@oss-scout/mcp 0.10.1 → 0.10.2

package/dist/index.d.ts

@@ -12,7 +12,7 @@ export { registerResources } from "./resources.js";
 /** Server identity, kept in one place for the bin and any embedding host. */
 export declare const SERVER_INFO: {
     readonly name: "oss-scout-mcp";
-    readonly version: "0.10.1";
+    readonly version: "0.10.2";
 };
 /**
  * Build a fully-wired MCP server (tools + resources) around a scout.

package/dist/index.js

@@ -15,7 +15,7 @@ export { registerResources } from "./resources.js";
 /** Server identity, kept in one place for the bin and any embedding host. */
 export const SERVER_INFO = {
     name: "oss-scout-mcp",
-    version: "0.10.1", // x-release-please-version
+    version: "0.10.2", // x-release-please-version
 };
 /**
  * Build a fully-wired MCP server (tools + resources) around a scout.

package/dist/mcp-server.bundle.cjs

@@ -37684,7 +37684,11 @@ async function triageWithSLM(input, options) {
         format: SLM_TRIAGE_SCHEMA,
         options: { temperature: 0.1 }
       }),
-      signal: AbortSignal.timeout(timeoutMs)
+      signal: AbortSignal.timeout(timeoutMs),
+      // No redirect following: an allowed private host could otherwise
+      // 307/308-redirect the issue-text POST body to a public origin (#310).
+      // Ollama never redirects, so this costs nothing.
+      redirect: "error"
     });
   } catch {
     return null;
@@ -38079,6 +38083,9 @@ var IssueVetter = class {
     let rateLimitFailures = 0;
     let attemptedCount = 0;
     let firstAuthError = null;
+    let firstForbiddenError = null;
+    let forbiddenCount = 0;
+    const forbiddenRepos = /* @__PURE__ */ new Set();
     const uniqueUrls = [...new Set(urls)];
     const issueRefs = uniqueUrls.flatMap((url2) => {
       const p = parseGitHubUrl(url2);
@@ -38097,6 +38104,12 @@ var IssueVetter = class {
         break;
       if (firstAuthError)
         break;
+      const parsedUrl = parseGitHubUrl(url2);
+      const repoKey = parsedUrl ? `${parsedUrl.owner}/${parsedUrl.repo}` : null;
+      if (repoKey && forbiddenRepos.has(repoKey)) {
+        debug(MODULE10, `Skipping ${url2}: repo already returned 403`);
+        continue;
+      }
       attemptedCount++;
       const core = prefetchFor(url2);
       const task = this.vetIssue(url2, core ? { prefetched: core } : void 0).then((candidate) => {
@@ -38107,10 +38120,19 @@ var IssueVetter = class {
           candidates.push(candidate);
         }
       }).catch((error48) => {
-        if (isAuthError(error48)) {
+        if (getHttpStatusCode(error48) === 401) {
           firstAuthError ??= error48;
           return;
         }
+        if (isAuthError(error48)) {
+          firstForbiddenError ??= error48;
+          forbiddenCount++;
+          failedVettingCount++;
+          if (repoKey)
+            forbiddenRepos.add(repoKey);
+          warn(MODULE10, `Access forbidden for ${url2} (SAML/token scope?) \u2014 skipping this repo:`, errorMessage(error48));
+          return;
+        }
         failedVettingCount++;
         if (isRateLimitError(error48)) {
           rateLimitFailures++;
@@ -38129,6 +38151,9 @@ var IssueVetter = class {
       }
       throw firstAuthError;
     }
+    if (firstForbiddenError && attemptedCount > 0 && forbiddenCount === attemptedCount) {
+      throw firstForbiddenError;
+    }
     const allFailed = failedVettingCount === attemptedCount && attemptedCount > 0;
     if (allFailed) {
       warn(MODULE10, `All ${attemptedCount} issue(s) failed vetting. This may indicate a systemic issue (rate limit, auth, network).`);
@@ -38806,6 +38831,7 @@ var IssueDiscovery = class {
     resetGraphQLSearchQueryCount();
     const tracker = this.budgetTracker;
     let searchBudget = CRITICAL_BUDGET_THRESHOLD - 1;
+    let preflightFailed = false;
     try {
       const rateLimit = await checkRateLimit(this.githubToken);
       searchBudget = rateLimit.remaining;
@@ -38823,6 +38849,7 @@ var IssueDiscovery = class {
     } catch (error48) {
       if (getHttpStatusCode(error48) === 401)
         throw error48;
+      preflightFailed = true;
       tracker.init(CRITICAL_BUDGET_THRESHOLD, new Date(Date.now() + 6e4).toISOString());
       warn(MODULE12, "Could not check rate limit \u2014 using conservative budget, skipping the starred phase:", errorMessage(error48));
     }
