@kaminari-ad/mcp 0.4.0 → 0.5.2

package/CHANGELOG.md

@@ -7,8 +7,40 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.2] - 2026-06-20
+
+### Security
+
+- **Bump `undici` 8.3.0 to 8.5.0** to clear the npm-audit gate after the
+  upstream disclosure of seven high-severity advisories (TLS validation
+  bypass, shared-cache disclosure, Set-Cookie SameSite downgrade, header
+  injection, WebSocket DoS). `undici` is a direct dependency.
+
+### Added
+
+- **Security response headers on the HTTP transport.** Every HTTP
+  response now carries `Strict-Transport-Security`,
+  `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`,
+  `Referrer-Policy: no-referrer`, and `Permissions-Policy`. These moved
+  off the upstream edge proxy so `mcp.kaminari.ad` is self-contained. No
+  CORS and no org-identifying headers are added (tenant-isolation rules).
+
+> `0.5.1` was tagged prematurely (before the version bump) and is
+> superseded by `0.5.2`; it was never published to npm.
+
+## [0.5.0] - 2026-06-17
+
 ### Added
 
+- **Ready-made scan report links.** `get_scan`, `list_scans`, and
+  `list_run_scans` now surface `report_url` (authenticated dashboard
+  report) and `public_report_url` (shareable, no-login) for every scan,
+  and `screenshot_url` / `creative_screenshot_url` are absolute URLs.
+  The agent links to a scan using these fields verbatim instead of
+  hand-building URLs (it previously guessed the apex host instead of the
+  `app.kaminari.ad` SPA host). A new MCP server `instructions` string
+  (advertised on both transports during `initialize`) reinforces the
+  rule: never construct scan/app URLs — use the ones the API returns.
 - **OAuth 2.0 Protected Resource discovery.** The HTTP transport now
   serves `GET /.well-known/oauth-protected-resource` (RFC 9728) and
   returns `WWW-Authenticate: Bearer resource_metadata="…", scope="…"`
@@ -62,6 +94,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   were no-ops; removing them is non-breaking (unknown keys were
   already stripped by input validation).
 
+### Security
+
+- **Cleared the `audit:deps` gate (5 advisories).** `npm audit fix`
+  resolved form-data (high), vite (high), and `@babel/core`; `js-yaml`
+  is forced to `4.2.0` via `overrides` (transitive through the dev-only
+  `@redocly/openapi-core`). Runtime dependencies are unchanged.
+
 ## [0.3.0] - 2026-05-20
 
 Major-feature release — full parity with the API surface added in

package/dist/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { NAME, VERSION, err, ok } from './chunk-RBCMUVI6.js';
+import { NAME, VERSION, err, ok } from './chunk-SQVFFWOB.js';
 import process from 'process';
 import { z } from 'zod';
 
@@ -162,10 +162,10 @@ async function main() {
   }
   const config = configResult.value;
   if (config.transport === "stdio") {
-    const { bootstrapStdio } = await import('./stdio-bootstrap-7GVABHZQ.js');
+    const { bootstrapStdio } = await import('./stdio-bootstrap-JBLNH46R.js');
     return bootstrapStdio(config);
   }
-  const { bootstrapHttp } = await import('./http-bootstrap-TGX6STYD.js');
+  const { bootstrapHttp } = await import('./http-bootstrap-X2Y2VGBO.js');
   return bootstrapHttp(config);
 }
 main().then(

