@oss-scout/mcp 0.10.1 → 0.11.0

package/dist/index.d.ts

@@ -12,7 +12,7 @@ export { registerResources } from "./resources.js";
 /** Server identity, kept in one place for the bin and any embedding host. */
 export declare const SERVER_INFO: {
     readonly name: "oss-scout-mcp";
-    readonly version: "0.10.1";
+    readonly version: "0.11.0";
 };
 /**
  * Build a fully-wired MCP server (tools + resources) around a scout.

package/dist/index.js

@@ -15,7 +15,7 @@ export { registerResources } from "./resources.js";
 /** Server identity, kept in one place for the bin and any embedding host. */
 export const SERVER_INFO = {
     name: "oss-scout-mcp",
-    version: "0.10.1", // x-release-please-version
+    version: "0.11.0", // x-release-please-version
 };
 /**
  * Build a fully-wired MCP server (tools + resources) around a scout.

package/dist/mcp-server.bundle.cjs

@@ -36075,6 +36075,7 @@ var IssueScopeSchema = external_exports3.enum([
 ]);
 var SearchStrategySchema = external_exports3.enum([
   "merged",
+  "orgs",
   "starred",
   "broad",
   "maintained",
@@ -36082,6 +36083,7 @@ var SearchStrategySchema = external_exports3.enum([
 ]);
 var CONCRETE_STRATEGIES = [
   "merged",
+  "orgs",
   "starred",
   "broad",
   "maintained"
@@ -36215,6 +36217,9 @@ var ScoutPreferencesSchema = external_exports3.looseObject({
   scope: external_exports3.array(IssueScopeSchema).optional(),
   excludeRepos: external_exports3.array(external_exports3.string()).default([]),
   excludeOrgs: external_exports3.array(external_exports3.string()).default([]),
+  // Orgs whose repos the "orgs" search phase targets with org: qualifiers.
+  // Empty (the default) disables the phase even when the strategy is enabled.
+  preferredOrgs: external_exports3.array(external_exports3.string()).default([]),
   aiPolicyBlocklist: external_exports3.array(external_exports3.string()).default(["matplotlib/matplotlib"]),
   projectCategories: external_exports3.array(ProjectCategorySchema).default([]),
   minStars: external_exports3.number().default(50),
@@ -37684,7 +37689,11 @@ async function triageWithSLM(input, options) {
         format: SLM_TRIAGE_SCHEMA,
         options: { temperature: 0.1 }
       }),
-      signal: AbortSignal.timeout(timeoutMs)
+      signal: AbortSignal.timeout(timeoutMs),
+      // No redirect following: an allowed private host could otherwise
+      // 307/308-redirect the issue-text POST body to a public origin (#310).
+      // Ollama never redirects, so this costs nothing.
+      redirect: "error"
     });
   } catch {
     return null;
@@ -38079,6 +38088,9 @@ var IssueVetter = class {
     let rateLimitFailures = 0;
     let attemptedCount = 0;
     let firstAuthError = null;
+    let firstForbiddenError = null;
+    let forbiddenCount = 0;
+    const forbiddenRepos = /* @__PURE__ */ new Set();
     const uniqueUrls = [...new Set(urls)];
     const issueRefs = uniqueUrls.flatMap((url2) => {
       const p = parseGitHubUrl(url2);
@@ -38097,6 +38109,12 @@ var IssueVetter = class {
         break;
       if (firstAuthError)
         break;
+      const parsedUrl = parseGitHubUrl(url2);
+      const repoKey = parsedUrl ? `${parsedUrl.owner}/${parsedUrl.repo}` : null;
+      if (repoKey && forbiddenRepos.has(repoKey)) {
+        debug(MODULE10, `Skipping ${url2}: repo already returned 403`);
+        continue;
+      }
       attemptedCount++;
       const core = prefetchFor(url2);
       const task = this.vetIssue(url2, core ? { prefetched: core } : void 0).then((candidate) => {
@@ -38107,10 +38125,19 @@ var IssueVetter = class {
           candidates.push(candidate);