@@ -38926,7 +38953,7 @@ var IssueDiscovery = class {
       strategiesUsed.push("maintained");
     }
     const phasesSkippedForBudget = searchBudget < CRITICAL_BUDGET_THRESHOLD;
-    const budgetNote = phasesSkippedForBudget ? ` The starred-repo phase was skipped due to critically low API quota (${searchBudget} remaining); broad and maintained phases still ran on GraphQL.` : "";
+    const budgetNote = phasesSkippedForBudget ? preflightFailed ? " The starred-repo phase was skipped as a precaution because the rate-limit check failed (quota unknown); broad and maintained phases still ran on GraphQL." : ` The starred-repo phase was skipped due to critically low API quota (${searchBudget} remaining); broad and maintained phases still ran on GraphQL.` : "";
     if (allCandidates.length === 0) {
       const errorDetails = [
         phaseErrors["0"] ? `Phase 0 (merged-PR repos): ${phaseErrors["0"]}` : null,
@@ -39034,10 +39061,17 @@ function parseRoadmapIssueRefs(content, owner, repo) {
       refs.add(n);
   }
   const fullRefStripPattern = /\b[\w.-]+\/[\w.-]+#\d+\b/gi;
+  let inFence = false;
   for (const line of content.split("\n")) {
+    if (/^\s*(```|~~~)/.test(line)) {
+      inFence = !inFence;
+      continue;
+    }
+    if (inFence)
+      continue;
     if (/^\s*#+\s/.test(line))
       continue;
-    const stripped = line.replace(fullRefStripPattern, "");
+    const stripped = line.replace(fullRefStripPattern, "").replace(/`[^`]*`/g, "");
     for (const m of stripped.matchAll(/(?:^|[^&\w])#(\d+)\b/g)) {
       const n = Number.parseInt(m[1], 10);
       if (n > 0)
@@ -39114,7 +39148,8 @@ function classifyHorizon(input) {
 function splitByHorizon(candidates, count, ratio = DEFAULT_SPLIT_RATIO) {
   const allQuick = candidates.filter((c) => c.horizon === "quick-win").sort((a, b) => b.viabilityScore - a.viabilityScore);
   const allBigger = candidates.filter((c) => c.horizon === "bigger-bet").sort((a, b) => b.viabilityScore - a.viabilityScore);
-  const targetQuick = Math.round(count * ratio);
+  const clampedRatio = Math.max(0, Math.min(1, ratio));
+  const targetQuick = Math.round(count * clampedRatio);
   const targetBigger = count - targetQuick;
   const quickTaken = Math.min(allQuick.length, targetQuick);
   const biggerTaken = Math.min(allBigger.length, targetBigger);
@@ -39168,6 +39203,17 @@ function detectWontfixNoContributor(input) {
 }
 var NO_ANCHORS_MESSAGE = "No anchor repos yet (need 3+ merged PRs in a repo). Try `scout search` to build relationships first.";
 var NO_RESULTS_MESSAGE = "No open feature opportunities in your anchor repos right now. Check back next week, or try `scout search` for fix-mode work.";
+function buildRepoExclusionFilter(opts) {
+  const excluded = new Set([...opts.excludeRepos ?? [], ...opts.aiPolicyBlocklist ?? []].map((r) => r.toLowerCase()));
+  const excludedOrgs = new Set((opts.excludeOrgs ?? []).map((o) => o.toLowerCase()));
+  return (repoFullName) => {
+    const lower = repoFullName.toLowerCase();
+    if (excluded.has(lower))
+      return false;
+    const org = lower.split("/")[0];
+    return !(org && excludedOrgs.has(org));
+  };
+}
 function extractLabels(item) {
   if (!Array.isArray(item.labels))
     return [];
@@ -39213,7 +39259,8 @@ async function vetAndClassify(item, vetter, roadmapRefs) {
   return { ...candidate, horizon };
 }
 async function discoverFeatures(opts) {
-  const anchorRepos = resolveAnchorRepos(opts.repoScores, opts.anchorThreshold);
+  const includeRepo = buildRepoExclusionFilter(opts);
+  const anchorRepos = resolveAnchorRepos(opts.repoScores, opts.anchorThreshold).filter(includeRepo);
   if (anchorRepos.length === 0) {
     return {
       quickWins: [],
@@ -39320,7 +39367,11 @@ async function discoverFeaturesBroad(opts) {
         merged.push(raw);
       }
     }
-    items = merged.filter((it) => !it.pull_request && !it.assignee && isFeatureIssue(it)).slice(0, maxToVet);
+    const includeRepo = buildRepoExclusionFilter(opts);
+    items = merged.filter((it) => !it.pull_request && !it.assignee && isFeatureIssue(it)).filter((it) => {
+      const repo = extractRepoFromUrl(it.html_url);
+      return repo === null || includeRepo(repo);
+    }).slice(0, maxToVet);
   } catch (err) {
     rethrowIfFatal(err);
     warn(MODULE13, `broad feature search failed: ${errorMessage(err)}`);
