@nooticr/mcp 1.26.44 → 1.26.45

package/dist/shared/fetch-ledger.js

@@ -0,0 +1,154 @@
+const LIMIT = 2000;
+const POST_KEYS = ["posts", "window", "demand", "supply", "results"];
+/** One spelling per post: no trailing slash, no tracking query, YouTube's id kept. */
+export function postKey(url) {
+    if (typeof url !== "string" || !url.trim())
+        return "";
+    const raw = url.trim();
+    try {
+        const u = new URL(raw);
+        const host = u.hostname.toLowerCase().replace(/^(www|m|mobile)\./, "");
+        const keep = host.endsWith("youtube.com") && u.searchParams.get("v") ? `?v=${u.searchParams.get("v")}` : "";
+        return `${host}${u.pathname.replace(/\/+$/, "")}${keep}`;
+    }
+    catch {
+        return raw.replace(/[?#].*$/, "").replace(/\/+$/, "").toLowerCase();
+    }
+}
+const urlsOf = (row) => [row.externalUrl, row.url, row.permalink, row.postUrl].map(postKey).filter(Boolean);
+const handleOf = (row) => String(row.handle ?? row.username ?? row.creatorHandle ?? "")
+    .trim()
+    .replace(/^@/, "")
+    .toLowerCase();
+export const creatorKey = (row) => {
+    const h = handleOf(row);
+    return h ? `${String(row.platform ?? "").toLowerCase()}:${h}` : "";
+};
+const runKey = (term, ranAt) => `${String(term ?? "").trim().toLowerCase()}|${String(ranAt ?? "")}`;
+class Bounded {
+    map = new Map();
+    set(k, v) {
+        if (!k)
+            return;
+        this.map.delete(k);
+        this.map.set(k, v);
+        if (this.map.size > LIMIT)
+            this.map.delete(this.map.keys().next().value);
+    }
+    get(k) {
+        return k ? this.map.get(k) : undefined;
+    }
+}
+export class FetchLedger {
+    posts = new Bounded();
+    creators = new Bounded();
+    runs = new Bounded();
+    /** Keep what a tool returned. The views' own results are never kept: they echo the model. */
+    record(tool, structured) {
+        if (tool.startsWith("show_") || !structured || typeof structured !== "object")
+            return;
+        const sc = structured;
+        const keepPost = (p) => {
+            if (!p || typeof p !== "object")
+                return;
+            for (const k of urlsOf(p))
+                this.posts.set(k, p);
+        };
+        for (const key of POST_KEYS) {
+            if (Array.isArray(sc[key]))
+                for (const p of sc[key])
+                    keepPost(p);
+        }
+        keepPost(sc.post);
+        // analyze_post and its siblings carry the post's fields at the top level.
+        if (urlsOf(sc).length && (sc.views != null || sc.caption != null || sc.title != null))
+            keepPost(sc);
+        if (Array.isArray(sc.creators)) {
+            for (const c of sc.creators) {
+                if (c && typeof c === "object")
+                    this.creators.set(creatorKey(c), c);
+            }
+        }
+        if (Array.isArray(sc.runs)) {
+            for (const r of sc.runs) {
+                if (!r || typeof r !== "object" || r.ranAt == null)
+                    continue;
+                this.runs.set(runKey(sc.term, r.ranAt), r);
+                this.runs.set(runKey("", r.ranAt), r);
+            }
+        }
+    }
+    post(url) {
+        return this.posts.get(postKey(url));
+    }
+    /**
+     * Posts as the view should draw them: nooticr's fields over the model's,
+     * so a copied stat can never win, and the model's extra fields survive.
+     */
+    checkPosts(sent) {
+        const unmatched = [];
+        const rows = sent.map((p) => {
+            const ours = urlsOf(p).map((k) => this.posts.get(k)).find(Boolean);
+            if (!ours) {
+                unmatched.push(String(p.externalUrl ?? p.url ?? "a post with no URL"));
+                return p;
+            }
+            return { ...p, ...ours, verified: true };
+        });
+        return { rows, verification: verdict(rows.length, unmatched, "post") };
+    }
+    checkCreators(sent) {
+        const unmatched = [];
+        const rows = sent.map((c) => {
+            const ours = this.creators.get(creatorKey(c));
+            if (!ours) {
+                unmatched.push(`@${handleOf(c) || "?"}${c.platform ? ` on ${String(c.platform)}` : ""}`);
+                return c;
+            }
+            // The order and any ranking note are the model's; every figure is ours.
+            return { ...c, ...ours, verified: true };
+        });
+        return { rows, verification: verdict(rows.length, unmatched, "creator") };
+    }
+    checkRuns(sent, term) {
+        const unmatched = [];
+        const rows = sent.map((r) => {
+            const ours = this.runs.get(runKey(term, r.ranAt)) ?? this.runs.get(runKey("", r.ranAt));
+            if (!ours) {
+                unmatched.push(String(r.ranAt ?? "an undated point"));
+                return r;
+            }
+            return { ...r, ...ours, verified: true };
+        });
+        return { rows, verification: verdict(rows.length, unmatched, "point") };
+    }
+}
+function verdict(total, unmatched, noun) {
+    if (!unmatched.length) {
+        return {
+            status: "verified",
+            note: `All ${total} ${noun}${total === 1 ? "" : "s"} drawn with the figures nooticr returned in this session.`,
+            unmatched,
+        };
+    }
+    const n = unmatched.length;
+    return {
+        status: "unverified",
+        note: `${n} of ${total} ${noun}${total === 1 ? "" : "s"} ${n === 1 ? "is" : "are"} not among what nooticr ` +
+            `returned in this session, so ${n === 1 ? "its" : "their"} figures are as re-sent and were not ` +
+            `checked: ${unmatched.slice(0, 5).join(", ")}${n > 5 ? ", …" : ""}.`,
+        unmatched,
+    };
+}
+/**
+ * One ledger per server. Keyed off the server object so the task path
+ * (registerSlowTool) and the plain path record into the same one without
+ * threading it through every registration.
+ */
+const LEDGERS = new WeakMap();
+export function ledgerFor(server) {
+    let l = LEDGERS.get(server);
+    if (!l)
+        LEDGERS.set(server, (l = new FetchLedger()));
+    return l;
+}