         }
       }).catch((error48) => {
-        if (isAuthError(error48)) {
+        if (getHttpStatusCode(error48) === 401) {
           firstAuthError ??= error48;
           return;
         }
+        if (isAuthError(error48)) {
+          firstForbiddenError ??= error48;
+          forbiddenCount++;
+          failedVettingCount++;
+          if (repoKey)
+            forbiddenRepos.add(repoKey);
+          warn(MODULE10, `Access forbidden for ${url2} (SAML/token scope?) \u2014 skipping this repo:`, errorMessage(error48));
+          return;
+        }
         failedVettingCount++;
         if (isRateLimitError(error48)) {
           rateLimitFailures++;
@@ -38129,6 +38156,9 @@ var IssueVetter = class {
       }
       throw firstAuthError;
     }
+    if (firstForbiddenError && attemptedCount > 0 && forbiddenCount === attemptedCount) {
+      throw firstForbiddenError;
+    }
     const allFailed = failedVettingCount === attemptedCount && attemptedCount > 0;
     if (allFailed) {
       warn(MODULE10, `All ${attemptedCount} issue(s) failed vetting. This may indicate a systemic issue (rate limit, auth, network).`);
@@ -38395,7 +38425,7 @@ function buildLanguageVariants(languages, isAnyLanguage, hasLabels) {
     return [languages.map((l) => `language:${l}`).join(" ")];
   return languages.map((l) => `language:${l}`);
 }
-async function searchAcrossLanguagesAndLabels(octokit, languages, isAnyLanguage, labels, buildBaseQuery, perPage, tracker = getSearchBudgetTracker(), startOffset = 0) {
+async function searchAcrossLanguagesAndLabels(octokit, languages, isAnyLanguage, labels, buildBaseQuery, perPage, tracker = getSearchBudgetTracker(), startOffset = 0, reservedOps = 0) {
   const variants = buildLanguageVariants(languages, isAnyLanguage, labels.length > 0);
   const k = variants.length > 0 ? startOffset % variants.length : 0;
   const langVariants = [...variants.slice(k), ...variants.slice(0, k)];
@@ -38404,7 +38434,7 @@ async function searchAcrossLanguagesAndLabels(octokit, languages, isAnyLanguage,
   for (let i = 0; i < langVariants.length; i++) {
     if (i > 0)
       await sleep(GRAPHQL_INTER_QUERY_DELAY_MS);
-    const items = await searchWithChunkedLabels(octokit, labels, 0, (labelQ) => `${buildBaseQuery(langVariants[i])} ${labelQ}`.replace(/  +/g, " ").trim(), perPage, tracker);
+    const items = await searchWithChunkedLabels(octokit, labels, reservedOps, (labelQ) => `${buildBaseQuery(langVariants[i])} ${labelQ}`.replace(/  +/g, " ").trim(), perPage, tracker);
     for (const item of items) {
       if (!seenUrls.has(item.html_url)) {
         seenUrls.add(item.html_url);
@@ -38582,6 +38612,35 @@ async function runPhase0(octokit, vetter, repos, maxResults, filterIssues) {
     rateLimitHit
   };
 }
+var MAX_QUERY_ORGS = 8;
+async function runPhaseOrgs(octokit, vetter, orgs, languages, isAnyLanguage, labels, maxResults, minStars, phase0RepoSet, starredRepoSet, filterIssues, tracker) {
+  info(MODULE12, `Orgs phase: searching ${orgs.length} preferred org(s)...`);
+  const queryOrgs = orgs.slice(0, MAX_QUERY_ORGS);
+  if (orgs.length > MAX_QUERY_ORGS) {
+    warn(MODULE12, `Orgs phase: capping query at ${MAX_QUERY_ORGS} org(s); dropping ${orgs.slice(MAX_QUERY_ORGS).join(", ")}`);
+  }
+  const orgQuery = queryOrgs.map((o) => `org:${o}`).join(" ");
+  try {
+    const allItems = await searchAcrossLanguagesAndLabels(octokit, languages, isAnyLanguage, labels, (langQ) => `is:issue is:open ${langQ} no:assignee ${orgQuery}`.replace(/  +/g, " ").trim(), maxResults * 3, tracker, 0, queryOrgs.length);