@@ -39654,6 +39705,13 @@ function mergeStates(local, remote) {
   const localPrefsWin = localPrefsTs !== void 0 && (remotePrefsTs === void 0 || localPrefsTs > remotePrefsTs);
   const preferences = localPrefsWin ? local.preferences : remote.preferences;
   const preferencesUpdatedAt = pickFresherTimestamp(localPrefsTs, remotePrefsTs);
+  const mergedPRsFinal = unionByUrl(local.mergedPRs, remote.mergedPRs);
+  const closedPRsFinal = unionByUrl(local.closedPRs, remote.closedPRs);
+  const resolvedUrls = /* @__PURE__ */ new Set([
+    ...mergedPRsFinal.map((p) => p.url),
+    ...closedPRsFinal.map((p) => p.url)
+  ]);
+  const openPRsFinal = unionByUrl(local.openPRs ?? [], remote.openPRs ?? []).filter((p) => !resolvedUrls.has(p.url));
   return {
     ...local,
     ...remote,
@@ -39664,9 +39722,9 @@ function mergeStates(local, remote) {
     repoScores: mergeRepoScores(local.repoScores, remote.repoScores),
     starredRepos: mergeStarredRepos(local, remote),
     starredReposLastFetched: pickFresherTimestamp(local.starredReposLastFetched, remote.starredReposLastFetched),
-    mergedPRs: unionByUrl(local.mergedPRs, remote.mergedPRs),
-    closedPRs: unionByUrl(local.closedPRs, remote.closedPRs),
-    openPRs: unionByUrl(local.openPRs ?? [], remote.openPRs ?? []),
+    mergedPRs: mergedPRsFinal,
+    closedPRs: closedPRsFinal,
+    openPRs: openPRsFinal,
     savedResults: savedResultsFinal,
     skippedIssues,
     lastSearchAt: pickFresherTimestamp(local.lastSearchAt, remote.lastSearchAt),
@@ -40038,12 +40096,16 @@ var OssScout = class {
       languages: this.state.preferences.languages,
       excludeRepos: this.state.preferences.excludeRepos,
       excludeOrgs: this.state.preferences.excludeOrgs,
+      aiPolicyBlocklist: this.state.preferences.aiPolicyBlocklist,
       splitRatio: options?.splitRatio ?? this.state.preferences.featuresSplitRatio
     }) : await discoverFeatures({
       octokit,
       vetter,
       repoScores: this.state.repoScores ?? {},
       count,
+      excludeRepos: this.state.preferences.excludeRepos,
+      excludeOrgs: this.state.preferences.excludeOrgs,
+      aiPolicyBlocklist: this.state.preferences.aiPolicyBlocklist,
       anchorThreshold: options?.anchorThreshold ?? this.state.preferences.featuresAnchorThreshold,
       splitRatio: options?.splitRatio ?? this.state.preferences.featuresSplitRatio
     });
@@ -40746,7 +40808,7 @@ function registerTools(server, scout) {
     "search",
     "Search for open source issues matching your preferences",
     {
-      maxResults: external_exports3.number().int().min(1).max(50).optional().describe("Maximum number of results to return (1-50, default 10)"),
+      maxResults: external_exports3.number().int().min(1).max(100).optional().describe("Maximum number of results to return (1-100, default 10)"),
       strategies: external_exports3.string().optional().describe(
         "Comma-separated search strategies: merged, starred, broad, maintained, all"
       ),
@@ -41095,7 +41157,7 @@ function registerResources(server, scout) {
 // src/index.ts
 var SERVER_INFO = {
   name: "oss-scout-mcp",
-  version: "0.10.1"
+  version: "0.10.2"
   // x-release-please-version
 };
 function createServer(scout) {

package/dist/tools.js

@@ -35,9 +35,12 @@ export function registerTools(server, scout) {
             .number()
             .int()
             .min(1)
-            .max(50)
+            // 100, not 50: the CLI's search count is unbounded, so a tight MCP
+            // cap made the two surfaces disagree for 1.5.0 clients while still
+            // needing SOME ceiling against absurd values (#317).
+            .max(100)
             .optional()
-            .describe("Maximum number of results to return (1-50, default 10)"),
+            .describe("Maximum number of results to return (1-100, default 10)"),
         strategies: z
             .string()
             .optional()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oss-scout/mcp",
-  "version": "0.10.1",
+  "version": "0.10.2",
   "description": "MCP server for oss-scout — exposes issue discovery and vetting as MCP tools",
   "type": "module",
   "bin": {
@@ -18,7 +18,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.27.1",
     "zod": "^4.3.6",
-    "@oss-scout/core": "^1.5.1"
+    "@oss-scout/core": "^1.5.2"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",