@noresponse/mcp 0.5.6 → 0.5.7

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.5.7
+
+* `SDK.assessments.create()`:  `response` **Changed**
+* `SDK.assessments.get()`:  `response` **Changed**
+* `SDK.assessments.query()`:  `response.items[].risk` **Changed**
+* `SDK.accounts.listChanged()`:  `response.items[].risk.reasons[]` **Changed**
+* `SDK.accounts.get()`:  `response.risk.reasons[]` **Changed**
+* `SDK.accounts.listAssessments()`:  `response.items[].risk` **Changed**
+
 ## 0.5.6
 
 * `SDK.assessments.create()`:  `response.account.risk.reasons[].code` **Changed** (Breaking ⚠️)

package/bin/mcp-server.js

@@ -48104,9 +48104,9 @@ var init_config = __esm(() => {
   SDK_METADATA = {
     language: "typescript",
     openapiDocVersion: "1",
-    sdkVersion: "0.5.6",
+    sdkVersion: "0.5.7",
     genVersion: "internal",
-    userAgent: "noresponse-sdk/mcp-typescript 0.5.6 internal 1 @noresponse/mcp"
+    userAgent: "noresponse-sdk/mcp-typescript 0.5.7 internal 1 @noresponse/mcp"
   };
 });
 
@@ -50272,6 +50272,29 @@ var init_accountdecisionsbyflow = __esm(() => {
   }).describe("The decision for each flow: the account's score under that flow's thresholds. A flow the workspace has not set uses its account_creation thresholds, so the flows differ only where it set them. The flow of the current assessment is held while that flow's admission is held and the assessment's investigation has not completed.");
 });
 
+// src/models/direction.ts
+var Direction$zodSchema;
+var init_direction = __esm(() => {
+  init_zod();
+  Direction$zodSchema = _enum([
+    "raises",
+    "lowers",
+    "neutral"
+  ]);
+});
+
+// src/models/impact.ts
+var Impact$zodSchema;
+var init_impact = __esm(() => {
+  init_zod();
+  Impact$zodSchema = _enum([
+    "none",
+    "low",
+    "medium",
+    "high"
+  ]);
+});
+
 // src/models/reasoncode.ts
 var ReasonCode$zodSchema;
 var init_reasoncode = __esm(() => {
@@ -50346,13 +50369,17 @@ var init_reasonidentifier = __esm(() => {
 var AccountRiskReason$zodSchema;
 var init_accountriskreason = __esm(() => {
   init_zod();
+  init_direction();
+  init_impact();
   init_reasoncode();
   init_reasonidentifier();
   AccountRiskReason$zodSchema = object({
     code: ReasonCode$zodSchema.describe("A stable reason code. New codes may appear; ignore any you do not know."),
+    direction: Direction$zodSchema,
     identifier: ReasonIdentifier$zodSchema.optional().describe("The submitted identifier or client context field a reason concerns; absent when it concerns the whole assessment. Client context is a claimed hint, not a device fingerprint."),
-    weight: int()
-  });
+    impact: Impact$zodSchema,
+    weight: literal(0).default(0).optional().describe("Deprecated and always 0: the policy's weights are not published. It is sent so that SDK versions that require it keep reading reasons. Read direction and impact.")
+  }).describe("One reason that fired. direction is whether it raises or lowers the score, or is neutral (informational, it moves nothing). impact is a coarse band of how much it moves the score: none for a neutral reason, otherwise low, medium or high.");
 });
 
 // src/models/accountrisk.ts
@@ -50363,7 +50390,7 @@ var init_accountrisk = __esm(() => {
   init_accountriskreason();
   AccountRisk$zodSchema = object({
     decision: AccountDecision$zodSchema.describe("block when the score reached your block threshold (risk.block of the assessment), otherwise the assessment's recommendation. held only for a flow whose admission is held (settings flows.<flow>.admission), when the account's current assessment was made for that flow and its investigation has not completed (status partial): the final decision arrives as account.risk_changed when the investigation completes, decided by its score, or when the hold's deadline (hold_seconds after the assessment was created) passes first, as the flow's on_expiry action or the decision the evidence so far gives, whichever is stricter. Your application applies it."),
-    reasons: array(AccountRiskReason$zodSchema).describe("Every reason that fired, highest weight first. The weights sum to score before clamping."),
+    reasons: array(AccountRiskReason$zodSchema).describe("Every reason that fired: risk-raising reasons first, then neutral, then risk-lowering, each strongest impact band first and then by code. The policy's numeric weights are kept private, so a reason carries only its direction and impact band."),
     score: int().describe("0 (safe) to 100 (risky), as risk.score of the assessment.")
   });
 });
@@ -50607,6 +50634,58 @@ var init_riskdetailsbreachname = __esm(() => {
   });
 });
 