package/dist/shared/output-schemas.js

@@ -311,6 +311,15 @@ const marketplaceScanShape = {
 };
 const marketplaceScan = open(marketplaceScanShape);
 const amazonScan = open(amazonScanShape);
+/**
+ * Whether a show_* view drew nooticr's own figures (#107): the session's
+ * fetch ledger overlays what was actually returned on what the model sent.
+ */
+const checkedAgainstSession = open({
+    status: scalar().describe("verified: every row matched what nooticr returned this session. unverified: some are as re-sent."),
+    note: scalar(),
+    unmatched: listOf(z.string()).describe("Rows not among what nooticr returned in this session; drawn as sent, unchecked."),
+}).nullish();
 export const OUTPUT_SCHEMAS = {
     analyze_post: open({ ...analyzed, ...evidence }),
     analyze_post_fast: open({ ...evidence, ...analyzed }),
@@ -539,6 +548,7 @@ export const OUTPUT_SCHEMAS = {
     // to land except chat text. Free, and make no requests, same as
     // show_comment_review: they only draw what they're handed.
     show_compared_posts: open({
+        verification: checkedAgainstSession,
         posts: listOf(post).describe("The 2-5 posts being compared, same shape as compare_posts returned."),
         comparison: open({
             winner: scalar().describe("1-indexed position of the post that won, matching the posts array."),
@@ -550,6 +560,7 @@ export const OUTPUT_SCHEMAS = {
         mcpCredits,
     }),
     show_post_analysis: open({
+        verification: checkedAgainstSession,
         url: scalar(),
         post: post.nullish().describe("The post analyze_post/analyze_post_fast/understand_social_post handed back."),
         analysis: open({}).passthrough().nullish().describe("Your own analysis, any of the fields analyze_post's guidance asked for — summary, " +
@@ -569,6 +580,7 @@ export const OUTPUT_SCHEMAS = {
         mcpCredits,
     }),
     show_variants: open({
+        verification: checkedAgainstSession,
         sourceUrl: scalar(),
         post: post.nullish(),
         variants: listOf(open({
@@ -945,6 +957,7 @@ export const OUTPUT_SCHEMAS = {
         mcpCredits,
     }),
     show_standings: open({
+        verification: checkedAgainstSession,
         creators: listOf(anyObject()),
         metric: scalar(),
         ranking: scalar().describe("Which axis the order is on — 'how often' and 'how big' disagree."),
@@ -1148,6 +1161,7 @@ export const OUTPUT_SCHEMAS = {
      * might want is left underived on purpose — the model reads the series.
      */
     show_trend: open({
+        verification: checkedAgainstSession,
         points: listOf(anyObject()),
         term: scalar(),
         metric: scalar(),

