@forgemeshlabs/gov-transparency-mcp 0.1.6 → 0.1.7

package/index.js

@@ -98,7 +98,7 @@ const TOOLS = [
       openWorldHint: true,
     },
     description:
-      "PAID ($0.02) — Congress stock trades from official STOCK Act disclosures: US House member trades with ticker, asset, buy/sell, transaction date, and disclosed amount range. Filter by member name, ticker, trade type (purchase/sale/sale_partial/exchange), state, or date window. Disclosures lag trades by up to 45 days by law. Requires WALLET_PRIVATE_KEY.",
+      "PAID ($0.02) — Congress stock trades from official STOCK Act disclosures: US House member trades with ticker, asset, buy/sell, transaction date, and disclosed amount range. Filter by member name, ticker, trade type (purchase/sale/sale_partial/exchange), state, or date window. House only, no Senate; disclosures lag trades by up to 45 days by law. Requires WALLET_PRIVATE_KEY.",
     inputSchema: {
       type: "object",
       properties: {
@@ -348,6 +348,10 @@ async function main() {
       }
       return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
     } catch (e) {
+      if (e && e.status !== undefined) {
+        // Service refusal: structured data, the upstream body is untrusted and never interpolated into prose.
+        return { content: [{ type: "text", text: JSON.stringify({ error: e.message, status: e.status, charged: e.charged, upstream: e.upstream, untrusted: true }, null, 2) }], isError: true };
+      }
       return { content: [{ type: "text", text: `Error: ${e.message}` }], isError: true };
     }
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgemeshlabs/gov-transparency-mcp",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "Watch the watchers: congressional stock trades, federal contracts, campaign finance, lobbying, and new regulations as nine MCP tools. All official US government data, paid per call with x402 USDC on Base — no account or API key.",
   "main": "index.js",
   "bin": {

package/x402-guard.js

@@ -99,6 +99,24 @@ function createGuard(opts) {
     }
   }
 
+  // Keep the service's refusal as data, never as prose: the message is fixed (status plus a short error
+  // code if the service sent one); the parsed body is carried in err.upstream, capped at 1500 chars.
+  function httpError(res, prefix, charged) {
+    let upstream;
+    try { upstream = JSON.parse(res.text); } catch { upstream = res.text.slice(0, 1500); }
+    if (upstream && typeof upstream === "object") {
+      const json = JSON.stringify(upstream);
+      if (json.length > 1500) upstream = json.slice(0, 1500);
+    }
+    const code = upstream && typeof upstream === "object" && typeof upstream.error === "string" && /^[A-Za-z0-9_.-]{1,64}$/.test(upstream.error) ? upstream.error : null;
+    const err = new Error(`${prefix}HTTP ${res.status}${code ? ` (${code})` : ""}`);
+    err.status = res.status;
+    err.upstream = upstream;
+    if (charged !== undefined) err.charged = charged;
+    else if (upstream && typeof upstream === "object" && typeof upstream.charged === "boolean") err.charged = upstream.charged;
+    return err;
+  }
+
   function parseJson(res) {
     try { return JSON.parse(res.text); } catch { throw new Error(`HTTP ${res.status}: non-JSON response`); }
   }
@@ -111,7 +129,7 @@ function createGuard(opts) {
     const init = { method, headers: { ...headers, ...(body ? { "content-type": "application/json" } : {}) }, ...(body ? { body: JSON.stringify(body) } : {}) };
     const res = await fetchBounded(url, init);
     if (res.status !== 402) {
-      if (!res.ok) throw new Error(`HTTP ${res.status}: ${res.text.slice(0, 200)}`);
+      if (!res.ok) throw httpError(res, "", false); // nothing was signed, so nothing was charged
       return parseJson(res);
     }
     let challenge;
@@ -119,7 +137,7 @@ function createGuard(opts) {
     const paymentRequired = httpClient.getPaymentRequiredResponse((n) => res.headers.get(n), challenge);
     const payload = await httpClient.createPaymentPayload(paymentRequired); // policy runs (and reserves budget) inside
     const paid = await fetchBounded(url, { ...init, headers: { ...init.headers, ...httpClient.encodePaymentSignatureHeader(payload) } });
-    if (!paid.ok) throw new Error(`Payment failed — HTTP ${paid.status}: ${paid.text.slice(0, 200)}`);
+    if (!paid.ok) throw httpError(paid, "Payment failed — ");
     let settle = null;
     try { settle = httpClient.getPaymentSettleResponse((n) => paid.headers.get(n)) || null; } catch { settle = null; }
     const contentType = paid.headers.get("content-type") || "";