@tensorfeed/mcp-server 1.11.0 → 1.12.0

package/CHANGELOG.md

@@ -1,6 +1,16 @@
 # Changelog
 
-All notable changes to the [TensorFeed.ai MCP server](https://github.com/RipperMercs/tensorfeed/tree/main/mcp-server). Free tools work without configuration; premium tools require a bearer token via the `TENSORFEED_TOKEN` env var. Buy credits at [tensorfeed.ai/developers/agent-payments](https://tensorfeed.ai/developers/agent-payments).
+All notable changes to the [TensorFeed.ai MCP server](https://github.com/RipperMercs/tensorfeed-mcp). Free tools work without configuration; premium tools require a bearer token via the `TENSORFEED_TOKEN` env var. Buy credits at [tensorfeed.ai/developers/agent-payments](https://tensorfeed.ai/developers/agent-payments).
+
+## 1.12.0 - 2026-05-04
+
+### Added
+- Defense-in-depth output sanitizer (`src/sanitize.ts`). Every tool's text output passes through a scrub pass before reaching the host LLM (Claude Desktop, Cursor, Cline, Roo, etc): strips ASCII control chars (preserves newline, carriage return, tab), strips bidi control + zero-width spoofing chars, and neutralizes role-confusion markers (ChatML / Llama / Mistral chat tokens, "ignore previous instructions", line-leading "system:" / "developer:" / "assistant:" preambles). Wired via a new `registerTool()` helper that wraps `server.tool()`. The TensorFeed worker already runs the same scrub on its agent-facing endpoints; this layer protects against any new endpoint that might forget it, plus drift between worker rules and what the MCP server should consider safe. No behavior change for legitimate text. No new dependencies.
+
+## 1.11.1 - 2026-05-04
+
+### Changed
+- Repository URL updated to point at the dedicated [`RipperMercs/tensorfeed-mcp`](https://github.com/RipperMercs/tensorfeed-mcp) repo. The MCP server now has its own GitHub home for issues, stars, and discoverability. Source-of-truth for builds remains in the main `tensorfeed` monorepo's `mcp-server/` folder; the standalone repo is mirrored on release. No code changes; no behavior changes; npm install / npx unaffected.
 
 ## 1.11.0 - 2026-04-29
 

package/README.md

@@ -1,118 +1,34 @@
 # TensorFeed MCP Server
 
-A [Model Context Protocol](https://modelcontextprotocol.io) server that gives AI agents access to real-time AI industry data and premium endpoints from [TensorFeed.ai](https://tensorfeed.ai).
+> **The MCP server has its own repo: https://github.com/RipperMercs/tensorfeed-mcp**
+>
+> User-facing docs, install instructions, and the full tool reference live there. Star and watch that repo to follow MCP server updates.
 
-## Free Tools
+This subfolder remains in the main `tensorfeed` repo as the **publishing source** for the npm package (`@tensorfeed/mcp-server`) and the [official MCP registry](https://registry.modelcontextprotocol.io/v0/servers/ai.tensorfeed/mcp-server) entry. Edits to `src/`, `server.json`, `package.json`, etc. happen here and get pushed to the standalone repo on release.
 
-| Tool | Description |
-|------|-------------|
-| `get_ai_news` | Latest AI news from 15+ sources (filterable by category) |
-| `get_ai_status` | Real-time status of Claude, OpenAI, Gemini, Mistral, and more |
-| `is_service_down` | Check if a specific AI service is down |
-| `get_model_pricing` | Compare pricing across all major AI model providers |
-| `get_ai_today` | Summary of top AI stories from the last 24 hours |
-| `get_agent_activity` | Live AI bot traffic on TensorFeed.ai with top-bot breakdown |
-| `mcp_registry_snapshot` | Today's summary of the official MCP server registry: total servers, top namespaces, newly added/reactivated/deprecated names |
-| `probe_latest` | Last 24h of measured LLM endpoint latency and availability per provider (ttfb/total p50/p95/p99). Unique because measured, not self-reported |
+## Publish a new version
 
-## Premium Tools (paid in USDC on Base)
+From the main tensorfeed repo:
 
-These tools require a `TENSORFEED_TOKEN` env var. Buy credits at [tensorfeed.ai/developers/agent-payments](https://tensorfeed.ai/developers/agent-payments) and pass the returned `tf_live_...` token to your MCP client.