+// src/models/footprintfamily.ts
+var FootprintFamily$zodSchema;
+var init_footprintfamily = __esm(() => {
+  init_zod();
+  FootprintFamily$zodSchema = _enum([
+    "account_presence",
+    "auth_provider",
+    "breach",
+    "breach_abuse",
+    "code_hosting"
+  ]).describe("The source-neutral kind of evidence: account_presence (an account found on a site), auth_provider (the account at your auth provider), breach (breach and credential tables), breach_abuse (abuse and fraud communities' tables) and code_hosting (a code hosting profile).");
+});
+
+// src/models/identifier.ts
+var Identifier$zodSchema;
+var init_identifier = __esm(() => {
+  init_zod();
+  Identifier$zodSchema = _enum([
+    "email",
+    "username"
+  ]);
+});
+
+// src/models/riskdetailseventkind.ts
+var RiskDetailsEventKind$zodSchema;
+var init_riskdetailseventkind = __esm(() => {
+  init_zod();
+  RiskDetailsEventKind$zodSchema = _enum([
+    "created",
+    "last_active",
+    "breached"
+  ]);
+});
+
+// src/models/riskdetailsevent.ts
+var RiskDetailsEvent$zodSchema;
+var init_riskdetailsevent = __esm(() => {
+  init_zod();
+  init_footprintfamily();
+  init_identifier();
+  init_riskdetailseventkind();
+  RiskDetailsEvent$zodSchema = object({
+    category: string2(),
+    family: FootprintFamily$zodSchema.describe("The source-neutral kind of evidence: account_presence (an account found on a site), auth_provider (the account at your auth provider), breach (breach and credential tables), breach_abuse (abuse and fraud communities' tables) and code_hosting (a code hosting profile)."),
+    identifier: Identifier$zodSchema,
+    kind: RiskDetailsEventKind$zodSchema,
+    month: int().optional(),
+    site: string2(),
+    year: int()
+  });
+});
+
 // src/models/riskdetailsphonename.ts
 var RiskDetailsPhoneName$zodSchema;
 var init_riskdetailsphonename = __esm(() => {
@@ -50623,10 +50702,12 @@ var init_riskdetails = __esm(() => {
   init_zod();
   init_breach();
   init_riskdetailsbreachname();
+  init_riskdetailsevent();
   init_riskdetailsphonename();
   RiskDetails$zodSchema = object({
     breach_names: array(RiskDetailsBreachName$zodSchema).optional().describe("Names found next to the identifiers in breach records, merged, with the number of distinct tables each was seen in."),
     breaches: array(Breach$zodSchema).optional().describe("The matching breach tables, newest first, at most 50."),
+    events: array(RiskDetailsEvent$zodSchema).optional().describe("The identity's dated footprint events, newest first, at most 100: the year and month, what happened (created, last_active, breached), the site, its category, the kind of evidence and the identifier it belongs to. No breach value: dates are coarsened to the month."),
     phone_names: array(RiskDetailsPhoneName$zodSchema).optional()
   }).describe("Detailed view only (response_mode=detailed, which needs the detailed scope); a standard answer leaves it out. Merged observations without provider, source, origin, raw breach record, value or score.");
 });
@@ -50635,13 +50716,17 @@ var init_riskdetails = __esm(() => {
 var RiskReason$zodSchema;
 var init_riskreason = __esm(() => {
   init_zod();
+  init_direction();
+  init_impact();
   init_reasoncode();
   init_reasonidentifier();
   RiskReason$zodSchema = object({
     code: ReasonCode$zodSchema.describe("A stable reason code. New codes may appear; ignore any you do not know."),
+    direction: Direction$zodSchema,
     identifier: ReasonIdentifier$zodSchema.optional().describe("The submitted identifier or client context field a reason concerns; absent when it concerns the whole assessment. Client context is a claimed hint, not a device fingerprint."),
-    weight: int()
-  });
+    impact: Impact$zodSchema,
+    weight: literal(0).default(0).optional().describe("Deprecated and always 0: the policy's weights are not published. It is sent so that SDK versions that require it keep reading reasons. Read direction and impact.")
+  }).describe("One reason that fired. direction is whether it raises or lowers the score, or is neutral (informational, it moves nothing). impact is a coarse band of how much it moves the score: none for a neutral reason, otherwise low, medium or high.");
 });
 
