@finchagentic/mcp 4.5.0 → 4.6.1

package/README.md

@@ -29,13 +29,13 @@ Always pin the version. Never use `@latest`.
 
 ```bash
 # One-command installer (detects common MCP clients)
-npx -y -p @finchagentic/mcp@4.5.0 finch install
+npx -y -p @finchagentic/mcp@4.6.1 finch install
 ```
 
 ### Claude Code
 
 ```bash
-claude mcp add finch -s user -- npx -y -p @finchagentic/mcp@4.5.0 finch-mcp
+claude mcp add finch -s user -- npx -y -p @finchagentic/mcp@4.6.1 finch-mcp
 ```
 
 ### Cursor / Windsurf / Claude Desktop
@@ -45,7 +45,7 @@ claude mcp add finch -s user -- npx -y -p @finchagentic/mcp@4.5.0 finch-mcp
   "mcpServers": {
     "finch": {
       "command": "npx",
-      "args": ["-y", "-p", "@finchagentic/mcp@4.5.0", "finch-mcp"]
+      "args": ["-y", "-p", "@finchagentic/mcp@4.6.1", "finch-mcp"]
     }
   }
 }
@@ -59,7 +59,7 @@ claude mcp add finch -s user -- npx -y -p @finchagentic/mcp@4.5.0 finch-mcp
     "finch": {
       "type": "stdio",
       "command": "npx",
-      "args": ["-y", "-p", "@finchagentic/mcp@4.5.0", "finch-mcp"]
+      "args": ["-y", "-p", "@finchagentic/mcp@4.6.1", "finch-mcp"]
     }
   }
 }
@@ -124,7 +124,7 @@ Default palette is `core` (lighter context). Full set:
 Finch is the runtime. **Your LLM is the brain. Your data stays yours.**
 
 ```bash
-npx -y -p @finchagentic/mcp@4.5.0 finch setup
+npx -y -p @finchagentic/mcp@4.6.1 finch setup
 # enable local vault (and optional local memory)
 ```
 
@@ -156,7 +156,7 @@ Scheduled/cloud features still need an account. Core memory, vault, and public-d
 Guided setup:
 
 ```bash
-npx -y -p @finchagentic/mcp@4.5.0 finch setup
+npx -y -p @finchagentic/mcp@4.6.1 finch setup
 ```
 
 ## Security
@@ -165,7 +165,7 @@ npx -y -p @finchagentic/mcp@4.5.0 finch setup
 |:-:|----------|------|
 | 1 | Prompt injection | External content is data only — never instructions |
 | 2 | Mainnet confirm | Estimate → preview → confirm → execute |
-| 3 | Pinned install | Always `@finchagentic/mcp@4.5.0`, never `@latest` |
+| 3 | Pinned install | Always `@finchagentic/mcp@4.6.1`, never `@latest` |
 | 4 | Credential vault | Never paste secrets into prompts or third-party tools |
 | 5 | Data disclosure | Know what leaves the machine (LLM, Firecrawl, GitHub, chain RPCs) |
 | 6 | Server monitors | Scheduled jobs need explicit confirmation |

package/dist/_text-search.js

@@ -0,0 +1,39 @@
+"use strict";
+// Shared substring/keyword scoring for the local-file backends
+// (local-memory-file.ts, local-vault.ts) - no embeddings, no server, zero
+// dependencies. Word-boundary aware, not raw substring counting - a short
+// common term like "is"/"a" used to score a "match" purely by being a
+// substring of an unrelated word ("is" inside "distances", "a" inside
+// "banana"). Found via real testing of memory_add's new conflict-hint
+// feature: a query for "the user's favorite pizza topping is pepperoni"
+// registered as "related" to a completely unrelated stored memory about
+// metric vs imperial units, purely because both contained "the" and "is".
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.meaningfulTerms = meaningfulTerms;
+exports.wordOccurrences = wordOccurrences;
+const STOP_WORDS = new Set([
+    "a", "an", "the", "is", "are", "was", "were", "be", "been", "being",
+    "to", "of", "in", "on", "at", "for", "with", "by", "from", "as",
+    "and", "or", "but", "if", "so", "this", "that", "it", "its", "i",
+    "you", "your", "they", "them", "their", "he", "she", "his", "her",
+    "not", "no", "do", "does", "did", "has", "have", "had", "will", "would",
+]);
+/** Query terms worth scoring against - lowercased, stop-words and
+ *  single-character noise dropped. An empty result means the query was
+ *  entirely stop words/punctuation - callers should treat that as "no
+ *  meaningful query" (return no matches) rather than matching everything. */
+function meaningfulTerms(query) {
+    return query
+        .toLowerCase()
+        .split(/[^a-z0-9]+/)
+        .filter((t) => t.length > 1 && !STOP_WORDS.has(t));
+}
+function escapeRegex(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/** Word-boundary occurrence count of `term` inside `haystack` - not a raw
+ *  substring count, so "is" doesn't match inside "distances" or "this". */
+function wordOccurrences(haystack, term) {
+    const re = new RegExp(`\\b${escapeRegex(term)}\\b`, "g");
+    return (haystack.match(re) || []).length;
+}