+    const { candidates, allVetFailed, rateLimitHit } = await filterVetAndScore(vetter, allItems, filterIssues, [phase0RepoSet, starredRepoSet], maxResults, minStars, "Orgs phase");
+    info(MODULE12, `Found ${candidates.length} candidates from preferred orgs`);
+    return {
+      candidates,
+      error: allVetFailed ? "all vetting failed" : null,
+      rateLimitHit
+    };
+  } catch (error48) {
+    if (getHttpStatusCode(error48) === 401)
+      throw error48;
+    const errMsg = errorMessage(error48);
+    warn(MODULE12, `Error in preferred-orgs search: ${errMsg}`);
+    return {
+      candidates: [],
+      error: errMsg,
+      rateLimitHit: isRateLimitError(error48)
+    };
+  }
+}
 async function runPhase1(octokit, vetter, repos, labels, maxResults, filterIssues) {
   info(MODULE12, `Phase 1: Searching issues in ${repos.length} starred repos...`);
   const phase1Labels = labels.slice(0, 3);
@@ -38806,6 +38865,7 @@ var IssueDiscovery = class {
     resetGraphQLSearchQueryCount();
     const tracker = this.budgetTracker;
     let searchBudget = CRITICAL_BUDGET_THRESHOLD - 1;
+    let preflightFailed = false;
     try {
       const rateLimit = await checkRateLimit(this.githubToken);
       searchBudget = rateLimit.remaining;
@@ -38823,6 +38883,7 @@ var IssueDiscovery = class {
     } catch (error48) {
       if (getHttpStatusCode(error48) === 401)
         throw error48;
+      preflightFailed = true;
       tracker.init(CRITICAL_BUDGET_THRESHOLD, new Date(Date.now() + 6e4).toISOString());
       warn(MODULE12, "Could not check rate limit \u2014 using conservative budget, skipping the starred phase:", errorMessage(error48));
     }
@@ -38869,7 +38930,9 @@ var IssueDiscovery = class {
         break;
     }
     const phase0RepoSet = new Set(phase0Repos);
-    const otherStrategiesCanRun = starredRepos.length > 0 && enabledStrategies.has("starred") || enabledStrategies.has("broad") || enabledStrategies.has("maintained");
+    const preferredOrgs = config2.preferredOrgs ?? [];
+    const orgsPhaseEnabled = preferredOrgs.length > 0 && enabledStrategies.has("orgs");
+    const otherStrategiesCanRun = orgsPhaseEnabled || starredRepos.length > 0 && enabledStrategies.has("starred") || enabledStrategies.has("broad") || enabledStrategies.has("maintained");
     if (phase0Repos.length > 0 && enabledStrategies.has("merged")) {
       const phase0Cap = otherStrategiesCanRun ? Math.max(1, Math.ceil(maxResults * PHASE0_MAX_SHARE)) : maxResults;
       const remaining = Math.min(maxResults - allCandidates.length, phase0Cap);
@@ -38879,6 +38942,13 @@ var IssueDiscovery = class {
       }
       strategiesUsed.push("merged");
     }
+    if (allCandidates.length < maxResults && orgsPhaseEnabled) {
+      await applyInterPhaseDelay();
+      const remaining = maxResults - allCandidates.length;
+      const result = await runPhaseOrgs(this.octokit, this.vetter, preferredOrgs, languages, isAnyLanguage, labels, remaining, minStars, phase0RepoSet, starredRepoSet, filterIssues, tracker);
+      recordPhaseResult("orgs", result);
+      strategiesUsed.push("orgs");
+    }
     if (allCandidates.length < maxResults && starredRepos.length > 0 && searchBudget >= CRITICAL_BUDGET_THRESHOLD && enabledStrategies.has("starred")) {
       await applyInterPhaseDelay();
       const reposToSearch = starredRepos.filter((r) => !phase0RepoSet.has(r));
@@ -38898,7 +38968,8 @@ var IssueDiscovery = class {
     if (viableBeforeBroad >= maxResults && enabledStrategies.has("broad")) {
       info(MODULE12, `Skipping broad search: ${viableBeforeBroad} viable candidate(s) already meet maxResults (${maxResults})`);