package/dist/{chunk-7DSLLKEK.js → chunk-3CY2WEZF.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { err, ok } from './chunk-RBCMUVI6.js';
+import { err, ok } from './chunk-SQVFFWOB.js';
 import { createHash, randomUUID } from 'crypto';
 import createClient from 'openapi-fetch';
 import { fetch } from 'undici';
@@ -332,6 +332,8 @@ var ScanResponse = z.object({
   offer_url: z.string(),
   redirect_chain: z.array(RedirectHopResponse),
   screenshot_url: z.string().optional().default(""),
+  report_url: z.string().optional().default(""),
+  public_report_url: z.string().optional().default(""),
   ad_tag: z.union([z.string(), z.null()]).optional(),
   creative_screenshot_url: z.string().optional().default(""),
   creative_width: z.number().int().optional().default(0),
@@ -357,6 +359,8 @@ var ScanBriefResponse = z.object({
   status: ScanStatus,
   offer_url: z.string(),
   screenshot_url: z.string().optional().default(""),
+  report_url: z.string().optional().default(""),
+  public_report_url: z.string().optional().default(""),
   labels: z.record(z.string()).optional(),
   classification: z.union([ScanClassificationResponse, z.null()]).optional(),
   elapsed_ms: z.number().int(),
@@ -533,6 +537,8 @@ var ScanTileResponse = z.object({
   status: z.string(),
   offer_url: z.string().optional().default(""),
   screenshot_url: z.string().optional().default(""),
+  report_url: z.string().optional().default(""),
+  public_report_url: z.string().optional().default(""),
   elapsed_ms: z.number().int().optional().default(0),
   error: z.string().optional().default("")
 }).passthrough();
@@ -1630,6 +1636,8 @@ var ScanTileSchema = schemas.ScanTileResponse.pick({
   status: true,
   offer_url: true,
   screenshot_url: true,
+  report_url: true,
+  public_report_url: true,
   elapsed_ms: true,
   error: true
 }).strip();
@@ -1642,6 +1650,8 @@ var ScanSchema = schemas.ScanResponse.pick({
   status: true,
   offer_url: true,
   screenshot_url: true,
+  report_url: true,
+  public_report_url: true,
   ad_tag: true,
   creative_screenshot_url: true,
   page_title: true,
@@ -1665,6 +1675,8 @@ var ScanBriefSchema = schemas.ScanBriefResponse.pick({
   status: true,
   offer_url: true,
   screenshot_url: true,
+  report_url: true,
+  public_report_url: true,
   labels: true,
   elapsed_ms: true,
   campaign_id: true,
@@ -2534,6 +2546,18 @@ function wrap(impl) {
     }
   };
 }
+
+// src/shared/server-instructions.ts
+var SERVER_INSTRUCTIONS = [
+  "Kaminari Ad \u2014 ad-verification API (malvertising, scams, policy violations).",
+  "",
+  "Linking to a scan: use the URL fields the tools return \u2014 never build or guess them.",
+  "- `report_url`: authenticated dashboard report (requires login).",
+  "- `public_report_url`: shareable report (no login).",
+  "- `screenshot_url` / `creative_screenshot_url`: absolute, directly followable.",
+  "These come from `get_scan`, `list_scans`, and `list_run_scans`. Do NOT assemble",
+  "scan/app URLs from a base host yourself \u2014 the apex domain does not serve scan pages."
+].join("\n");
 function declareEmptyResourcesAndPrompts(server) {
   server.server.registerCapabilities({ resources: {}, prompts: {} });
   server.server.setRequestHandler(ListResourcesRequestSchema, async () => {
@@ -4480,7 +4504,7 @@ var ListRunScansInputShape = {
 };
 var listRunScansTool = {
   name: "list_run_scans",
-  description: "List the tile-scan items produced by one run (status, country, offer URL, screenshot, elapsed ms, error). For full scan details (input URL, labels, classification, redirect chain) fetch a specific scan via `get_scan`.",
+  description: "List the tile-scan items produced by one run (status, country, offer URL, absolute screenshot URL, report_url + public_report_url deep-links, elapsed ms, error). Link users to a scan with the returned `report_url` (auth dashboard) or `public_report_url` (shareable) \u2014 never hand-build URLs. For full scan details (input URL, labels, classification, redirect chain) fetch a specific scan via `get_scan`.",
   annotations: {
     title: "List Run Scans",
     readOnlyHint: true,
@@ -4601,7 +4625,7 @@ var GetScanInputShape = {
 };
 var getScanTool = {
   name: "get_scan",
-  description: "Get full detail for one scan by UUID: status, offer URL, screenshot URL, timing, labels, and the parent campaign if any.",
+  description: "Get full detail for one scan by UUID: status, offer URL, absolute screenshot URL, report_url + public_report_url deep-links, timing, labels, and the parent campaign if any. Link users with the returned `report_url` / `public_report_url` \u2014 never construct URLs yourself.",
   annotations: {
     title: "Get Scan",
     readOnlyHint: true,
@@ -4719,7 +4743,7 @@ var ListScansInputShape = {
 };
 var listScansTool = {
   name: "list_scans",
-  description: "List scans for the caller's organization with optional filters (status, country, URL substring, date range, run/campaign/group, tag, AI/IAB/brand category, dynamic labels). Returns a paginated envelope.",
+  description: "List scans for the caller's organization with optional filters (status, country, URL substring, date range, run/campaign/group, tag, AI/IAB/brand category, dynamic labels). Returns a paginated envelope; each scan carries an absolute screenshot URL plus report_url (auth dashboard) and public_report_url (shareable) deep-links \u2014 link users with those, never hand-build URLs.",
   annotations: {
     title: "List Scans",
     readOnlyHint: true,
@@ -5351,6 +5375,6 @@ function formatToolError(error) {
   }
 }
 
-export { BearerToken, createHttpApiGateway, createPinoLogger, declareEmptyResourcesAndPrompts, newRequestId, wireToolsIntoMcpServer };
-//# sourceMappingURL=chunk-7DSLLKEK.js.map
-//# sourceMappingURL=chunk-7DSLLKEK.js.map
+export { BearerToken, SERVER_INSTRUCTIONS, createHttpApiGateway, createPinoLogger, declareEmptyResourcesAndPrompts, newRequestId, wireToolsIntoMcpServer };
+//# sourceMappingURL=chunk-3CY2WEZF.js.map
+//# sourceMappingURL=chunk-3CY2WEZF.js.map