package/dist/local-memory-file.js

@@ -44,6 +44,7 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const crypto = __importStar(require("crypto"));
+const _text_search_js_1 = require("./_text-search.js");
 function getLocalMemoryFileConfig() {
     return { dir: path.join(os.homedir(), ".finch", "memory") };
 }
@@ -107,7 +108,9 @@ function fileMemoryDeleteByVaultKey(cfg, vaultKey) {
 }
 function fileMemorySearch(cfg, query, limit) {
     const idx = readIndex(cfg);
-    const terms = query.toLowerCase().split(/\s+/).filter(Boolean);
+    const terms = (0, _text_search_js_1.meaningfulTerms)(query);
+    if (terms.length === 0)
+        return [];
     const scored = [];
     for (const m of idx.memories) {
         const hay = `${m.title ?? ""}\n${(m.tags ?? []).join(" ")}\n${m.content}`.toLowerCase();
@@ -117,7 +120,7 @@ function fileMemorySearch(cfg, query, limit) {
                 score += 3;
             if ((m.tags ?? []).some((tag) => tag.toLowerCase().includes(t)))
                 score += 2;
-            score += Math.min(hay.split(t).length - 1, 5);
+            score += Math.min((0, _text_search_js_1.wordOccurrences)(hay, t), 5);
         }
         if (score > 0)
             scored.push({ m, score });

package/dist/local-vault.js

@@ -53,6 +53,7 @@ const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const crypto = __importStar(require("crypto"));
 const config_js_1 = require("./config.js");
+const _text_search_js_1 = require("./_text-search.js");
 // Fully-local, user-owned Noel-Vault backend. Mirrors the two-tier pattern of
 // local-memory.ts: when the user opts in (`vaultBackend: "local"`), the vault
 // tools store versioned artifacts on the user's own disk under
@@ -232,8 +233,10 @@ function localVaultList(cfg, opts) {
 // ── search (full-text, local) ─────────────────────────────────────────────────
 function localVaultSearch(cfg, query, opts) {
     const idx = readIndex(cfg);
-    const terms = query.toLowerCase().split(/\s+/).filter(Boolean);
+    const terms = (0, _text_search_js_1.meaningfulTerms)(query);
     const scored = [];
+    if (terms.length === 0)
+        return { results: [] };
     for (const e of Object.values(idx.entries)) {
         if (e.type === "credential")
             continue;
@@ -247,8 +250,7 @@ function localVaultSearch(cfg, query, opts) {
                 score += 3;
             if (e.tags.some((tag) => tag.toLowerCase().includes(t)))
                 score += 2;
-            const occurrences = hay.split(t).length - 1;
-            score += Math.min(occurrences, 5);
+            score += Math.min((0, _text_search_js_1.wordOccurrences)(hay, t), 5);
         }
         if (score > 0) {
             const firstHit = terms.map((t) => content.toLowerCase().indexOf(t)).filter((i) => i >= 0).sort((a, b) => a - b)[0] ?? 0;