     } else if (enabledStrategies.has("broad")) {
-      const newRepoCandidateCount = allCandidates.filter((c) => c.recommendation !== "skip" && !phase0RepoSet.has(c.issue.repo) && !starredRepoSet.has(c.issue.repo)).length;
+      const preferredOrgSet = new Set(preferredOrgs.map((o) => o.toLowerCase()));
+      const newRepoCandidateCount = allCandidates.filter((c) => c.recommendation !== "skip" && !phase0RepoSet.has(c.issue.repo) && !starredRepoSet.has(c.issue.repo) && !preferredOrgSet.has(c.issue.repo.split("/")[0]?.toLowerCase() ?? "")).length;
       if (skipThreshold > 0 && newRepoCandidateCount >= skipThreshold) {
         info(MODULE12, `Skipping broad search: already found ${newRepoCandidateCount} viable candidate(s) from new repos (threshold: ${skipThreshold})`);
       } else {
@@ -38926,10 +38997,11 @@ var IssueDiscovery = class {
       strategiesUsed.push("maintained");
     }
     const phasesSkippedForBudget = searchBudget < CRITICAL_BUDGET_THRESHOLD;
-    const budgetNote = phasesSkippedForBudget ? ` The starred-repo phase was skipped due to critically low API quota (${searchBudget} remaining); broad and maintained phases still ran on GraphQL.` : "";
+    const budgetNote = phasesSkippedForBudget ? preflightFailed ? " The starred-repo phase was skipped as a precaution because the rate-limit check failed (quota unknown); broad and maintained phases still ran on GraphQL." : ` The starred-repo phase was skipped due to critically low API quota (${searchBudget} remaining); broad and maintained phases still ran on GraphQL.` : "";
     if (allCandidates.length === 0) {
       const errorDetails = [
         phaseErrors["0"] ? `Phase 0 (merged-PR repos): ${phaseErrors["0"]}` : null,
+        phaseErrors["orgs"] ? `Orgs phase (preferred orgs): ${phaseErrors["orgs"]}` : null,
         phaseErrors["1"] ? `Phase 1 (starred repos): ${phaseErrors["1"]}` : null,
         phaseErrors["2"] ? `Phase 2 (general): ${phaseErrors["2"]}` : null,
         phaseErrors["3"] ? `Phase 3 (maintained repos): ${phaseErrors["3"]}` : null
@@ -39034,10 +39106,17 @@ function parseRoadmapIssueRefs(content, owner, repo) {
       refs.add(n);
   }
   const fullRefStripPattern = /\b[\w.-]+\/[\w.-]+#\d+\b/gi;
+  let inFence = false;
   for (const line of content.split("\n")) {
+    if (/^\s*(```|~~~)/.test(line)) {
+      inFence = !inFence;
+      continue;
+    }
+    if (inFence)
+      continue;
     if (/^\s*#+\s/.test(line))
       continue;
-    const stripped = line.replace(fullRefStripPattern, "");
+    const stripped = line.replace(fullRefStripPattern, "").replace(/`[^`]*`/g, "");
     for (const m of stripped.matchAll(/(?:^|[^&\w])#(\d+)\b/g)) {
       const n = Number.parseInt(m[1], 10);
       if (n > 0)
@@ -39114,7 +39193,8 @@ function classifyHorizon(input) {
 function splitByHorizon(candidates, count, ratio = DEFAULT_SPLIT_RATIO) {
   const allQuick = candidates.filter((c) => c.horizon === "quick-win").sort((a, b) => b.viabilityScore - a.viabilityScore);
   const allBigger = candidates.filter((c) => c.horizon === "bigger-bet").sort((a, b) => b.viabilityScore - a.viabilityScore);
-  const targetQuick = Math.round(count * ratio);
+  const clampedRatio = Math.max(0, Math.min(1, ratio));
+  const targetQuick = Math.round(count * clampedRatio);
   const targetBigger = count - targetQuick;
   const quickTaken = Math.min(allQuick.length, targetQuick);
   const biggerTaken = Math.min(allBigger.length, targetBigger);
@@ -39168,6 +39248,17 @@ function detectWontfixNoContributor(input) {
 }
 var NO_ANCHORS_MESSAGE = "No anchor repos yet (need 3+ merged PRs in a repo). Try `scout search` to build relationships first.";
