@tensorfeed/mcp-server 1.27.0 → 1.28.0

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to the [TensorFeed.ai MCP server](https://github.com/RipperMercs/tensorfeed-mcp). Free tools work without configuration; premium tools require a bearer token via the `TENSORFEED_TOKEN` env var. Buy credits at [tensorfeed.ai/developers/agent-payments](https://tensorfeed.ai/developers/agent-payments).
 
+## 1.28.0 - 2026-05-13
+
+### Added
+- `get_ai_supply_chain_iocs` (free): wraps `/api/security/ai-supply-chain-iocs.json`. Daily-refreshed list of GitHub Security Advisory entries filtered by AI/ML/LLM/MCP keyword vocabulary across npm, PyPI, Go, Maven, and other package ecosystems. Each row carries the package name, ecosystem, GHSA advisory ID, severity, summary, vulnerable version range, publication date, and the canonical GHSA URL. Optional `severity` and `ecosystem` filters; `limit` caps result count (default 25, max 100). Republish posture: TensorFeed re-publishes already-public advisories; the linked GHSA record is authoritative. Useful for MCP-server reviewers, AI-tool maintainers, and supply-chain monitors that want a single AI-relevant feed rather than parsing all of GHSA.
+
+Tool count: 45 -> 46. Lands the same security feed that caught the @mistralai npm worm on day 1, now reachable as an MCP tool for defenders running agentic supply-chain audits.
+
 ## 1.27.0 - 2026-05-09
 
 ### Added

package/dist/index.js

@@ -267,6 +267,62 @@ registerTool('get_agent_activity', 'Get live AI bot traffic on TensorFeed.ai. Re
         ],
     };
 });
+// ── Tool: get_ai_supply_chain_iocs ──────────────────────────────────
+registerTool('get_ai_supply_chain_iocs', 'Get the latest AI/ML supply-chain indicators-of-compromise from the TensorFeed defender feed. Daily-refreshed list of GitHub Security Advisory entries filtered by AI/ML/LLM/MCP keyword vocabulary across npm, PyPI, Go, Maven, and other ecosystems. Each entry includes the package name, ecosystem, GHSA advisory ID, severity, summary, vulnerable version range, publication date, and a link to the authoritative GHSA record. Pure data feed: TensorFeed re-publishes already-public advisories, does not detect malware, and does not attribute it. Always treat the linked GHSA record as authoritative. Useful for AI-tool maintainers, MCP-server reviewers, and supply-chain monitors that want a single feed of AI-relevant advisories rather than parsing all of GHSA.', {
+    severity: z
+        .enum(['critical', 'high', 'moderate', 'low'])
+        .optional()
+        .describe('Filter to a single GHSA severity tier'),
+    ecosystem: z
+        .string()
+        .optional()
+        .describe('Filter to a single package ecosystem (e.g. "npm", "pypi", "go", "maven")'),
+    limit: z
+        .number()
+        .min(1)
+        .max(100)
+        .optional()
+        .describe('Maximum number of advisories to return (default 25, max 100)'),
+}, async ({ severity, ecosystem, limit }) => {
+    const data = (await fetchJSON('/security/ai-supply-chain-iocs.json'));
+    const sevWanted = severity?.toLowerCase();
+    const ecoWanted = ecosystem?.toLowerCase();
+    const filtered = data.entries.filter((e) => {
+        if (sevWanted && e.severity.toLowerCase() !== sevWanted)
+            return false;
+        if (ecoWanted && e.package.ecosystem.toLowerCase() !== ecoWanted)
+            return false;
+        return true;
+    });
+    const cap = Math.min(limit ?? 25, 100);
+    const rows = filtered.slice(0, cap);
+    if (rows.length === 0) {
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: `No AI supply-chain IOCs matched (total in feed: ${data.total}, generated ${data.generated_at}).`,
+                },
+            ],
+        };
+    }
+    const body = rows
+        .map((e, i) => {
+        const kw = e.ai_relevance?.matched_keywords?.length
+            ? ` [matched: ${e.ai_relevance.matched_keywords.join(', ')}]`
+            : '';
+        return [
+            `${i + 1}. ${e.package.ecosystem}: ${e.package.name} (${e.severity.toUpperCase()})`,
+            `   ${e.summary}`,
+            `   GHSA: ${e.advisory_id}  ${e.url}`,
+            `   Affected: ${e.vulnerable_version_range}  Published: ${e.published_at}${kw}`,
+        ].join('\n');
+    })
+        .join('\n\n');
+    const header = `AI supply-chain IOCs (${rows.length} of ${filtered.length} matched, ${data.total} in feed, generated ${data.generated_at}):`;
+    const footer = `\n\nPosture: ${data.posture}`;
+    return { content: [{ type: 'text', text: `${header}\n\n${body}${footer}` }] };
+});
 // ════════════════════════════════════════════════════════════════════
 // PREMIUM TOOLS (require TENSORFEED_TOKEN env var, paid in USDC on Base)
 // ════════════════════════════════════════════════════════════════════

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tensorfeed/mcp-server",
-  "version": "1.27.0",
+  "version": "1.28.0",
   "mcpName": "ai.tensorfeed/mcp-server",
   "description": "MCP server for TensorFeed.ai - AI news, status, model data, and premium endpoints (routing, cost projection, forecast, history series, news search, webhook watches with digest tier, enriched directory) for AI agents",
   "main": "dist/index.js",