package/dist/tools/memory.js

@@ -49,6 +49,7 @@ const convex_js_1 = require("../convex.js");
 const public_url_js_1 = require("../public-url.js");
 const local_vault_js_1 = require("../local-vault.js");
 const local_memory_js_1 = require("../local-memory.js");
+const _text_search_js_1 = require("../_text-search.js");
 // memory_extract and memory_consolidate used to run their own LLM calls here
 // (and a matching pair of Convex routes did the same server-side). Both are now
 // two-pass: the tool fetches and stores, the caller decides what the facts are
@@ -304,7 +305,11 @@ exports.MEMORY_TOOLS = [
             "searchable in ~30s. Retrieval is full-text (keyword) search, not embeddings - " +
             "'what did I say about ETH yield?' finds notes containing those words or close variants, " +
             "not unrelated phrasing with the same meaning. " +
-            "Auto-deduplicates: identical content in your recent 50 memories is skipped (override with force:true).",
+            "Auto-deduplicates: identical content in your recent 50 memories is skipped (override with force:true). " +
+            "Also surfaces up to 3 existing memories that share real keyword overlap with what you just saved (a " +
+            "possible-conflict HINT, not a verdict - Finch doesn't call an LLM to judge this). When that shows up, " +
+            "read them and decide yourself whether the new one supersedes an old preference/fact; if so, say so in a " +
+            "follow-up memory_add, or fold both into one with memory_consolidate.",
         inputSchema: {
             type: "object",
             properties: {
@@ -563,6 +568,46 @@ async function handleMemoryTool(name, args) {
             // dedupes even before supermemory has indexed the first one.
             if (!sourceUrl)
                 rememberRecentHash(hash, data?.id ?? "saved", title);
+            // ─── Conflict hint (not a proof) ──────────────────────────────────
+            // Finch never runs its own LLM call to judge this - "two-pass, no API
+            // key needed" is deliberate (see this file's header comment), and an
+            // autonomous contradiction call would break that. Instead this just
+            // resurfaces whatever memory_search's own retrieval already ranks as
+            // related to the content just saved, so the CALLING model - already
+            // reasoning about this exact save, in the same turn, no extra API
+            // cost - can judge for itself whether the two actually conflict and
+            // decide what to do (mark the old one superseded, fold both into
+            // memory_consolidate, or just note the new one is the current one).
+            // Best-effort: a search hiccup here must never fail or block the save
+            // that already succeeded above.
+            let conflictNote = "";
+            try {
+                const related = await hybridMemorySearch(content, 8);
+                // hybridMemorySearch's score is rank-based and normalized per-call -
+                // a single weak match (one common word) can still come back as
+                // "top result, 100%" purely for lack of competition. Found live:
+                // "the user's favorite pizza topping" registered as "related" to a
+                // completely unrelated units-preference memory, because both
+                // happened to say "user". Counting actual shared meaningful terms
+                // (>=2 distinct, not stop words) is a real, absolute bar instead of
+                // trusting a relative score - "user" alone no longer qualifies,
+                // "user"+"prefers"+"units"+"metric"/"imperial" does.
+                const newTerms = new Set((0, _text_search_js_1.meaningfulTerms)(content));
+                const candidates = related
+                    .filter((r) => r.id !== data?.id && contentHash(r.content) !== hash)
+                    .map((r) => ({ r, overlap: new Set((0, _text_search_js_1.meaningfulTerms)(r.content).filter((t) => newTerms.has(t))).size }))
+                    .filter((x) => x.overlap >= 2)
+                    .sort((a, b) => b.overlap - a.overlap)
+                    .slice(0, 3)
+                    .map((x) => x.r);
+                if (candidates.length) {
+                    conflictNote = "\n\n⚠️ **Possibly related existing memories** - skim these for a conflict with what you just saved (e.g. an old preference this replaces):\n" +
+                        candidates.map((r) => `- \`${r.id}\`: ${r.content.slice(0, 100)}${r.content.length > 100 ? "…" : ""}`).join("\n");
+                }
+            }
+            catch {
+                // best-effort only
+            }
             return {
                 content: [{
                         type: "text",
@@ -573,7 +618,7 @@ async function handleMemoryTool(name, args) {
                             tags?.length ? `Tags: ${tags.join(", ")}` : "",
                             ``,
                             `Find it with: \`memory_search query: "${(title ?? content).slice(0, 40)}"\``,
-                        ].filter(Boolean).join("\n"),
+                        ].filter(Boolean).join("\n") + conflictNote,
                     }],
             };
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finchagentic/mcp",
-  "version": "4.5.0",
+  "version": "4.6.1",
   "description": "The runtime layer for Agentic AI. Persistent memory, autonomous agents, and workflows that survive every session.",
   "main": "dist/index.js",
   "bin": {