+```powershell
+# 1. Bump the version in mcp-server/package.json + mcp-server/server.json
+# 2. Build + npm publish from the mcp-server/ folder
+cd mcp-server
+npm run build
+npm publish --access public
 
-| Tool | Cost | Description |
-|------|------|-------------|
-| `get_account_balance` | Free | Show credits remaining on the configured token |
-| `get_account_usage` | Free | Per-endpoint usage history for the configured token |
-| `premium_routing` | 1 credit | Top-N ranked AI model recommendations with full score breakdown |
-| `pricing_series` | 1 credit | Daily price points for one model with min/max/delta summary |
-| `benchmark_series` | 1 credit | Score evolution for a benchmark on one model |
-| `status_uptime` | 1 credit | Daily uptime % for one provider with incident-day list |
-| `premium_agents_directory` | 1 credit | Enriched agents catalog with live status, news, traffic, trending_score |
-| `news_search` | 1 credit | Full-text news search with date/provider/category filters and relevance scoring |
-| `cost_projection` | 1 credit | Project workload cost across 1-10 AI models with 4 time horizons and cheapest-monthly ranking |
-| `provider_deepdive` | 1 credit | One provider's full profile: status, all models with benchmarks joined, recent news, traffic |
-| `compare_models` | 1 credit | Side-by-side comparison of 2-5 models with normalized benchmarks and rankings |
-| `whats_new` | 1 credit | Agent morning brief: pricing changes, incidents, top news from last 1-7 days |
-| `mcp_registry_series` | 1 credit | Multi-day MCP registry growth and churn series, 90-day max range |
-| `probe_series` | 1 credit | Daily SLA series for one LLM provider with ttfb/total p50/p95/p99 and incident-hour count, 90-day max range |
-| `list_watches` | Free | List active webhook watches owned by the token |
-| `create_price_watch` | 1 credit | Register a webhook watch on a model price change |
-| `create_status_watch` | 1 credit | Register a webhook watch on a service status transition |
-| `create_digest_watch` | 1 credit | Register a daily/weekly digest webhook (pricing-changes summary, set-and-forget) |
-| `delete_watch` | Free | Remove an active watch |
+# 3. Republish to the official MCP registry
+.\scripts\mcp-publish.ps1
 
-## Setup with Claude Code
-
-Add to your Claude Code MCP config (`~/.claude/claude_desktop_config.json`):
-
-```json
-{
-  "mcpServers": {
-    "tensorfeed": {
-      "command": "npx",
-      "args": ["-y", "@tensorfeed/mcp-server"]
-    }
-  }
-}
-```
-
-To enable premium tools, add the `env` block:
-
-```json
-{
-  "mcpServers": {
-    "tensorfeed": {
-      "command": "npx",
-      "args": ["-y", "@tensorfeed/mcp-server"],
-      "env": {
-        "TENSORFEED_TOKEN": "tf_live_..."
-      }
-    }
-  }
-}
-```
-
-## Setup with Claude Desktop
-
-Add to Claude Desktop settings (same shape as above).
-
-## Run Locally
-
-```bash
-npx @tensorfeed/mcp-server
-# or with a token for premium endpoints
-TENSORFEED_TOKEN=tf_live_... npx @tensorfeed/mcp-server
+# 4. Mirror the new version to the standalone repo
+#    (manual until we wire it as a release-time GitHub Action)
 ```
 
-## Example Queries
-
-Free tier:
-
-- "What's happening in AI today?"
-- "Is Claude down right now?"
-- "Compare pricing between Claude Opus and GPT-4o"
-- "Show me the latest AI research papers"
-- "What's the status of all AI services?"
-
-Premium tier (with `TENSORFEED_TOKEN` set):
-
-- "Recommend the best AI model for code under $5 per million tokens"
-- "Show the price history of Claude Opus 4.7 over the last 30 days"
-- "What's Anthropic's uptime this month?"
-- "Compare model pricing between April 1 and today"
-- "Set up a webhook to my server when Claude goes down"
-- "What's my credit balance?"
-
-## Pricing
-
-Premium tools cost 1 credit per call. Credits are 50 per $1 USDC at base rate, with volume discounts at $5 (10%), $30 (25%), and $200 (40%). See [tensorfeed.ai/developers/agent-payments](https://tensorfeed.ai/developers/agent-payments) for the full payment flow and trust attestation.
-
-No refunds: all credit purchases are final per Section 17.5 of the [Terms](https://tensorfeed.ai/terms#premium). Credits do not expire and are jointly redeemable on tensorfeed.ai and terminalfeed.io, so the safe pattern is to buy small ($1 USDC for 50 credits) and top up as call volume is calibrated. Premium access is unavailable in OFAC-sanctioned jurisdictions; see Section 17.9.
-
-## Data Source
-
-All data comes from the [TensorFeed.ai API](https://tensorfeed.ai/developers), which aggregates from 15+ sources including Anthropic, OpenAI, Google AI, TechCrunch, The Verge, arXiv, Hacker News, and more. Updated every 10 minutes.
