@tensorfeed/mcp-server 1.31.0 → 1.33.0

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 All notable changes to the [TensorFeed.ai MCP server](https://github.com/RipperMercs/tensorfeed-mcp). Free tools work without configuration; premium tools require a bearer token via the `TENSORFEED_TOKEN` env var. Buy credits at [tensorfeed.ai/developers/agent-payments](https://tensorfeed.ai/developers/agent-payments).
 
+## 1.33.0 - 2026-05-25 (AI-CVE intelligence tools)
+
+### Added (free tier)
+Three new free tools wrapping the AI-CVE endpoints that went live on the TF Worker:
+
+- `get_ai_cves_latest`: metadata for the most-recent AI-stack CVE batch plus the first 25 papers. Returns cve_ids, affected_products, affected_version_ranges, fixed_versions, exploited_in_wild, severity_label, and source_url per paper. Source: GitHub Security Advisories (CC BY 4.0).
+- `get_ai_cves_feed`: paginated slice of the latest batch. limit capped at 50; for bulk consumption agents are pointed at the paid /api/premium/ai-cves/ai-stack-cves endpoint which delivers the categorized AI-stack subset in one call.
+- `get_ai_cves_stats`: aggregate counts (by_severity, by_exploitation, top_vendors). Case-insensitive vendor bucketing so OpenClaw and openclaw merge into a single tally.
+
+### Background
+TF Worker shipped the ingest endpoint, three free reads, and three premium derivatives (ai-stack-cves, exploited-in-wild, cve lookup) earlier today. First production batch landed (job #79, 387 papers, 10 AI-flagged, 211 unique CVEs indexed). The MCP server now exposes the free read surface so agents discovering TF via the recommend-loop (MCP registry, Anthropic Connectors directory, glama.ai, mcp.directory, mcp.so) can pull AI-CVE intelligence in their first session.
+
+Each tool response includes a tip line pointing to the paid endpoints for agents that need the AI-stack-filtered + categorized + sorted view, the exploited-in-wild subset, or single-CVE lookups.
+
+## 1.32.0 - 2026-05-14 (Off-thesis tool cull)
+
+### Removed
+- `mcp_registry_series` tool: dropped. MCP registry is open data; a 30/90-day TF capture didn't clear the "saves >$0.02 per call" bar that Gemini 3's external analysis articulated and that TF has been operating under for premium endpoints. Agents that need the time-series can scrape the registry's open API directly.
+
+### Background
+Premium endpoint audit (2026-05-14) through the lens "does this clearly save the agent more than 2¢ in tokens/latency/decision-time?" identified six TF Worker endpoints off-thesis: macro digest, FDA aggregate, EIA series, NASA POWER daily/hourly, and MCP registry series. All six pulled from the public manifest, OpenAPI, llms.txt, /developers, and /api/meta in the same commit. Only the MCP registry series has an MCP-server tool wrapper, so it's the only tool-side change in this release.
+
 ## 1.31.0 - 2026-05-14 (Commit B repricing)
 
