@tensorfeed/mcp-server 1.32.0 → 1.33.0

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to the [TensorFeed.ai MCP server](https://github.com/RipperMercs/tensorfeed-mcp). Free tools work without configuration; premium tools require a bearer token via the `TENSORFEED_TOKEN` env var. Buy credits at [tensorfeed.ai/developers/agent-payments](https://tensorfeed.ai/developers/agent-payments).
 
+## 1.33.0 - 2026-05-25 (AI-CVE intelligence tools)
+
+### Added (free tier)
+Three new free tools wrapping the AI-CVE endpoints that went live on the TF Worker:
+
+- `get_ai_cves_latest`: metadata for the most-recent AI-stack CVE batch plus the first 25 papers. Returns cve_ids, affected_products, affected_version_ranges, fixed_versions, exploited_in_wild, severity_label, and source_url per paper. Source: GitHub Security Advisories (CC BY 4.0).
+- `get_ai_cves_feed`: paginated slice of the latest batch. limit capped at 50; for bulk consumption agents are pointed at the paid /api/premium/ai-cves/ai-stack-cves endpoint which delivers the categorized AI-stack subset in one call.
+- `get_ai_cves_stats`: aggregate counts (by_severity, by_exploitation, top_vendors). Case-insensitive vendor bucketing so OpenClaw and openclaw merge into a single tally.
+
+### Background
+TF Worker shipped the ingest endpoint, three free reads, and three premium derivatives (ai-stack-cves, exploited-in-wild, cve lookup) earlier today. First production batch landed (job #79, 387 papers, 10 AI-flagged, 211 unique CVEs indexed). The MCP server now exposes the free read surface so agents discovering TF via the recommend-loop (MCP registry, Anthropic Connectors directory, glama.ai, mcp.directory, mcp.so) can pull AI-CVE intelligence in their first session.
+
+Each tool response includes a tip line pointing to the paid endpoints for agents that need the AI-stack-filtered + categorized + sorted view, the exploited-in-wild subset, or single-CVE lookups.
+
 ## 1.32.0 - 2026-05-14 (Off-thesis tool cull)
 