-
-## License
+## Quick links
 
-MIT - Built by [TensorFeed.ai](https://tensorfeed.ai/about)
+- **User-facing repo (please star):** https://github.com/RipperMercs/tensorfeed-mcp
+- **npm package:** https://www.npmjs.com/package/@tensorfeed/mcp-server
+- **Official MCP registry:** https://registry.modelcontextprotocol.io/v0/servers/ai.tensorfeed/mcp-server
+- **TensorFeed.ai:** https://tensorfeed.ai
+- **Premium / payments:** https://tensorfeed.ai/developers/agent-payments
+- **AFTA standard:** https://tensorfeed.ai/agent-fair-trade

package/dist/index.js

@@ -2,6 +2,7 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { z } from 'zod';
+import { sanitizeToolResponse } from './sanitize.js';
 const API_BASE = 'https://tensorfeed.ai/api';
 const SDK_VERSION = '1.9.0';
 async function fetchJSON(path, opts = {}) {
@@ -46,8 +47,26 @@ const server = new McpServer({
     name: 'tensorfeed',
     version: SDK_VERSION,
 });
+// ── Defense-in-depth tool wrapper ───────────────────────────────────
+// Every tool's text output passes through sanitizeToolResponse before
+// reaching the host LLM. Strips control chars, bidi/zero-width spoofing,
+// and neutralizes role-confusion tokens (ChatML / Llama / Mistral chat
+// markers, "ignore previous instructions", etc). The TensorFeed worker
+// already runs the same scrub on its agent-facing endpoints; this layer
+// covers any new endpoint that might forget it, plus protects against
+// drift between worker rules and what the MCP server should consider
+// safe. See ./sanitize.ts.
+function registerTool(name, description, paramsSchema, cb) {
+    const wrapped = (async (args, extra) => {
+        const result = await cb(args, extra);
+        return sanitizeToolResponse(result);
+    });
+    // Direct dispatch to the SDK's underlying registration. Do not call
+    // registerTool() here or it will recurse forever.
+    return server.tool(name, description, paramsSchema, wrapped);
+}
 // ── Tool: get_ai_news ───────────────────────────────────────────────
-server.tool('get_ai_news', 'Get the latest AI news articles from TensorFeed.ai. Aggregates from 15+ sources including Anthropic, OpenAI, Google, TechCrunch, The Verge, arXiv, and more.', {
+registerTool('get_ai_news', 'Get the latest AI news articles from TensorFeed.ai. Aggregates from 15+ sources including Anthropic, OpenAI, Google, TechCrunch, The Verge, arXiv, and more.', {
     category: z.string().optional().describe('Filter by category (e.g. "anthropic", "openai", "research", "tools")'),
     limit: z.number().min(1).max(50).optional().describe('Number of articles to return (default 10, max 50)'),
 }, async ({ category, limit }) => {
@@ -62,7 +81,7 @@ server.tool('get_ai_news', 'Get the latest AI news articles from TensorFeed.ai.
     return { content: [{ type: 'text', text: text || 'No articles found.' }] };
 });
 // ── Tool: get_ai_status ─────────────────────────────────────────────
-server.tool('get_ai_status', 'Get real-time operational status of major AI services (Claude, OpenAI, Gemini, Mistral, Cohere, Replicate, Hugging Face).', {}, async () => {
+registerTool('get_ai_status', 'Get real-time operational status of major AI services (Claude, OpenAI, Gemini, Mistral, Cohere, Replicate, Hugging Face).', {}, async () => {
     const data = await fetchJSON('/status');
     const text = data.services
         .map(s => {
@@ -75,7 +94,7 @@ server.tool('get_ai_status', 'Get real-time operational status of major AI servi
     return { content: [{ type: 'text', text: `AI Service Status:\n${text}` }] };
 });
 // ── Tool: is_service_down ───────────────────────────────────────────
-server.tool('is_service_down', 'Check if a specific AI service is currently down or experiencing issues.', {
+registerTool('is_service_down', 'Check if a specific AI service is currently down or experiencing issues.', {
     service: z.string().describe('Service name to check (e.g. "claude", "openai", "gemini", "mistral", "cohere", "hugging face", "replicate")'),
 }, async ({ service }) => {
     const data = await fetchJSON('/status');
@@ -96,7 +115,7 @@ server.tool('is_service_down', 'Check if a specific AI service is currently down
     };
 });
 // ── Tool: get_model_pricing ─────────────────────────────────────────
-server.tool('get_model_pricing', 'Get AI model pricing comparison across all major providers (Anthropic, OpenAI, Google, Meta, Mistral, Cohere). Prices per 1M tokens.', {}, async () => {
+registerTool('get_model_pricing', 'Get AI model pricing comparison across all major providers (Anthropic, OpenAI, Google, Meta, Mistral, Cohere). Prices per 1M tokens.', {}, async () => {
     const data = await fetchJSON('/models');
     const text = data.providers
         .map(p => {
@@ -116,7 +135,7 @@ server.tool('get_model_pricing', 'Get AI model pricing comparison across all maj
     return { content: [{ type: 'text', text: `AI Model Pricing (per 1M tokens):\n\n${text}` }] };
 });
 // ── Tool: get_ai_today ──────────────────────────────────────────────
-server.tool('get_ai_today', 'Get a summary of what happened in AI today. Returns the top stories from the last 24 hours.', {
+registerTool('get_ai_today', 'Get a summary of what happened in AI today. Returns the top stories from the last 24 hours.', {