 // src/models/consistencyvalue.ts
@@ -50681,6 +50766,78 @@ var init_consistency = __esm(() => {
   }).describe("Cross-identifier agreement, computed from facts only. Every member is optional; absent makes no claim.");
 });
 
+// src/models/agreement.ts
+var Agreement$zodSchema;
+var init_agreement = __esm(() => {
+  init_zod();
+  Agreement$zodSchema = _enum([
+    "match",
+    "partial",
+    "mismatch"
+  ]);
+});
+
+// src/models/attributeagreement.ts
+var AttributeAgreement$zodSchema;
+var init_attributeagreement = __esm(() => {
+  init_zod();
+  init_agreement();
+  AttributeAgreement$zodSchema = object({
+    agreement: Agreement$zodSchema,
+    support: int(),
+    values: int()
+  }).describe("How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served.");
+});
+
+// src/models/footprintcoherence.ts
+var FootprintCoherence$zodSchema;
+var init_footprintcoherence = __esm(() => {
+  init_zod();
+  init_attributeagreement();
+  FootprintCoherence$zodSchema = object({
+    birth_date: AttributeAgreement$zodSchema.optional().describe("How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served."),
+    city: AttributeAgreement$zodSchema.optional().describe("How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served."),
+    company: AttributeAgreement$zodSchema.optional().describe("How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served."),
+    country: AttributeAgreement$zodSchema.optional().describe("How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served."),
+    gender: AttributeAgreement$zodSchema.optional().describe("How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served."),
+    name: AttributeAgreement$zodSchema.optional().describe("How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served."),
+    nationality: AttributeAgreement$zodSchema.optional().describe("How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served."),
+    social: AttributeAgreement$zodSchema.optional().describe("How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served."),
+    website: AttributeAgreement$zodSchema.optional().describe("How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served."),
+    zip: AttributeAgreement$zodSchema.optional().describe("How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served.")
+  });
+});
+
+// src/models/footprinttimeline.ts
+var FootprintTimeline$zodSchema;
+var init_footprinttimeline = __esm(() => {
+  init_zod();
+  init_footprintfamily();
+  FootprintTimeline$zodSchema = object({
+    families: array(FootprintFamily$zodSchema),
+    first_seen_year: int(),
+    last_active_year: int().optional(),
+    last_seen_year: int(),
+    sites: int(),
+    span_years: int()
+  }).describe("One identifier's dated footprint across every source: the first and last year any event was seen, the years between them, the latest year a source dated activity (omitted when none did), how many distinct sites and which kinds of evidence saw it.");
+});
+
+// src/models/footprint.ts
+var Footprint$zodSchema;
+var init_footprint = __esm(() => {
+  init_zod();
+  init_footprintcoherence();
+  init_footprintfamily();
+  init_footprinttimeline();
+  Footprint$zodSchema = object({
+    coherence: FootprintCoherence$zodSchema.optional(),
+    email: FootprintTimeline$zodSchema.optional().describe("One identifier's dated footprint across every source: the first and last year any event was seen, the years between them, the latest year a source dated activity (omitted when none did), how many distinct sites and which kinds of evidence saw it."),
+    families: array(FootprintFamily$zodSchema),
+    username: FootprintTimeline$zodSchema.optional().describe("One identifier's dated footprint across every source: the first and last year any event was seen, the years between them, the latest year a source dated activity (omitted when none did), how many distinct sites and which kinds of evidence saw it.")
+  }).describe("How long and how widely the signup's email and username have existed, and how far independent sources agree on the person behind them, in years and counts only. families are the kinds of evidence that found either identifier. Omitted when nothing found them: a footprint lookup that failed makes no claim, and absence is no_digital_footprint's to state.");
