@tensorfeed/mcp-server 1.26.0 → 1.28.0

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to the [TensorFeed.ai MCP server](https://github.com/RipperMercs/tensorfeed-mcp). Free tools work without configuration; premium tools require a bearer token via the `TENSORFEED_TOKEN` env var. Buy credits at [tensorfeed.ai/developers/agent-payments](https://tensorfeed.ai/developers/agent-payments).
 
+## 1.28.0 - 2026-05-13
+
+### Added
+- `get_ai_supply_chain_iocs` (free): wraps `/api/security/ai-supply-chain-iocs.json`. Daily-refreshed list of GitHub Security Advisory entries filtered by AI/ML/LLM/MCP keyword vocabulary across npm, PyPI, Go, Maven, and other package ecosystems. Each row carries the package name, ecosystem, GHSA advisory ID, severity, summary, vulnerable version range, publication date, and the canonical GHSA URL. Optional `severity` and `ecosystem` filters; `limit` caps result count (default 25, max 100). Republish posture: TensorFeed re-publishes already-public advisories; the linked GHSA record is authoritative. Useful for MCP-server reviewers, AI-tool maintainers, and supply-chain monitors that want a single AI-relevant feed rather than parsing all of GHSA.
+
+Tool count: 45 -> 46. Lands the same security feed that caught the @mistralai npm worm on day 1, now reachable as an MCP tool for defenders running agentic supply-chain audits.
+
+## 1.27.0 - 2026-05-09
+
+### Added
+- `get_recent_earthquakes` (free): wraps `/api/climate/earthquakes`. USGS Earthquake Hazards Program pre-built summary feeds. Magnitude bucket (significant | 4.5 | 2.5 | 1.0 | all) crossed with period (hour | day | week | month). Returns id, magnitude, place, time, depth, lat/lon, tsunami flag, USGS detail URL. License: US Government public domain (17 USC §105).
+- `get_weather_alerts` (free, US-only): wraps `/api/climate/weather-alerts`. NWS Active Weather Alerts. Filter by 2-letter state, exact NWS event name, severity, urgency, status. Returns flattened alerts list with effective/expires windows and the canonical NWS web URL. License: US Government public domain.
+- `get_agent_opportunities` (free): wraps `/api/agents/opportunities`. Daily 13:30 UTC scan of new repositories across the AI agent ecosystem (Anthropic / OpenAI / Microsoft / ModelContextProtocol / HuggingFace / LangChain / frontier-lab orgs plus MCP, x402, agent-skills keyword sweeps and a vertical-pattern catch). Eleven signals deduped + composite-scored with per-signal MIN/MAX caps so smaller signals are never starved. Optional `signal` filter to one source.
+
+Tool count: 42 -> 45. Brings the stdio package up to parity with the new public-domain feeds and the daily agent-ecosystem scan that landed on the hosted HTTP transport this same day.
+
 ## 1.26.0 - 2026-05-09
 