     limit: z.number().min(1).max(20).optional().describe('Number of stories (default 5)'),
 }, async ({ limit }) => {
     const data = await fetchJSON(`/news?limit=${limit || 5}`);
@@ -126,7 +145,7 @@ server.tool('get_ai_today', 'Get a summary of what happened in AI today. Returns
     return { content: [{ type: 'text', text: `Today in AI:\n\n${text}` }] };
 });
 // ── Tool: get_agent_activity ────────────────────────────────────────
-server.tool('get_agent_activity', 'Get live AI bot traffic on TensorFeed.ai. Returns today\'s bot hit count, the most recent 50 hits with bot name + endpoint + timestamp, and a derived top-bots breakdown. Useful when an agent wants to see which crawlers are pulling AI ecosystem data and how that distribution shifts. Free, no auth.', {}, async () => {
+registerTool('get_agent_activity', 'Get live AI bot traffic on TensorFeed.ai. Returns today\'s bot hit count, the most recent 50 hits with bot name + endpoint + timestamp, and a derived top-bots breakdown. Useful when an agent wants to see which crawlers are pulling AI ecosystem data and how that distribution shifts. Free, no auth.', {}, async () => {
     const data = (await fetchJSON('/agents/activity'));
     const tally = new Map();
     for (const hit of data.recent) {
@@ -158,7 +177,7 @@ server.tool('get_agent_activity', 'Get live AI bot traffic on TensorFeed.ai. Ret
 // PREMIUM TOOLS (require TENSORFEED_TOKEN env var, paid in USDC on Base)
 // ════════════════════════════════════════════════════════════════════
 // ── Tool: get_account_balance ───────────────────────────────────────
-server.tool('get_account_balance', 'Check the credit balance for the configured TensorFeed bearer token. Free, but requires TENSORFEED_TOKEN to be set.', {}, async () => {
+registerTool('get_account_balance', 'Check the credit balance for the configured TensorFeed bearer token. Free, but requires TENSORFEED_TOKEN to be set.', {}, async () => {
     const data = (await fetchJSON('/payment/balance', { auth: true }));
     return {
         content: [
@@ -170,7 +189,7 @@ server.tool('get_account_balance', 'Check the credit balance for the configured
     };
 });
 // ── Tool: get_account_usage ─────────────────────────────────────────
-server.tool('get_account_usage', 'Show per-endpoint usage for the configured TensorFeed token (last 100 calls aggregated). Free, but requires TENSORFEED_TOKEN.', {}, async () => {
+registerTool('get_account_usage', 'Show per-endpoint usage for the configured TensorFeed token (last 100 calls aggregated). Free, but requires TENSORFEED_TOKEN.', {}, async () => {
     const data = (await fetchJSON('/payment/usage', { auth: true }));
     if (data.total_calls === 0) {
         return { content: [{ type: 'text', text: 'No premium API calls on this token yet.' }] };
@@ -189,7 +208,7 @@ server.tool('get_account_usage', 'Show per-endpoint usage for the configured Ten
     };
 });
 // ── Tool: premium_routing (1 credit) ────────────────────────────────
-server.tool('premium_routing', 'Get a ranked list of recommended AI models for a task with full score breakdown (quality, availability, cost, latency). Costs 1 credit.', {
+registerTool('premium_routing', 'Get a ranked list of recommended AI models for a task with full score breakdown (quality, availability, cost, latency). Costs 1 credit.', {
     task: z.enum(['code', 'reasoning', 'creative', 'general']).optional().describe('Task type the model needs to be good at (default: general)'),
     budget: z.number().optional().describe('Max blended USD per 1M tokens'),
     min_quality: z.number().min(0).max(1).optional().describe('Minimum quality score in [0, 1]'),
@@ -217,7 +236,7 @@ server.tool('premium_routing', 'Get a ranked list of recommended AI models for a
     return { content: [{ type: 'text', text: `Routing for "${data.task}":\n\n${list}${billing}` }] };
 });
 // ── Tool: pricing_series (1 credit) ─────────────────────────────────
-server.tool('pricing_series', 'Daily price points for one AI model with min/max/delta summary. Default range = last 30 days, max 90 days. Costs 1 credit.', {
+registerTool('pricing_series', 'Daily price points for one AI model with min/max/delta summary. Default range = last 30 days, max 90 days. Costs 1 credit.', {
     model: z.string().describe('Model id or display name (e.g. "Claude Opus 4.7" or "claude-opus-4-7")'),
     from: z.string().optional().describe('Start date YYYY-MM-DD UTC (default: 30 days ago)'),
     to: z.string().optional().describe('End date YYYY-MM-DD UTC (default: today)'),
@@ -242,7 +261,7 @@ server.tool('pricing_series', 'Daily price points for one AI model with min/max/
     };
 });
 // ── Tool: benchmark_series (1 credit) ───────────────────────────────
-server.tool('benchmark_series', 'Score evolution for a single benchmark on one AI model. Costs 1 credit. Benchmark keys: swe_bench, mmlu_pro, gpqa_diamond, math, human_eval.', {
+registerTool('benchmark_series', 'Score evolution for a single benchmark on one AI model. Costs 1 credit. Benchmark keys: swe_bench, mmlu_pro, gpqa_diamond, math, human_eval.', {
     model: z.string().describe('Model id or display name'),
     benchmark: z.string().describe('Benchmark key (e.g. swe_bench, mmlu_pro, gpqa_diamond, math, human_eval)'),
     from: z.string().optional().describe('Start date YYYY-MM-DD UTC (default: 30 days ago)'),