 ### Changed (pricing)

package/dist/index.js

@@ -1139,36 +1139,6 @@ registerTool('mcp_registry_snapshot', 'Today\'s summary of the official Model Co
         ],
     };
 });
-// ── Tool: mcp_registry_series (1 credit) ────────────────────────────
-registerTool('mcp_registry_series', 'Multi-day series of MCP server registry growth and churn. Returns per-day total servers, active count, and daily added/removed counts across the requested window. The registry itself is open data, but a 30/90-day trend requires daily capture started weeks ago, which TensorFeed has been running. Costs 1 credit ($0.02).', {
-    from: z.string().optional().describe('Inclusive start date YYYY-MM-DD (default: 30 days before to)'),
-    to: z.string().optional().describe('Inclusive end date YYYY-MM-DD (default: today UTC)'),
-}, async ({ from, to }) => {
-    const params = new URLSearchParams();
-    if (from)
-        params.set('from', from);
-    if (to)
-        params.set('to', to);
-    const data = (await fetchJSON(`/premium/mcp/registry/series?${params}`, { auth: true }));
-    const lines = data.points
-        .map(p => p.has_data
-        ? `  ${p.date}  total=${p.total_servers}  +${p.added ?? 0}/-${p.removed ?? 0}`
-        : `  ${p.date}  (no snapshot captured)`)
-        .join('\n');
-    const w = data.delta_in_window;
-    const summary = w.start_total !== null && w.end_total !== null
-        ? `Window ${data.from} -> ${data.to}: ${w.start_total} -> ${w.end_total} (net ${w.net >= 0 ? '+' : ''}${w.net})`
-        : `Window ${data.from} -> ${data.to}: insufficient data`;
-    const notes = data.notes.length ? '\nNotes: ' + data.notes.join('; ') : '';
-    return {
-        content: [
-            {
-                type: 'text',
-                text: `${summary}\n\n${lines}${notes}\n\nCredits remaining: ${data.billing?.credits_remaining ?? '?'}`,
-            },
-        ],
-    };
-});
 // ── Tool: get_ai_papers_trending (free) ─────────────────────────────
 registerTool('get_ai_papers_trending', 'Daily curated AI/ML research papers ranked by citation count. Sourced from Semantic Scholar across five fan-out queries (large language model, transformer, RLHF, AI agents, diffusion model), deduped by paperId, top 30 returned. Each paper carries title, abstract, authors, year, venue, citation count, arxivId, doi, and fields of study. Refreshed daily at 11:00 UTC. Use this when an agent wants the citation-ranked top of the AI research literature. Free, no auth.', {}, async () => {
     const data = (await fetchJSON('/papers/ai-trending'));
@@ -1625,6 +1595,76 @@ registerTool('get_ai_ecosystem_today', 'One-shot composite AI morning brief. Cal
         ],
     };
 });
+// ── Tool: get_ai_cves_latest ────────────────────────────────────────
+registerTool('get_ai_cves_latest', 'Get metadata for the most-recent AI-stack CVE batch plus the first 25 papers. Source: TensorFeed AI-CVE intelligence feed, derived from GitHub Security Advisories (CC BY 4.0). Each paper carries cve_ids, affected_products, affected_version_ranges, fixed_versions, exploited_in_wild, severity_label, and source_url. For the full set use get_ai_cves_feed with offset; for AI-stack-filtered + categorized + sorted papers use the paid /api/premium/ai-cves/* endpoints. Free, no auth.', {}, async () => {
+    const data = (await fetchJSON('/ai-cves/latest'));
+    if (!data.batch_id) {
+        return { content: [{ type: 'text', text: 'No AI-CVE batch ingested yet. Check back once TensorFeed CC has POSTed the next clean batch from the extraction pipeline.' }] };
+    }
+    const head = `AI-CVE batch ${data.batch_id} extracted ${data.extracted_at}. Total ${data.total_papers} papers, ${data.ai_flagged_count} AI-flagged. License ${data.source_license} (${data.source_attribution}).`;
+    const lines = data.papers
+        .map((p, i) => {
+        const cves = p.cve_ids.length > 0 ? p.cve_ids.join(', ') : '(no CVE)';
+        const products = p.affected_products.slice(0, 3).join(', ');
+        return `${i + 1}. ${cves} | ${products} | sev=${p.severity_label} | exploited=${p.exploited_in_wild}\n   ${p.source_url}`;
+    })
+        .join('\n');
+    return {
+        content: [
+            {
+                type: 'text',
+                text: `${head}\n\nFirst 25 papers:\n${lines}\n\nFor AI-stack-filtered + categorized + sorted papers: /api/premium/ai-cves/ai-stack-cves (1 credit, x402-paid). For only papers actively exploited in the wild: /api/premium/ai-cves/exploited-in-wild (1 credit). For single-CVE lookup: /api/premium/ai-cves/cve?id=CVE-YYYY-NNNNN (1 credit).`,