 ### Added

package/dist/index.js

@@ -267,6 +267,62 @@ registerTool('get_agent_activity', 'Get live AI bot traffic on TensorFeed.ai. Re
         ],
     };
 });
+// ── Tool: get_ai_supply_chain_iocs ──────────────────────────────────
+registerTool('get_ai_supply_chain_iocs', 'Get the latest AI/ML supply-chain indicators-of-compromise from the TensorFeed defender feed. Daily-refreshed list of GitHub Security Advisory entries filtered by AI/ML/LLM/MCP keyword vocabulary across npm, PyPI, Go, Maven, and other ecosystems. Each entry includes the package name, ecosystem, GHSA advisory ID, severity, summary, vulnerable version range, publication date, and a link to the authoritative GHSA record. Pure data feed: TensorFeed re-publishes already-public advisories, does not detect malware, and does not attribute it. Always treat the linked GHSA record as authoritative. Useful for AI-tool maintainers, MCP-server reviewers, and supply-chain monitors that want a single feed of AI-relevant advisories rather than parsing all of GHSA.', {
+    severity: z
+        .enum(['critical', 'high', 'moderate', 'low'])
+        .optional()
+        .describe('Filter to a single GHSA severity tier'),
+    ecosystem: z
+        .string()
+        .optional()
+        .describe('Filter to a single package ecosystem (e.g. "npm", "pypi", "go", "maven")'),
+    limit: z
+        .number()
+        .min(1)
+        .max(100)
+        .optional()
+        .describe('Maximum number of advisories to return (default 25, max 100)'),
+}, async ({ severity, ecosystem, limit }) => {
+    const data = (await fetchJSON('/security/ai-supply-chain-iocs.json'));
+    const sevWanted = severity?.toLowerCase();
+    const ecoWanted = ecosystem?.toLowerCase();
+    const filtered = data.entries.filter((e) => {
+        if (sevWanted && e.severity.toLowerCase() !== sevWanted)
+            return false;
+        if (ecoWanted && e.package.ecosystem.toLowerCase() !== ecoWanted)
+            return false;
+        return true;
+    });
+    const cap = Math.min(limit ?? 25, 100);
+    const rows = filtered.slice(0, cap);
+    if (rows.length === 0) {
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: `No AI supply-chain IOCs matched (total in feed: ${data.total}, generated ${data.generated_at}).`,
+                },
+            ],
+        };
+    }
+    const body = rows
+        .map((e, i) => {
+        const kw = e.ai_relevance?.matched_keywords?.length
+            ? ` [matched: ${e.ai_relevance.matched_keywords.join(', ')}]`
+            : '';
+        return [
+            `${i + 1}. ${e.package.ecosystem}: ${e.package.name} (${e.severity.toUpperCase()})`,
+            `   ${e.summary}`,
+            `   GHSA: ${e.advisory_id}  ${e.url}`,
+            `   Affected: ${e.vulnerable_version_range}  Published: ${e.published_at}${kw}`,
+        ].join('\n');
+    })
+        .join('\n\n');
+    const header = `AI supply-chain IOCs (${rows.length} of ${filtered.length} matched, ${data.total} in feed, generated ${data.generated_at}):`;
+    const footer = `\n\nPosture: ${data.posture}`;
+    return { content: [{ type: 'text', text: `${header}\n\n${body}${footer}` }] };
+});
 // ════════════════════════════════════════════════════════════════════
 // PREMIUM TOOLS (require TENSORFEED_TOKEN env var, paid in USDC on Base)
 // ════════════════════════════════════════════════════════════════════
@@ -1180,6 +1236,105 @@ registerTool('get_hf_daily_papers', 'Hugging Face Daily Papers: editor-curated A
     return { content: [{ type: 'text', text }] };
 });
 // ── Tool: get_ai_ecosystem_today (free, composite) ──────────────────
+// ── Tool: get_recent_earthquakes (free) ─────────────────────────────
+registerTool('get_recent_earthquakes', "Recent earthquakes from the USGS Earthquake Hazards Program pre-built summary feeds. Choose a magnitude bucket (significant | 4.5 | 2.5 | 1.0 | all) and a time window (hour | day | week | month). Returns id, magnitude, place, time (ISO 8601), depth_km, longitude, latitude, tsunami flag, USGS detail URL. Upstream feeds refresh every minute. License: US Government public domain (17 USC §105). Free, no auth.", {
+    magnitude: z.enum(['significant', '4.5', '2.5', '1.0', 'all']).optional().describe('Magnitude bucket (default 4.5)'),
+    period: z.enum(['hour', 'day', 'week', 'month']).optional().describe('Time window (default day)'),
+    limit: z.number().min(1).max(50).optional().describe('Max earthquakes to render (default 15, max 50). Worker accepts up to 500 but text rendering caps lower.'),
+}, async ({ magnitude, period, limit }) => {
+    const params = new URLSearchParams();
+    params.set('magnitude', magnitude ?? '4.5');
+    params.set('period', period ?? 'day');
+    params.set('limit', String(Math.min(limit ?? 15, 50)));
+    const data = (await fetchJSON(`/climate/earthquakes?${params}`));
+    if (!data.ok || !data.earthquakes) {
+        return { content: [{ type: 'text', text: `USGS earthquakes unavailable: ${data.error ?? 'unknown error'}` }] };
+    }
+    const eqs = data.earthquakes;
+    const lines = eqs.map((q, i) => {
+        const mag = q.magnitude !== null ? `M${q.magnitude.toFixed(1)}` : 'M?';
+        const tsu = q.tsunami ? ' [tsunami flag]' : '';
+        const time = q.time ? q.time.slice(0, 19).replace('T', ' ') + ' UTC' : 'unknown time';
+        const depth = q.depth_km !== null ? `${q.depth_km.toFixed(0)}km deep` : 'depth unknown';
+        const coords = q.latitude !== null && q.longitude !== null ? ` (${q.latitude.toFixed(2)}, ${q.longitude.toFixed(2)})` : '';
+        return `${i + 1}. ${mag}  ${q.place ?? 'location unknown'}${coords}\n     ${time}, ${depth}${tsu}\n     ${q.url ?? ''}`;
+    }).join('\n\n');
+    const meta = data.feed_metadata;
+    const header = `USGS earthquakes (${data.query?.magnitude ?? '?'} / ${data.query?.period ?? '?'}). ${eqs.length} of ${meta?.upstream_count ?? '?'} returned.`;
+    return { content: [{ type: 'text', text: `${header}\n\n${lines || '  (no events in this window)'}\n\nSource: USGS Earthquake Hazards Program. Public domain (17 USC §105).` }] };