@@ -268,7 +287,7 @@ server.tool('benchmark_series', 'Score evolution for a single benchmark on one A
     };
 });
 // ── Tool: status_uptime (1 credit) ──────────────────────────────────
-server.tool('status_uptime', 'Daily uptime rollup for one provider with operational/degraded/down day counts and uptime % (degraded counts as half-credit). Costs 1 credit.', {
+registerTool('status_uptime', 'Daily uptime rollup for one provider with operational/degraded/down day counts and uptime % (degraded counts as half-credit). Costs 1 credit.', {
     provider: z.string().describe('Provider name (e.g. anthropic, openai, google)'),
     from: z.string().optional().describe('Start date YYYY-MM-DD UTC (default: 30 days ago)'),
     to: z.string().optional().describe('End date YYYY-MM-DD UTC (default: today)'),
@@ -295,7 +314,7 @@ server.tool('status_uptime', 'Daily uptime rollup for one provider with operatio
     };
 });
 // ── Tool: premium_agents_directory (1 credit) ───────────────────────
-server.tool('premium_agents_directory', 'Enriched AI agents catalog joined with live status, recent news, agent traffic, flagship pricing, and a 0-100 trending_score. Costs 1 credit.', {
+registerTool('premium_agents_directory', 'Enriched AI agents catalog joined with live status, recent news, agent traffic, flagship pricing, and a 0-100 trending_score. Costs 1 credit.', {
     category: z.string().optional().describe('coding, research, general, creative, frameworks'),
     status: z.enum(['operational', 'degraded', 'down', 'unknown']).optional(),
     open_source: z.boolean().optional(),
@@ -328,7 +347,7 @@ server.tool('premium_agents_directory', 'Enriched AI agents catalog joined with
     };
 });
 // ── Tool: whats_new (1 credit) ──────────────────────────────────────
-server.tool('whats_new', 'Agent morning brief: pricing changes, new/removed models, status incidents, and top news from the last 1-7 days. The tool to call when your agent boots up. Costs 1 credit.', {
+registerTool('whats_new', 'Agent morning brief: pricing changes, new/removed models, status incidents, and top news from the last 1-7 days. The tool to call when your agent boots up. Costs 1 credit.', {
     days: z.number().min(1).max(7).optional().describe('Window length in days (default 1)'),
     news_limit: z.number().min(1).max(25).optional().describe('Max news headlines (default 10)'),
 }, async ({ days, news_limit }) => {
@@ -364,7 +383,7 @@ server.tool('whats_new', 'Agent morning brief: pricing changes, new/removed mode
     };
 });
 // ── Tool: compare_models (1 credit) ─────────────────────────────────
-server.tool('compare_models', 'Side-by-side comparison of 2-5 AI models. Returns pricing, benchmarks (normalized to a union of keys with null for missing scores), provider status, and recent news per model, plus rankings (cheapest blended, most context, per-benchmark leaderboard). Costs 1 credit.', {
+registerTool('compare_models', 'Side-by-side comparison of 2-5 AI models. Returns pricing, benchmarks (normalized to a union of keys with null for missing scores), provider status, and recent news per model, plus rankings (cheapest blended, most context, per-benchmark leaderboard). Costs 1 credit.', {
     ids: z.string().describe('Comma-separated list of 2-5 model ids or display names. Examples: "Claude Opus 4.7,GPT-5.5,Gemini 3" or "opus-4-7,gpt-5-5"'),
 }, async ({ ids }) => {
     const data = (await fetchJSON(`/premium/compare/models?ids=${encodeURIComponent(ids)}`, { auth: true }));
@@ -391,7 +410,7 @@ server.tool('compare_models', 'Side-by-side comparison of 2-5 AI models. Returns
     };
 });
 // ── Tool: provider_deepdive (1 credit) ──────────────────────────────
-server.tool('provider_deepdive', 'Everything about an AI provider in one call: live status, all models with pricing + tier + benchmark scores joined in, recent news mentions, and agent traffic. Costs 1 credit. Aggregation IS the value; doing this from free endpoints would take 4 round-trips.', {
+registerTool('provider_deepdive', 'Everything about an AI provider in one call: live status, all models with pricing + tier + benchmark scores joined in, recent news mentions, and agent traffic. Costs 1 credit. Aggregation IS the value; doing this from free endpoints would take 4 round-trips.', {
     provider: z.string().describe('Provider id or display name (case-insensitive). Examples: anthropic, openai, google, mistral, cohere'),
 }, async ({ provider }) => {
     const data = (await fetchJSON(`/premium/providers/${encodeURIComponent(provider)}`, { auth: true }));
@@ -421,7 +440,7 @@ server.tool('provider_deepdive', 'Everything about an AI provider in one call: l
     };
 });
 // ── Tool: cost_projection (1 credit) ────────────────────────────────
-server.tool('cost_projection', 'Project the cost of a token-usage workload across 1-10 AI models. Returns daily/weekly/monthly/yearly totals per model and a ranking by cheapest monthly. Costs 1 credit.', {
+registerTool('cost_projection', 'Project the cost of a token-usage workload across 1-10 AI models. Returns daily/weekly/monthly/yearly totals per model and a ranking by cheapest monthly. Costs 1 credit.', {
     models: z.string().describe('One model or comma-separated list of up to 10 (e.g. "Claude Opus 4.7,GPT-5.5,Gemini 3"). Names or ids both work.'),
