sync with package.json "version" (asserted at release; see CHANGELOG).
-const SERVER_VERSION = "1.13.0";
+const SERVER_VERSION = "1.13.2";
 
 // ─── Tool input schemas (Zod) ────────────────────────────────────
 
@@ -6640,7 +6640,7 @@ export const TOOLS: ToolDef[] = [
     description:
       "Report a problem, request a feature, or flag a wrong-looking result for THIS server — returns a PREFILLED GitHub issue link (public repo cliwant/mcp-sam-gov) for the USER to open and submit. KEYLESS. The server does NOT post anything: it only builds the link; the human submits it (nothing is sent automatically, no network call). Use when the user reports a bug, says a tool's output looks wrong, or wants a capability this server doesn't have. Input (all optional): `kind` (bug|feature|wrong_output, default bug), `tool` (the tool it's about), `summary` (a short, NON-SENSITIVE title line). Returns { reportUrl, repo, willPost:false, instructions, privacy }. PRIVACY: never put secrets, personal data, or sensitive query values in `summary` — the issue is PUBLIC and the link prefills only your summary + tool + server version.",
     inputSchema: FeedbackInput,
-    handler: async (input) => feedback.feedbackTool(input),
+    handler: async (input) => feedback.feedbackTool(input, SERVER_VERSION),
   }),
 ];