 var NO_RESULTS_MESSAGE = "No open feature opportunities in your anchor repos right now. Check back next week, or try `scout search` for fix-mode work.";
+function buildRepoExclusionFilter(opts) {
+  const excluded = new Set([...opts.excludeRepos ?? [], ...opts.aiPolicyBlocklist ?? []].map((r) => r.toLowerCase()));
+  const excludedOrgs = new Set((opts.excludeOrgs ?? []).map((o) => o.toLowerCase()));
+  return (repoFullName) => {
+    const lower = repoFullName.toLowerCase();
+    if (excluded.has(lower))
+      return false;
+    const org = lower.split("/")[0];
+    return !(org && excludedOrgs.has(org));
+  };
+}
 function extractLabels(item) {
   if (!Array.isArray(item.labels))
     return [];
@@ -39213,7 +39304,8 @@ async function vetAndClassify(item, vetter, roadmapRefs) {
   return { ...candidate, horizon };
 }
 async function discoverFeatures(opts) {
-  const anchorRepos = resolveAnchorRepos(opts.repoScores, opts.anchorThreshold);
+  const includeRepo = buildRepoExclusionFilter(opts);
+  const anchorRepos = resolveAnchorRepos(opts.repoScores, opts.anchorThreshold).filter(includeRepo);
   if (anchorRepos.length === 0) {
     return {
       quickWins: [],
@@ -39320,7 +39412,11 @@ async function discoverFeaturesBroad(opts) {
         merged.push(raw);
       }
     }
-    items = merged.filter((it) => !it.pull_request && !it.assignee && isFeatureIssue(it)).slice(0, maxToVet);
+    const includeRepo = buildRepoExclusionFilter(opts);
+    items = merged.filter((it) => !it.pull_request && !it.assignee && isFeatureIssue(it)).filter((it) => {
+      const repo = extractRepoFromUrl(it.html_url);
+      return repo === null || includeRepo(repo);
+    }).slice(0, maxToVet);
   } catch (err) {
     rethrowIfFatal(err);
     warn(MODULE13, `broad feature search failed: ${errorMessage(err)}`);
@@ -39654,6 +39750,13 @@ function mergeStates(local, remote) {
   const localPrefsWin = localPrefsTs !== void 0 && (remotePrefsTs === void 0 || localPrefsTs > remotePrefsTs);
   const preferences = localPrefsWin ? local.preferences : remote.preferences;
   const preferencesUpdatedAt = pickFresherTimestamp(localPrefsTs, remotePrefsTs);
+  const mergedPRsFinal = unionByUrl(local.mergedPRs, remote.mergedPRs);
+  const closedPRsFinal = unionByUrl(local.closedPRs, remote.closedPRs);
+  const resolvedUrls = /* @__PURE__ */ new Set([
+    ...mergedPRsFinal.map((p) => p.url),
+    ...closedPRsFinal.map((p) => p.url)
+  ]);
+  const openPRsFinal = unionByUrl(local.openPRs ?? [], remote.openPRs ?? []).filter((p) => !resolvedUrls.has(p.url));
   return {
     ...local,
     ...remote,
@@ -39664,9 +39767,9 @@ function mergeStates(local, remote) {
     repoScores: mergeRepoScores(local.repoScores, remote.repoScores),
     starredRepos: mergeStarredRepos(local, remote),
     starredReposLastFetched: pickFresherTimestamp(local.starredReposLastFetched, remote.starredReposLastFetched),
-    mergedPRs: unionByUrl(local.mergedPRs, remote.mergedPRs),
-    closedPRs: unionByUrl(local.closedPRs, remote.closedPRs),
-    openPRs: unionByUrl(local.openPRs ?? [], remote.openPRs ?? []),
+    mergedPRs: mergedPRsFinal,
+    closedPRs: closedPRsFinal,
+    openPRs: openPRsFinal,
     savedResults: savedResultsFinal,
     skippedIssues,
     lastSearchAt: pickFresherTimestamp(local.lastSearchAt, remote.lastSearchAt),
@@ -40038,12 +40141,16 @@ var OssScout = class {
       languages: this.state.preferences.languages,
       excludeRepos: this.state.preferences.excludeRepos,
       excludeOrgs: this.state.preferences.excludeOrgs,
+      aiPolicyBlocklist: this.state.preferences.aiPolicyBlocklist,