     input_tokens_per_day: z.number().min(0).describe('Expected daily input token volume'),
     output_tokens_per_day: z.number().min(0).describe('Expected daily output token volume'),
@@ -456,7 +475,7 @@ server.tool('cost_projection', 'Project the cost of a token-usage workload acros
     };
 });
 // ── Tool: news_search (1 credit) ────────────────────────────────────
-server.tool('news_search', 'Full-text search over the TensorFeed news article corpus with optional date range, provider, and category filters. Relevance scoring with recency boost. Costs 1 credit.', {
+registerTool('news_search', 'Full-text search over the TensorFeed news article corpus with optional date range, provider, and category filters. Relevance scoring with recency boost. Costs 1 credit.', {
     q: z.string().optional().describe('Free-text query, e.g. "claude opus pricing". Omit to browse latest filtered articles.'),
     from: z.string().optional().describe('Start date YYYY-MM-DD UTC (inclusive)'),
     to: z.string().optional().describe('End date YYYY-MM-DD UTC (inclusive end-of-day)'),
@@ -494,7 +513,7 @@ server.tool('news_search', 'Full-text search over the TensorFeed news article co
     };
 });
 // ── Tool: list_watches ──────────────────────────────────────────────
-server.tool('list_watches', 'List the active webhook watches owned by the configured TensorFeed token. Free, requires TENSORFEED_TOKEN.', {}, async () => {
+registerTool('list_watches', 'List the active webhook watches owned by the configured TensorFeed token. Free, requires TENSORFEED_TOKEN.', {}, async () => {
     const data = (await fetchJSON('/premium/watches', { auth: true }));
     if (data.count === 0) {
         return { content: [{ type: 'text', text: 'No active watches.' }] };
@@ -510,7 +529,7 @@ server.tool('list_watches', 'List the active webhook watches owned by the config
     return { content: [{ type: 'text', text: `${data.count} active watches:\n\n${rows}` }] };
 });
 // ── Tool: create_price_watch (1 credit) ─────────────────────────────
-server.tool('create_price_watch', 'Register a webhook watch on a model price change. Costs 1 credit. Watch lives 90 days. Each fire is an HMAC-signed POST to callback_url.', {
+registerTool('create_price_watch', 'Register a webhook watch on a model price change. Costs 1 credit. Watch lives 90 days. Each fire is an HMAC-signed POST to callback_url.', {
     model: z.string().describe('Model name (e.g. "Claude Opus 4.7")'),
     field: z.enum(['inputPrice', 'outputPrice', 'blended']).describe('Which price field to watch'),
     op: z.enum(['lt', 'gt', 'changes']).describe('Trigger: lt = below threshold, gt = above, changes = any change'),
@@ -535,7 +554,7 @@ server.tool('create_price_watch', 'Register a webhook watch on a model price cha
     };
 });
 // ── Tool: create_status_watch (1 credit) ────────────────────────────
-server.tool('create_status_watch', 'Register a webhook watch on a service status transition (e.g. anthropic becomes down). Costs 1 credit. Watch lives 90 days.', {
+registerTool('create_status_watch', 'Register a webhook watch on a service status transition (e.g. anthropic becomes down). Costs 1 credit. Watch lives 90 days.', {
     provider: z.string().describe('Provider name (e.g. anthropic, openai)'),
     op: z.enum(['becomes', 'changes']).describe('becomes = transitions to a specific value; changes = any transition'),
     value: z.enum(['operational', 'degraded', 'down']).optional().describe('Required when op is becomes'),
@@ -559,7 +578,7 @@ server.tool('create_status_watch', 'Register a webhook watch on a service status
     };
 });
 // ── Tool: create_digest_watch (1 credit) ────────────────────────────
-server.tool('create_digest_watch', 'Register a scheduled digest webhook that fires daily or weekly with a curated summary of pricing changes (regardless of whether anything dramatic happened). Costs 1 credit. Watch lives 90 days. Set-and-forget for agents that want a periodic snapshot without subscribing to realtime transitions.', {
+registerTool('create_digest_watch', 'Register a scheduled digest webhook that fires daily or weekly with a curated summary of pricing changes (regardless of whether anything dramatic happened). Costs 1 credit. Watch lives 90 days. Set-and-forget for agents that want a periodic snapshot without subscribing to realtime transitions.', {
     cadence: z.enum(['daily', 'weekly']).describe('How often the digest fires'),
     callback_url: z.string().describe('HTTPS URL to POST to when the digest fires'),
     secret: z.string().optional().describe('Optional HMAC shared secret'),
@@ -581,14 +600,14 @@ server.tool('create_digest_watch', 'Register a scheduled digest webhook that fir
     };
 });
 // ── Tool: delete_watch ──────────────────────────────────────────────
-server.tool('delete_watch', 'Delete one of your active webhook watches by id. Free, requires TENSORFEED_TOKEN.', {
+registerTool('delete_watch', 'Delete one of your active webhook watches by id. Free, requires TENSORFEED_TOKEN.', {
     watch_id: z.string().describe('The wat_... id from create_price_watch / create_status_watch / list_watches'),
 }, async ({ watch_id }) => {
     await fetchJSON(`/premium/watches/${watch_id}`, { method: 'DELETE', auth: true });