+});
+
 // src/models/ipsummarytype.ts
 var IpSummaryType$zodSchema;
 var init_ipsummarytype = __esm(() => {
@@ -50779,6 +50936,7 @@ var RiskSummary$zodSchema;
 var init_risksummary = __esm(() => {
   init_zod();
   init_consistency();
+  init_footprint();
   init_ipsummary();
   init_risksummaryemail();
   init_risksummaryphone();
@@ -50786,6 +50944,7 @@ var init_risksummary = __esm(() => {
   RiskSummary$zodSchema = object({
     consistency: Consistency$zodSchema.optional().describe("Cross-identifier agreement, computed from facts only. Every member is optional; absent makes no claim."),
     email: RiskSummaryEmail$zodSchema.optional(),
+    footprint: Footprint$zodSchema.optional().describe("How long and how widely the signup's email and username have existed, and how far independent sources agree on the person behind them, in years and counts only. families are the kinds of evidence that found either identifier. Omitted when nothing found them: a footprint lookup that failed makes no claim, and absence is no_digital_footprint's to state."),
     ip: IpSummary$zodSchema.optional().describe("Facts about the submitted IP from the offline database and this workspace's own recent assessments. Every member is optional; absent makes no claim."),
     phone: RiskSummaryPhone$zodSchema.optional(),
     username: RiskSummaryUsername$zodSchema.optional()
@@ -50811,12 +50970,12 @@ var init_risk = __esm(() => {
     coverage: RiskCoverage$zodSchema.describe("Sources counted by state, not named."),
     details: RiskDetails$zodSchema.optional().describe("Detailed view only (response_mode=detailed, which needs the detailed scope); a standard answer leaves it out. Merged observations without provider, source, origin, raw breach record, value or score."),
     policy_basis: literal("heuristic_unvalidated").default("heuristic_unvalidated").optional().describe("Labels the v0 policy as hand-authored and not statistically validated."),
-    policy_version: string2().describe("Version of the hand-authored heuristic weights that produced the recommendation, for example 'risk-2026-10.7'. A workspace threshold override adds a +t<N> suffix, e.g. 'risk-2026-10.7+t3'."),
-    reasons: array(RiskReason$zodSchema).describe("Every reason that fired, highest weight first. The weights sum to score before clamping."),
+    policy_version: string2().describe("Version of the hand-authored heuristic policy that produced the recommendation, for example 'risk-2026-10.7'. A workspace threshold override adds a +t<N> suffix, e.g. 'risk-2026-10.7+t3'."),
+    reasons: array(RiskReason$zodSchema).describe("Every reason that fired: risk-raising reasons first, then neutral, then risk-lowering, each strongest impact band first and then by code. The policy's numeric weights are kept private, so a reason carries only its direction and impact band."),
     recommendation: Recommendation$zodSchema.describe("The recommended action: allow, step_up or review. Your application applies it."),
     score: int(),
     summary: RiskSummary$zodSchema.optional().describe("A few typed facts per identifier. Every fact is optional: absent means the evidence did not answer and makes no claim, while false or 0 is a definite answer. Lanes that do not exist yet leave their members absent.")
-  }).describe("The one risk decision for this event. score is 0 (safe) to 100 (risky): the sum of the weights of the reasons that fired, clamped to 0 to 100, from hand-set versioned weights. Every answer with a recommendation carries it, and the top-level recommendation equals risk.recommendation. It names no source or provider.");
+  }).describe("The one risk decision for this event. score is 0 (safe) to 100 (risky), set by the reasons that fired under a hand-set, versioned heuristic policy. Each reason carries its direction and impact band; the policy's weights are not published. Every answer with a recommendation carries it, and the top-level recommendation equals risk.recommendation. It names no source or provider.");
 });
 