package/dist/shared/tasks.js

@@ -24,6 +24,7 @@
  * The task APIs are experimental in SDK 1.30 and may change under us. They are
  * contained here for that reason — one file to fix rather than three handlers.
  */
+import { ledgerFor } from "./fetch-ledger.js";
 import { InMemoryTaskStore } from "@modelcontextprotocol/sdk/experimental/tasks/stores/in-memory.js";
 /** How long a finished result stays fetchable. */
 export const TASK_TTL_MS = 900_000;
@@ -67,6 +68,7 @@ export function registerSlowTool(server, name, config, run) {
             void (async () => {
                 try {
                     const result = await run(args, extra);
+                    ledgerFor(server).record(name, result?.structuredContent);
                     await extra.taskStore.storeTaskResult(task.taskId, result?.isError ? "failed" : "completed", result);
                 }
                 catch (err) {

package/dist/shared/tools.js

@@ -5,6 +5,7 @@
  * file for the CLI, KV session for the worker) — the tool bodies, schemas and
  * result formatting live here and nowhere else.
  */
+import { ledgerFor } from "./fetch-ledger.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 import { NooticrError, safeCreditsHint } from "./nooticr.js";
@@ -29,7 +30,7 @@ import { registerCollabTools } from "./collab.js";
 import { registerAmazonTools } from "./amazon.js";
 import { registerMarketplaceTools } from "./marketplace.js";
 /** Current MCP server version — bumped on every deploy for traceability. */
-export const MCP_SERVER_VERSION = "1.26.44";
+export const MCP_SERVER_VERSION = "1.26.45";
 /** MCP Apps extension identifier */
 const UI_EXTENSION = "io.modelcontextprotocol/ui";
 /** MIME type for MCP Apps HTML resources */
@@ -556,6 +557,18 @@ export function createMcpServer(rawMakeClient, opts) {
             },
         },
     });
+    // Every tool result passes through the session's fetch ledger on its way
+    // out, so the show_* views can draw what nooticr returned rather than the
+    // model's copy of it (#107). Wrapped once here rather than in eighty
+    // handlers; registerSlowTool records the task path the same way.
+    const ledger = ledgerFor(server);
+    const registerTool = server.registerTool.bind(server);
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    server.registerTool = (name, config, handler) => registerTool(name, config, async (...a) => {
+        const result = (await handler(...a));
+        ledger.record(name, result?.structuredContent);
+        return result;
+    });
     // Register one UI app resource per tool/view. Claude/ChatGPT render a
     // separate sandboxed app per resourceUri and key app state by it, so a
     // distinct URI per tool avoids a shared app instance/session colliding
@@ -1685,7 +1698,9 @@ export function createMcpServer(rawMakeClient, opts) {
     // it (show_hooks, show_variants, show_repurposed_post).
     server.registerTool("show_trend", {
         title: "Show Trend",
-        description: "Draw the trend you read out of mention_trend. Free, and makes no requests — it renders what " +
+        description: "Figures are checked against what nooticr returned in this session: its own numbers are drawn, " +
+            "and a row it never returned is drawn marked as unchecked, so there is no need to re-type them exactly. " +
+            "Draw the trend you read out of mention_trend. Free, and makes no requests — it renders what " +
             "you pass it: the series as a chart, per-network lines where you supply them, and your own " +
             "read of what changed. Pass `tooShort` when the series has too few points to call a " +
             "direction, and `edgeIsRecordStart` when the left edge is where the record begins rather " +
@@ -1726,16 +1741,19 @@ export function createMcpServer(rawMakeClient, opts) {
         })
             .strict(),
     }, async (args) => {
+        const checked = ledger.checkRuns(args.points, args.term);
         return {
             content: [
                 {
                     type: "text",
                     text: `Showing a ${args.points.length}-point trend${args.term ? ` for "${args.term}"` : ""}.` +
-                        (args.verdict ? ` ${args.verdict}` : ""),
+                        (args.verdict ? ` ${args.verdict}` : "") +
+                        ` ${checked.verification.note}`,
                 },
             ],
             structuredContent: {
-                points: args.points,
+                points: checked.rows,
+                verification: checked.verification,
                 term: args.term ?? null,
                 metric: args.metric ?? "found",
                 verdict: args.verdict ?? null,
@@ -1747,7 +1765,9 @@ export function createMcpServer(rawMakeClient, opts) {
     });
     server.registerTool("show_standings", {
         title: "Show Standings",
-        description: "Draw the standings you read out of compare_creators or watchlist_standings. Free, and makes " +
+        description: "Figures are checked against what nooticr returned in this session: its own numbers are drawn, " +
+            "and a row it never returned is drawn marked as unchecked, so there is no need to re-type them exactly. " +
+            "Draw the standings you read out of compare_creators or watchlist_standings. Free, and makes " +
             "no requests — it only renders what you pass it: one row per creator with their window, their " +
             "own median, how often they beat it and how hard, and the post that did best. Pass `ranking` " +
             "to say which axis you ordered on, and `tooThin` for the creators whose window was too short " +
@@ -1783,16 +1803,19 @@ export function createMcpServer(rawMakeClient, opts) {
         })
             .strict(),
     }, async (args) => {
+        const checked = ledger.checkCreators(args.creators);
         return {
             content: [
                 {
                     type: "text",
                     text: `Showing standings for ${args.creators.length} creator${args.creators.length === 1 ? "" : "s"}.` +
-                        (args.verdict ? ` ${args.verdict}` : ""),
+                        (args.verdict ? ` ${args.verdict}` : "") +