 ### Removed

package/dist/index.js

@@ -1595,6 +1595,76 @@ registerTool('get_ai_ecosystem_today', 'One-shot composite AI morning brief. Cal
         ],
     };
 });
+// ── Tool: get_ai_cves_latest ────────────────────────────────────────
+registerTool('get_ai_cves_latest', 'Get metadata for the most-recent AI-stack CVE batch plus the first 25 papers. Source: TensorFeed AI-CVE intelligence feed, derived from GitHub Security Advisories (CC BY 4.0). Each paper carries cve_ids, affected_products, affected_version_ranges, fixed_versions, exploited_in_wild, severity_label, and source_url. For the full set use get_ai_cves_feed with offset; for AI-stack-filtered + categorized + sorted papers use the paid /api/premium/ai-cves/* endpoints. Free, no auth.', {}, async () => {
+    const data = (await fetchJSON('/ai-cves/latest'));
+    if (!data.batch_id) {
+        return { content: [{ type: 'text', text: 'No AI-CVE batch ingested yet. Check back once TensorFeed CC has POSTed the next clean batch from the extraction pipeline.' }] };
+    }
+    const head = `AI-CVE batch ${data.batch_id} extracted ${data.extracted_at}. Total ${data.total_papers} papers, ${data.ai_flagged_count} AI-flagged. License ${data.source_license} (${data.source_attribution}).`;
+    const lines = data.papers
+        .map((p, i) => {
+        const cves = p.cve_ids.length > 0 ? p.cve_ids.join(', ') : '(no CVE)';
+        const products = p.affected_products.slice(0, 3).join(', ');
+        return `${i + 1}. ${cves} | ${products} | sev=${p.severity_label} | exploited=${p.exploited_in_wild}\n   ${p.source_url}`;
+    })
+        .join('\n');
+    return {
+        content: [
+            {
+                type: 'text',
+                text: `${head}\n\nFirst 25 papers:\n${lines}\n\nFor AI-stack-filtered + categorized + sorted papers: /api/premium/ai-cves/ai-stack-cves (1 credit, x402-paid). For only papers actively exploited in the wild: /api/premium/ai-cves/exploited-in-wild (1 credit). For single-CVE lookup: /api/premium/ai-cves/cve?id=CVE-YYYY-NNNNN (1 credit).`,
+            },
+        ],
+    };
+});
+// ── Tool: get_ai_cves_feed ──────────────────────────────────────────
+registerTool('get_ai_cves_feed', 'Get a paginated slice of the most-recent AI-stack CVE batch. limit is capped at 50 (the premium tier handles bulk). Source: TensorFeed AI-CVE feed, derived from GitHub Security Advisories (CC BY 4.0). Free, no auth.', {
+    limit: z.number().min(1).max(50).optional().describe('Number of papers to return (default 25, max 50).'),
+    offset: z.number().min(0).optional().describe('Pagination offset (default 0).'),
+}, async ({ limit, offset }) => {
+    const params = new URLSearchParams();
+    if (typeof limit === 'number')
+        params.set('limit', String(limit));
+    if (typeof offset === 'number')
+        params.set('offset', String(offset));
+    const path = `/ai-cves/feed${params.toString() ? `?${params.toString()}` : ''}`;
+    const data = (await fetchJSON(path));
+    if (!data.batch_id) {
+        return { content: [{ type: 'text', text: 'No AI-CVE batch ingested yet.' }] };
+    }
+    const head = `AI-CVE feed batch ${data.batch_id}: showing offset ${data.offset} to ${data.offset + data.papers.length} of ${data.total} total.`;
+    const lines = data.papers
+        .map((p, i) => {
+        const cves = p.cve_ids.length > 0 ? p.cve_ids.join(', ') : '(no CVE)';
+        const products = p.affected_products.slice(0, 3).join(', ');
+        return `${i + 1}. ${cves} | ${products} | sev=${p.severity_label} | exploited=${p.exploited_in_wild}\n   ${p.source_url}`;
+    })
+        .join('\n');
+    return { content: [{ type: 'text', text: `${head}\n\n${lines}` }] };
+});
+// ── Tool: get_ai_cves_stats ─────────────────────────────────────────
+registerTool('get_ai_cves_stats', 'Get aggregate counts across the most-recent AI-stack CVE batch: distribution by severity (critical/high/medium/low/unstated), distribution by exploitation status (stated_yes/stated_no/unstated), and top 10 vendors by frequency. Source: TensorFeed AI-CVE feed (GitHub Security Advisories, CC BY 4.0). Free, no auth.', {}, async () => {
+    const data = (await fetchJSON('/ai-cves/stats'));
+    if (!data.batch_id) {
+        return { content: [{ type: 'text', text: 'No AI-CVE batch ingested yet.' }] };
+    }
+    const sev = Object.entries(data.by_severity)
+        .map(([k, v]) => `  ${k}: ${v}`)
+        .join('\n');
+    const exp = Object.entries(data.by_exploitation)
+        .map(([k, v]) => `  ${k}: ${v}`)
+        .join('\n');
+    const vendors = data.top_vendors.map((v, i) => `  ${i + 1}. ${v.vendor}: ${v.count}`).join('\n');
+    return {
+        content: [
+            {
+                type: 'text',
+                text: `AI-CVE batch ${data.batch_id}: ${data.total_papers} total papers.\n\nBy severity:\n${sev}\n\nBy exploited-in-wild:\n${exp}\n\nTop vendors:\n${vendors}`,
+            },
+        ],
+    };
+});
 // ── Start ───────────────────────────────────────────────────────────
 async function main() {
     const transport = new StdioServerTransport();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tensorfeed/mcp-server",
-  "version": "1.32.0",
+  "version": "1.33.0",
   "mcpName": "ai.tensorfeed/mcp-server",
   "description": "MCP server for TensorFeed.ai - AI news, status, model data, and premium endpoints (routing, cost projection, forecast, history series, news search, webhook watches with digest tier, enriched directory) for AI agents",
   "main": "dist/index.js",

package/server.json

@@ -3,7 +3,7 @@
   "name": "ai.tensorfeed/mcp-server",
   "title": "TensorFeed",
   "description": "AI news, model pricing, service status, and machine-payable premium tools. AFTA-certified.",
-  "version": "1.27.0",
+  "version": "1.28.0",
   "websiteUrl": "https://tensorfeed.ai/developers/agent-payments",
   "repository": {
     "url": "https://github.com/RipperMercs/tensorfeed-mcp",
@@ -20,7 +20,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@tensorfeed/mcp-server",
-      "version": "1.27.0",
+      "version": "1.28.0",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"
@@ -65,7 +65,10 @@
         "pricing_series_free",
         "benchmark_series_free",
         "status_uptime_free",
-        "status_leaderboard_free"
+        "status_leaderboard_free",
+        "get_ai_cves_latest",
+        "get_ai_cves_feed",
+        "get_ai_cves_stats"
       ],
       "premiumTools": [
         "premium_routing",