     return { content: [{ type: 'text', text: `Deleted watch ${watch_id}.` }] };
 });
 // ── Tool: probe_latest (free) ───────────────────────────────────────
-server.tool('probe_latest', 'Last 24 hours of measured LLM endpoint latency and availability per provider (Anthropic, OpenAI, Google, Mistral, Cohere). TensorFeed pings each provider\'s chat completion endpoint every 15 min and records time-to-first-byte, total response time, and HTTP status. Returns per-provider success rate and ttfb/total p50/p95/p99 latency. The data is unique because we measure it ourselves, not self-reported by the providers. Useful when an agent needs to pick a provider whose SLA you can verify, or to detect ongoing incidents before they hit a status page. Free, no auth.', {}, async () => {
+registerTool('probe_latest', 'Last 24 hours of measured LLM endpoint latency and availability per provider (Anthropic, OpenAI, Google, Mistral, Cohere). TensorFeed pings each provider\'s chat completion endpoint every 15 min and records time-to-first-byte, total response time, and HTTP status. Returns per-provider success rate and ttfb/total p50/p95/p99 latency. The data is unique because we measure it ourselves, not self-reported by the providers. Useful when an agent needs to pick a provider whose SLA you can verify, or to detect ongoing incidents before they hit a status page. Free, no auth.', {}, async () => {
     const data = (await fetchJSON('/probe/latest'));
     const s = data.summary;
     if (s.providers.length === 0) {
@@ -614,7 +633,7 @@ server.tool('probe_latest', 'Last 24 hours of measured LLM endpoint latency and
     };
 });
 // ── Tool: probe_series (1 credit) ───────────────────────────────────
-server.tool('probe_series', 'Daily SLA series for one LLM provider, measured by TensorFeed. Returns per-day count, success rate, ttfb p50/p95/p99, total p50/p95/p99, and incident-hour count across the requested window. Provider status pages are politically managed; this is the measured truth. Pairs naturally with premium_routing for picking a model whose SLA you can verify. Costs 1 credit.', {
+registerTool('probe_series', 'Daily SLA series for one LLM provider, measured by TensorFeed. Returns per-day count, success rate, ttfb p50/p95/p99, total p50/p95/p99, and incident-hour count across the requested window. Provider status pages are politically managed; this is the measured truth. Pairs naturally with premium_routing for picking a model whose SLA you can verify. Costs 1 credit.', {
     provider: z.enum(['anthropic', 'openai', 'google', 'mistral', 'cohere']).describe('LLM provider key'),
     from: z.string().optional().describe('Inclusive start YYYY-MM-DD (default: 30 days before to)'),
     to: z.string().optional().describe('Inclusive end YYYY-MM-DD (default: today UTC)'),
@@ -645,7 +664,7 @@ server.tool('probe_series', 'Daily SLA series for one LLM provider, measured by
     };
 });
 // ── Tool: mcp_registry_snapshot (free) ──────────────────────────────
-server.tool('mcp_registry_snapshot', 'Today\'s summary of the official Model Context Protocol server registry. Returns total servers, by-status breakdown, top namespaces, and 1-day deltas (newly added, reactivated, deprecated). Captured daily at 9:30 AM UTC from registry.modelcontextprotocol.io. Useful when an agent wants to see how the MCP ecosystem is growing or detect freshly-deprecated servers it may be using. Free, no auth.', {}, async () => {
+registerTool('mcp_registry_snapshot', 'Today\'s summary of the official Model Context Protocol server registry. Returns total servers, by-status breakdown, top namespaces, and 1-day deltas (newly added, reactivated, deprecated). Captured daily at 9:30 AM UTC from registry.modelcontextprotocol.io. Useful when an agent wants to see how the MCP ecosystem is growing or detect freshly-deprecated servers it may be using. Free, no auth.', {}, async () => {
     const data = (await fetchJSON('/mcp/registry/snapshot'));
     const s = data.summary;
     const statusLine = Object.entries(s.by_status)
@@ -676,7 +695,7 @@ server.tool('mcp_registry_snapshot', 'Today\'s summary of the official Model Con
     };
 });
 // ── Tool: mcp_registry_series (1 credit) ────────────────────────────
-server.tool('mcp_registry_series', 'Multi-day series of MCP server registry growth and churn. Returns per-day total servers, active count, and daily added/removed counts across the requested window. The registry itself is open data, but a 30/90-day trend requires daily capture started weeks ago, which TensorFeed has been running. Costs 1 credit.', {
+registerTool('mcp_registry_series', 'Multi-day series of MCP server registry growth and churn. Returns per-day total servers, active count, and daily added/removed counts across the requested window. The registry itself is open data, but a 30/90-day trend requires daily capture started weeks ago, which TensorFeed has been running. Costs 1 credit.', {
     from: z.string().optional().describe('Inclusive start date YYYY-MM-DD (default: 30 days before to)'),
     to: z.string().optional().describe('Inclusive end date YYYY-MM-DD (default: today UTC)'),
 }, async ({ from, to }) => {

package/dist/sanitize.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Defense-in-depth output scrub for tool responses.