+                        ` ${checked.verification.note}`,
                 },
             ],
             structuredContent: {
-                creators: args.creators,
+                creators: checked.rows,
+                verification: checked.verification,
                 metric: args.metric ?? "views",
                 ranking: args.ranking ?? null,
                 verdict: args.verdict ?? null,
@@ -1803,7 +1826,9 @@ export function createMcpServer(rawMakeClient, opts) {
     });
     server.registerTool("show_compared_posts", {
         title: "Show Comparison",
-        description: "Display a comparison you wrote after compare_posts fetched the first post and you fetched " +
+        description: "Figures are checked against what nooticr returned in this session: its own numbers are drawn, " +
+            "and a row it never returned is drawn marked as unchecked, so there is no need to re-type them exactly. " +
+            "Display a comparison you wrote after compare_posts fetched the first post and you fetched " +
             "the rest yourself (get_social_media, 1 credit each). Free, and makes no requests — it only " +
             "draws what you pass it: each post with a BEST badge on the winner, what differed, shared " +
             "strengths and the next experiment worth running. Call this after you have done the " +
@@ -1834,15 +1859,18 @@ export function createMcpServer(rawMakeClient, opts) {
         })
             .strict(),
     }, async (args) => {
+        const checked = ledger.checkPosts(args.posts);
         return {
             content: [
                 {
                     type: "text",
-                    text: `Showing a comparison of ${args.posts.length} posts.${args.winnerReason ? ` ${args.winnerReason}` : ""}`,
+                    text: `Showing a comparison of ${args.posts.length} posts.${args.winnerReason ? ` ${args.winnerReason}` : ""}` +
+                        ` ${checked.verification.note}`,
                 },
             ],
             structuredContent: {
-                posts: args.posts,
+                posts: checked.rows,
+                verification: checked.verification,
                 comparison: {
                     winner: args.winner,
                     winnerReason: args.winnerReason ?? null,
@@ -1856,7 +1884,9 @@ export function createMcpServer(rawMakeClient, opts) {
     });
     server.registerTool("show_post_analysis", {
         title: "Show Analysis",
-        description: "Display an analysis you wrote after analyze_post, analyze_post_fast or understand_social_post " +
+        description: "Figures are checked against what nooticr returned in this session: its own numbers are drawn, " +
+            "and a row it never returned is drawn marked as unchecked, so there is no need to re-type them exactly. " +
+            "Display an analysis you wrote after analyze_post, analyze_post_fast or understand_social_post " +
             "handed you the material. Free, and makes no requests — it only draws what you pass it: hook " +
             "strength, script structure, quotable lines, hashtags, target audience, viral triggers and " +
             "more, whichever of these you actually produced. Call this after you have done the analysing, " +
@@ -1883,11 +1913,15 @@ export function createMcpServer(rawMakeClient, opts) {
         })
             .strict(),
     }, async (args) => {
+        const checked = ledger.checkPosts([
+            { ...(args.post ?? { platform: platformFromUrl(args.url) }), externalUrl: args.post?.externalUrl ?? args.url },
+        ]);
         return {
-            content: [{ type: "text", text: `Showing your analysis of ${args.url}.` }],
+            content: [{ type: "text", text: `Showing your analysis of ${args.url}. ${checked.verification.note}` }],
             structuredContent: {
                 url: args.url,
-                post: args.post ?? { platform: platformFromUrl(args.url), externalUrl: args.url },
+                post: checked.rows[0],
+                verification: checked.verification,
                 analysis: args.analysis,
                 mcpCredits: { cost: 0 },
             },
@@ -1932,7 +1966,9 @@ export function createMcpServer(rawMakeClient, opts) {
     });
     server.registerTool("show_variants", {
         title: "Show Variants",
-        description: "Display the post variants you wrote after create_variants handed you the original post's " +
+        description: "Figures are checked against what nooticr returned in this session: its own numbers are drawn, " +
+            "and a row it never returned is drawn marked as unchecked, so there is no need to re-type them exactly. " +
+            "Display the post variants you wrote after create_variants handed you the original post's " +
             "material. Free, and makes no requests — it only draws what you pass it: each variant's hook, " +
             "the angle that changes, its shot beats and its call to action. Call this after you have " +
             "written the variants, not instead of writing them.",
@@ -1960,11 +1996,23 @@ export function createMcpServer(rawMakeClient, opts) {
         })
             .strict(),
     }, async (args) => {
+        const checked = ledger.checkPosts([
+            {
+                ...(args.post ?? { platform: platformFromUrl(args.sourceUrl) }),
+                externalUrl: args.post?.externalUrl ?? args.sourceUrl,
+            },
+        ]);
         return {
-            content: [{ type: "text", text: `Showing ${args.variants.length} variants of ${args.sourceUrl}.` }],
+            content: [
+                {
+                    type: "text",
+                    text: `Showing ${args.variants.length} variants of ${args.sourceUrl}. ${checked.verification.note}`,
+                },
+            ],
             structuredContent: {
                 sourceUrl: args.sourceUrl,
-                post: args.post ?? { platform: platformFromUrl(args.sourceUrl), externalUrl: args.sourceUrl },
+                post: checked.rows[0],
+                verification: checked.verification,
                 variants: args.variants,
                 mcpCredits: { cost: 0 },
             },