+});
+// ── Tool: get_weather_alerts (free, US only) ────────────────────────
+registerTool('get_weather_alerts', "Active US weather alerts from the National Weather Service. US-only. Filter by 2-letter state code (area), exact NWS event name, severity, urgency, status. Returns id, event, severity, urgency, headline, description, areaDesc, sent/effective/expires/ends, sender_name, web URL. Active alerts only — expired alerts fall off the upstream feed automatically. License: US Government public domain. Free, no auth.", {
+    area: z.string().regex(/^[A-Za-z]{2}$/).optional().describe('2-letter US state or territory code (CA, TX, PR, etc)'),
+    event: z.string().optional().describe('Exact NWS event name (e.g. "Tornado Warning", "Heat Advisory")'),
+    severity: z.enum(['Extreme', 'Severe', 'Moderate', 'Minor', 'Unknown']).optional().describe('Severity filter'),
+    urgency: z.enum(['Immediate', 'Expected', 'Future', 'Past', 'Unknown']).optional().describe('Urgency filter'),
+    status: z.enum(['actual', 'exercise', 'system', 'test', 'draft']).optional().describe('Status filter (default actual unfiltered)'),
+    limit: z.number().min(1).max(50).optional().describe('Max alerts to render (default 15, max 50). Worker accepts up to 500 but text rendering caps lower.'),
+}, async ({ area, event, severity, urgency, status, limit }) => {
+    const params = new URLSearchParams();
+    if (area)
+        params.set('area', area.toUpperCase());
+    if (event)
+        params.set('event', event);
+    if (severity)
+        params.set('severity', severity);
+    if (urgency)
+        params.set('urgency', urgency);
+    if (status)
+        params.set('status', status);
+    params.set('limit', String(Math.min(limit ?? 15, 50)));
+    const data = (await fetchJSON(`/climate/weather-alerts?${params}`));
+    if (!data.ok || !data.alerts) {
+        return { content: [{ type: 'text', text: `NWS weather alerts unavailable: ${data.error ?? 'unknown error'}` }] };
+    }
+    const alerts = data.alerts;
+    const lines = alerts.map((a, i) => {
+        const ev = a.event ?? 'unknown event';
+        const sev = a.severity ? `[${a.severity}]` : '';
+        const eff = a.effective ? a.effective.slice(0, 19).replace('T', ' ') + ' UTC' : '';
+        const exp = a.expires ? a.expires.slice(0, 19).replace('T', ' ') + ' UTC' : 'no expiry';
+        return `${i + 1}. ${sev} ${ev}\n     Where: ${a.area_desc ?? 'unspecified'}\n     ${a.headline ?? ''}\n     Effective: ${eff} → ${exp}\n     ${a.web ?? ''}`;
+    }).join('\n\n');
+    const filters = [];
+    if (area)
+        filters.push(`area=${area.toUpperCase()}`);
+    if (event)
+        filters.push(`event=${event}`);
+    if (severity)
+        filters.push(`severity=${severity}`);
+    const filterText = filters.length > 0 ? ` (${filters.join(', ')})` : '';
+    const header = `NWS active US weather alerts${filterText}. ${alerts.length} of ${data.feed_metadata?.upstream_count ?? '?'} returned.`;
+    return { content: [{ type: 'text', text: `${header}\n\n${lines || '  (no active alerts matching filters)'}\n\nSource: api.weather.gov. Public domain (17 USC §105). US-only coverage.` }] };
+});
+// ── Tool: get_agent_opportunities (free) ────────────────────────────
+registerTool('get_agent_opportunities', "TensorFeed's daily scan of new repositories across the AI agent ecosystem (Anthropic, OpenAI, Microsoft, ModelContextProtocol, HuggingFace, LangChain, frontier-lab orgs) plus recent MCP, x402, and skill keyword sweeps. Eleven signals total, deduped + composite-scored (signal_weight × log10(stars+1) × recency decay) with per-signal MIN/MAX caps so smaller signals are never starved. Refreshed daily at 13:30 UTC. Useful for surfacing distribution targets, integration ideas, or a daily brief on what's launching across the agent space. Free, no auth.", {
+    signal: z.enum([
+        'anthropic-org', 'openai-org', 'microsoft-org', 'mcp-org', 'huggingface-org',
+        'langchain-org', 'frontier-labs', 'mcp-keyword', 'x402-keyword', 'skill-keyword',
+        'vertical-pattern',
+    ]).optional().describe('Filter to one signal source. Omit to get the cross-signal ranked top-N.'),
+    limit: z.number().min(1).max(25).optional().describe('Max opportunities to render (default 10, max 25)'),
+}, async ({ signal, limit }) => {
+    const data = (await fetchJSON('/agents/opportunities'));
+    if (data.error) {
+        return { content: [{ type: 'text', text: `Agent opportunities unavailable: ${data.error}` }] };
+    }
+    const all = data.opportunities ?? [];
+    const filtered = signal ? all.filter(o => o.signal === signal) : all;
+    const cap = Math.min(limit ?? 10, 25);
+    const top = filtered.slice(0, cap);
+    const lines = top.map((o, i) => {
+        const updated = o.updated_at ? o.updated_at.slice(0, 10) : '';
+        const desc = o.description ? `\n     ${o.description.length > 140 ? o.description.slice(0, 140) + '...' : o.description}` : '';
+        return `${i + 1}. [${o.signal}] ${o.full_name}  ${o.stars.toLocaleString()}★, score ${o.composite_score.toFixed(1)}, updated ${updated}${desc}\n     ${o.html_url}`;
+    }).join('\n\n');
+    const filt = signal ? ` filtered to ${signal}` : '';
+    const header = `Agent ecosystem opportunities for ${data.date ?? 'today'}${filt}. ${top.length} of ${filtered.length} (total snapshot: ${data.total_opportunities ?? all.length}).`;
+    const bySignal = data.summary?.by_signal ? Object.entries(data.summary.by_signal).map(([k, v]) => `${k}=${v}`).join(', ') : '';
+    const sig = bySignal ? `\nBy signal: ${bySignal}` : '';
+    return { content: [{ type: 'text', text: `${header}${sig}\n\n${lines || '  (no opportunities returned)'}\n\nSource: TensorFeed daily GitHub scan via the public Search API.` }] };
+});
 // Single fetch to /api/today which fans out worker-side. The previous
 // implementation made 9 separate fetches per agent invocation; now
 // the worker's edge cache absorbs the load and serves one cached