 // src/models/failurereason.ts
@@ -51077,10 +51236,10 @@ var init_assessmentdetail = __esm(() => {
     expires_at: string2().describe("After this instant the assessment is no longer served: GET /v1/assessments/{assessment_id} answers 404 and it leaves the account history. It is created_at plus your retention period at creation (default and maximum 365 days) and is fixed per record: a later revision keeps it, and a new assessment for the same account starts its own clock. If you later shorten retention, the effective expiry becomes created_at plus the shorter of the two periods."),
     incomplete_sources: array(IncompleteSource$zodSchema).describe("The lanes that did not settle, each listed once with a reason; lanes, not sources. In a detailed view a lane is listed exactly when one of its signals did not settle; a standard view carries no signals to match."),
     policy_basis: literal("heuristic_unvalidated").default("heuristic_unvalidated").optional().describe("Labels the v0 policy as hand-authored and not statistically validated."),
-    policy_version: string2().describe("Version of the hand-authored heuristic weights that produced the recommendation, for example 'risk-2026-10.7'. A workspace threshold override adds a +t<N> suffix, e.g. 'risk-2026-10.7+t3'."),
+    policy_version: string2().describe("Version of the hand-authored heuristic policy that produced the recommendation, for example 'risk-2026-10.7'. A workspace threshold override adds a +t<N> suffix, e.g. 'risk-2026-10.7+t3'."),
     recommendation: Recommendation$zodSchema.optional().describe("The recommended action: allow, step_up or review. Your application applies it."),
     request_id: string2().optional().describe("An optional provider correlation id, echoed back. It is not an idempotency key. Refuses an exact-shape JWT or a bare 40, 64 or 128 character hex digest; a UUID is accepted."),
-    risk: Risk$zodSchema.optional().describe("The one risk decision for this event. score is 0 (safe) to 100 (risky): the sum of the weights of the reasons that fired, clamped to 0 to 100, from hand-set versioned weights. Every answer with a recommendation carries it, and the top-level recommendation equals risk.recommendation. It names no source or provider."),
+    risk: Risk$zodSchema.optional().describe("The one risk decision for this event. score is 0 (safe) to 100 (risky), set by the reasons that fired under a hand-set, versioned heuristic policy. Each reason carries its direction and impact band; the policy's weights are not published. Every answer with a recommendation carries it, and the top-level recommendation equals risk.recommendation. It names no source or provider."),
     schema_version: literal("1").default("1").optional().describe("Version of the body shape."),
     signals: array(Signal$zodSchema).optional().describe("Detailed view only (response_mode=detailed, which needs the detailed scope): a standard answer omits signals[], and a detailed one always carries it, possibly empty. The body does not name its mode, so that rule is the serving gate's; the schema states the half it can: an answer with risk.details is a detailed view and carries signals[]. At most one signal per (type, source_id, identifier)."),
     status: Status$zodSchema.describe("complete: final; nothing is still running. A lane that failed or missed its 10 s deadline stays listed in incomplete_sources, and confidence is lower. partial: a recommendation exists and at least one lane is still running or did not settle (see incomplete_sources). pending: nothing usable before the deadline; no recommendation yet, poll or wait for the webhook."),
@@ -56226,7 +56385,7 @@ endpoint.verification sends a signed challenge now and answers whether the endpo
 function createMCPServer(deps) {
   const server = new McpServer({
     name: "NoResponse",
-    version: "0.5.6"
+    version: "0.5.7"
   });
   const getClient = deps.getSDK || (() => new NoResponseCore({
     security: deps.security,
@@ -64963,7 +65122,7 @@ var routes = buildRouteMap({
 var app = buildApplication(routes, {
   name: "mcp",
   versionInfo: {
-    currentVersion: "0.5.6"
+    currentVersion: "0.5.7"
   }
 });
 run(app, process3.argv.slice(2), buildContext(process3));
@@ -64971,5 +65130,5 @@ export {
   app
 };
 
-//# debugId=6A4CD5F41543A1EB64756E2164756E21
+//# debugId=F1F49377161C671264756E2164756E21
 //# sourceMappingURL=mcp-server.js.map