package/dist/shared/ui-template.js

@@ -3464,7 +3464,24 @@ export const NOOTICR_UI_TEMPLATE = `<!DOCTYPE html>
   // after it — one wrapper instead of a call at each of the many early
   // returns below.
   function render(result){
-    try{renderView(result);}finally{initPlayers();setTimeout(reportSize,80);}
+    try{renderView(result);verificationBanner(result);}finally{initPlayers();setTimeout(reportSize,80);}
+  }
+
+  // #107: a show_* view whose rows could not all be matched to what nooticr
+  // returned this session says so above the card. The marketplace card draws
+  // its own. Only the unverified case is drawn: a banner on every honest card
+  // would be noise that trains a reader to skip it.
+  function verificationBanner(result){
+    var d=extractResult(result);
+    if(!d||typeof d!=="object"||d.marketplace)return;
+    var v=d.verification;
+    if(!v||v.status!=="unverified")return;
+    var app=document.getElementById("app");if(!app)return;
+    var b=document.createElement("div");
+    b.setAttribute("data-verification","unverified");
+    b.style.cssText="font-size:12px;padding:8px 10px;margin:0 0 10px;border-radius:8px;border:1px solid var(--border);background:rgba(180,35,24,.06)";
+    b.innerHTML="<b>Not checked against nooticr</b> · "+esc(v.note||"");
+    app.insertBefore(b,app.firstChild);
   }
 
   // ─── Own account ───

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nooticr/mcp",
   "mcpName": "com.nooticr/mcp",
-  "version": "1.26.44",
+  "version": "1.26.45",
   "description": "MCP server for nooticr - fetch, discover and understand TikTok/Instagram/YouTube/X/Reddit/LinkedIn/Weibo posts with AI (media metadata, niche discovery, brand monitoring, hook & viral analysis)",
   "homepage": "https://mcp.nooticr.com",
   "repository": {