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tensorfeed/mcp-server",
-  "version": "1.26.0",
+  "version": "1.28.0",
   "mcpName": "ai.tensorfeed/mcp-server",
   "description": "MCP server for TensorFeed.ai - AI news, status, model data, and premium endpoints (routing, cost projection, forecast, history series, news search, webhook watches with digest tier, enriched directory) for AI agents",
   "main": "dist/index.js",

package/server.json

@@ -3,7 +3,7 @@
   "name": "ai.tensorfeed/mcp-server",
   "title": "TensorFeed",
   "description": "AI news, model pricing, service status, and machine-payable premium tools. AFTA-certified.",
-  "version": "1.26.0",
+  "version": "1.27.0",
   "websiteUrl": "https://tensorfeed.ai/developers/agent-payments",
   "repository": {
     "url": "https://github.com/RipperMercs/tensorfeed-mcp",
@@ -20,7 +20,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@tensorfeed/mcp-server",
-      "version": "1.26.0",
+      "version": "1.27.0",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"
@@ -59,6 +59,9 @@
         "get_openrouter_models",
         "get_hf_daily_papers",
         "get_ai_ecosystem_today",
+        "get_recent_earthquakes",
+        "get_weather_alerts",
+        "get_agent_opportunities",
         "pricing_series_free",
         "benchmark_series_free",
         "status_uptime_free",