       splitRatio: options?.splitRatio ?? this.state.preferences.featuresSplitRatio
     }) : await discoverFeatures({
       octokit,
       vetter,
       repoScores: this.state.repoScores ?? {},
       count,
+      excludeRepos: this.state.preferences.excludeRepos,
+      excludeOrgs: this.state.preferences.excludeOrgs,
+      aiPolicyBlocklist: this.state.preferences.aiPolicyBlocklist,
       anchorThreshold: options?.anchorThreshold ?? this.state.preferences.featuresAnchorThreshold,
       splitRatio: options?.splitRatio ?? this.state.preferences.featuresSplitRatio
     });
@@ -40585,6 +40692,7 @@ var FIELD_CONFIGS = {
   scope: { type: "enum-array", validValues: IssueScopeSchema.options },
   excludeRepos: { type: "array" },
   excludeOrgs: { type: "array" },
+  preferredOrgs: { type: "array" },
   aiPolicyBlocklist: { type: "array" },
   projectCategories: {
     type: "enum-array",
@@ -40746,9 +40854,9 @@ function registerTools(server, scout) {
     "search",
     "Search for open source issues matching your preferences",
     {
-      maxResults: external_exports3.number().int().min(1).max(50).optional().describe("Maximum number of results to return (1-50, default 10)"),
+      maxResults: external_exports3.number().int().min(1).max(100).optional().describe("Maximum number of results to return (1-100, default 10)"),
       strategies: external_exports3.string().optional().describe(
-        "Comma-separated search strategies: merged, starred, broad, maintained, all"
+        "Comma-separated search strategies: merged, orgs, starred, broad, maintained, all"
       ),
       preferLanguages: external_exports3.array(external_exports3.string()).optional().describe(
         "Soft-boost ranking for candidates whose repo language matches one of these (case-insensitive). Personalization tier between recommendation and viabilityScore (#1244). Not a filter; only reorders."
@@ -41095,7 +41203,7 @@ function registerResources(server, scout) {
 // src/index.ts
 var SERVER_INFO = {
   name: "oss-scout-mcp",
-  version: "0.10.1"
+  version: "0.11.0"
   // x-release-please-version
 };
 function createServer(scout) {

package/dist/tools.js

@@ -35,13 +35,16 @@ export function registerTools(server, scout) {
             .number()
             .int()
             .min(1)
-            .max(50)
+            // 100, not 50: the CLI's search count is unbounded, so a tight MCP
+            // cap made the two surfaces disagree for 1.5.0 clients while still
+            // needing SOME ceiling against absurd values (#317).
+            .max(100)
             .optional()
-            .describe("Maximum number of results to return (1-50, default 10)"),
+            .describe("Maximum number of results to return (1-100, default 10)"),
         strategies: z
             .string()
             .optional()
-            .describe("Comma-separated search strategies: merged, starred, broad, maintained, all"),
+            .describe("Comma-separated search strategies: merged, orgs, starred, broad, maintained, all"),
         preferLanguages: z
             .array(z.string())
             .optional()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oss-scout/mcp",
-  "version": "0.10.1",
+  "version": "0.11.0",
   "description": "MCP server for oss-scout — exposes issue discovery and vetting as MCP tools",
   "type": "module",
   "bin": {
@@ -18,7 +18,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.27.1",
     "zod": "^4.3.6",
-    "@oss-scout/core": "^1.5.1"
+    "@oss-scout/core": "^1.6.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",