+ *
+ * The MCP server returns text from the TensorFeed worker into a host LLM
+ * (Claude Desktop, Cursor, Cline, Roo, etc). Any text we forward becomes
+ * untrusted input to that downstream model. The worker already runs
+ * sanitize.ts on its agent-facing endpoints, but this layer protects
+ * against:
+ *
+ *   1. New worker endpoints that forget the worker-side scrub
+ *   2. Future tools that aggregate or reformat upstream text
+ *   3. Drift between the worker's sanitization rules and what the MCP
+ *      server should consider safe
+ *
+ * The rule set mirrors worker/src/sanitize.ts:
+ *   - Strip ASCII control chars (preserves \n \r \t)
+ *   - Strip bidi controls and zero-width chars used in spoofing
+ *   - Neutralize role-confusion markers (ChatML / Llama / Mistral chat
+ *     tokens, jailbreak preamble lines, "ignore previous instructions")
+ *   - Collapse runs of whitespace
+ *
+ * No length cap is applied here. Tool output is conversational and may
+ * legitimately be tens of KB; upstream KV size limits already bound it.
+ */
+/**
+ * Scrub a single string for return to a host LLM. Idempotent and pure.
+ */
+export declare function sanitizeForLLM(input: string): string;
+/**
+ * Recursively scrub the `text` field of every text-content item in an
+ * MCP tool response. Non-text items (resources, images) pass through
+ * untouched. Returns a new content array; the input is not mutated.
+ */
+export declare function sanitizeToolResponse<T extends {
+    content: Array<{
+        type: string;
+        text?: string;
+        [k: string]: unknown;
+    }>;
+}>(response: T): T;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tensorfeed/mcp-server",
-  "version": "1.11.0",
+  "version": "1.12.0",
   "mcpName": "ai.tensorfeed/mcp-server",
   "description": "MCP server for TensorFeed.ai - AI news, status, model data, and premium endpoints (routing, cost projection, forecast, history series, news search, webhook watches with digest tier, enriched directory) for AI agents",
   "main": "dist/index.js",
@@ -19,13 +19,29 @@
     "build": "tsc",
     "start": "node dist/index.js"
   },
-  "keywords": ["mcp", "ai", "news", "tensorfeed", "model-context-protocol", "claude", "agents", "x402", "usdc", "base", "model-routing", "agent-payments"],
+  "keywords": [
+    "mcp",
+    "ai",
+    "news",
+    "tensorfeed",
+    "model-context-protocol",
+    "claude",
+    "agents",
+    "x402",
+    "usdc",
+    "base",
+    "model-routing",
+    "agent-payments"
+  ],
   "author": "TensorFeed.ai",
   "license": "MIT",
   "homepage": "https://tensorfeed.ai/developers",
   "repository": {
     "type": "git",
-    "url": "https://github.com/RipperMercs/tensorfeed"
+    "url": "https://github.com/RipperMercs/tensorfeed-mcp"
+  },
+  "bugs": {
+    "url": "https://github.com/RipperMercs/tensorfeed-mcp/issues"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.28.0",

package/server.json

@@ -3,19 +3,18 @@
   "name": "ai.tensorfeed/mcp-server",
   "title": "TensorFeed",
   "description": "AI news, model pricing, service status, and machine-payable premium tools. AFTA-certified.",
-  "version": "1.11.0",
+  "version": "1.12.0",
   "websiteUrl": "https://tensorfeed.ai/developers/agent-payments",
   "repository": {
-    "url": "https://github.com/RipperMercs/tensorfeed",
-    "source": "github",
-    "subfolder": "mcp-server"
+    "url": "https://github.com/RipperMercs/tensorfeed-mcp",
+    "source": "github"
   },
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@tensorfeed/mcp-server",
-      "version": "1.11.0",
+      "version": "1.12.0",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"