+            },
+        ],
+    };
+});
+// ── Tool: get_ai_cves_feed ──────────────────────────────────────────
+registerTool('get_ai_cves_feed', 'Get a paginated slice of the most-recent AI-stack CVE batch. limit is capped at 50 (the premium tier handles bulk). Source: TensorFeed AI-CVE feed, derived from GitHub Security Advisories (CC BY 4.0). Free, no auth.', {
+    limit: z.number().min(1).max(50).optional().describe('Number of papers to return (default 25, max 50).'),
+    offset: z.number().min(0).optional().describe('Pagination offset (default 0).'),
+}, async ({ limit, offset }) => {
+    const params = new URLSearchParams();
+    if (typeof limit === 'number')
+        params.set('limit', String(limit));
+    if (typeof offset === 'number')
+        params.set('offset', String(offset));
+    const path = `/ai-cves/feed${params.toString() ? `?${params.toString()}` : ''}`;
+    const data = (await fetchJSON(path));
+    if (!data.batch_id) {
+        return { content: [{ type: 'text', text: 'No AI-CVE batch ingested yet.' }] };
+    }
+    const head = `AI-CVE feed batch ${data.batch_id}: showing offset ${data.offset} to ${data.offset + data.papers.length} of ${data.total} total.`;
+    const lines = data.papers
+        .map((p, i) => {
+        const cves = p.cve_ids.length > 0 ? p.cve_ids.join(', ') : '(no CVE)';
+        const products = p.affected_products.slice(0, 3).join(', ');
+        return `${i + 1}. ${cves} | ${products} | sev=${p.severity_label} | exploited=${p.exploited_in_wild}\n   ${p.source_url}`;
+    })
+        .join('\n');
+    return { content: [{ type: 'text', text: `${head}\n\n${lines}` }] };
+});
+// ── Tool: get_ai_cves_stats ─────────────────────────────────────────
+registerTool('get_ai_cves_stats', 'Get aggregate counts across the most-recent AI-stack CVE batch: distribution by severity (critical/high/medium/low/unstated), distribution by exploitation status (stated_yes/stated_no/unstated), and top 10 vendors by frequency. Source: TensorFeed AI-CVE feed (GitHub Security Advisories, CC BY 4.0). Free, no auth.', {}, async () => {
+    const data = (await fetchJSON('/ai-cves/stats'));
+    if (!data.batch_id) {
+        return { content: [{ type: 'text', text: 'No AI-CVE batch ingested yet.' }] };
+    }
+    const sev = Object.entries(data.by_severity)
+        .map(([k, v]) => `  ${k}: ${v}`)
+        .join('\n');
+    const exp = Object.entries(data.by_exploitation)
+        .map(([k, v]) => `  ${k}: ${v}`)
+        .join('\n');
+    const vendors = data.top_vendors.map((v, i) => `  ${i + 1}. ${v.vendor}: ${v.count}`).join('\n');
+    return {
+        content: [
+            {
+                type: 'text',
+                text: `AI-CVE batch ${data.batch_id}: ${data.total_papers} total papers.\n\nBy severity:\n${sev}\n\nBy exploited-in-wild:\n${exp}\n\nTop vendors:\n${vendors}`,
+            },
+        ],
+    };
+});
 // ── Start ───────────────────────────────────────────────────────────
 async function main() {
     const transport = new StdioServerTransport();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tensorfeed/mcp-server",
-  "version": "1.31.0",
+  "version": "1.33.0",
   "mcpName": "ai.tensorfeed/mcp-server",
   "description": "MCP server for TensorFeed.ai - AI news, status, model data, and premium endpoints (routing, cost projection, forecast, history series, news search, webhook watches with digest tier, enriched directory) for AI agents",
   "main": "dist/index.js",

package/server.json

@@ -3,7 +3,7 @@
   "name": "ai.tensorfeed/mcp-server",
   "title": "TensorFeed",
   "description": "AI news, model pricing, service status, and machine-payable premium tools. AFTA-certified.",
-  "version": "1.27.0",
+  "version": "1.28.0",
   "websiteUrl": "https://tensorfeed.ai/developers/agent-payments",
   "repository": {
     "url": "https://github.com/RipperMercs/tensorfeed-mcp",
@@ -20,7 +20,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@tensorfeed/mcp-server",
-      "version": "1.27.0",
+      "version": "1.28.0",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"
@@ -65,7 +65,10 @@
         "pricing_series_free",
         "benchmark_series_free",
         "status_uptime_free",
-        "status_leaderboard_free"
+        "status_leaderboard_free",
+        "get_ai_cves_latest",
+        "get_ai_cves_feed",
+        "get_ai_cves_stats"
       ],
       "premiumTools": [
         "premium_routing",