@tensorfeed/mcp-server 1.35.0 → 1.36.1

package/CHANGELOG.md

@@ -2,6 +2,46 @@
 
 All notable changes to the [TensorFeed.ai MCP server](https://github.com/RipperMercs/tensorfeed-mcp). Free tools work without configuration; premium tools require a bearer token via the `TENSORFEED_TOKEN` env var. Buy credits at [tensorfeed.ai/developers/agent-payments](https://tensorfeed.ai/developers/agent-payments).
 
+## 1.36.1 - 2026-05-31
+
+Security hardening only. No API changes; agents see the same tools.
+
+- The `latest_news` resource output is now sanitized like every tool
+  output, so external RSS titles cannot carry prompt-injection markers
+  to the model.
+- Tool output is capped at 40000 characters and the x402 publishers and
+  agent reputation renderers are bounded, so a large upstream response
+  cannot overflow the agent's context window.
+- Path parameters (watch id, company ticker) are now URL-encoded and
+  schema-validated before they reach a request path.
+- Reconciled the stated credit cost on the free pricing, benchmark, and
+  status series pointers (they correctly read 2 credits now).
+
+## 1.36.0 - 2026-05-28
+
+Adds 6 tools wrapping the x402 settlement index endpoints (Wave 20)
+that shipped earlier today as the first-mover ecosystem-level index
+of x402 USDC settlements on Base mainnet.
+
+Free tools:
+- `get_x402_summary`: ecosystem-level rollup across 24h/7d/30d window.
+- `get_x402_publishers`: canonical list of x402-compliant publishers
+  TensorFeed is currently indexing, auto-discovered from
+  /.well-known/x402.json crawls.
+- `get_x402_leaderboard`: top publishers by volume in the window.
+- `get_x402_recent`: most recent settlement events newest-first.
+
+Premium tools (1 credit, AFTA-signed):
+- `premium_x402_publisher_receipts`: per-publisher feed with daily
+  series + avg_amount + attribution.
+- `premium_x402_series`: time-series of ecosystem or per-publisher
+  volume / count across a date range.
+
+Each premium tool's description includes an explicit VS FREE
+differentiator (per the upsell-copy memory): Anthropic-side LLMs
+repeat tool descriptions verbatim when deciding whether to recommend
+paying.
+
 ## 1.33.0 - 2026-05-25 (AI-CVE intelligence tools, unified versioning)
 
 Versions across npm + MCP Registry + MCPB manifest are now all 1.33.0

package/dist/index.js

@@ -5,8 +5,13 @@ import { z } from 'zod';
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
-import { sanitizeToolResponse } from './sanitize.js';
+import { sanitizeToolResponse, sanitizeForLLM } from './sanitize.js';
 const API_BASE = 'https://tensorfeed.ai/api';
+// Per-request upstream timeout. fetchJSON is the single HTTP helper behind every
+// MCP tool and the latest_news resource, so a missing timeout would let one
+// stalled upstream hang an agent's tool call. 20s is generous for the slowest
+// premium endpoint while still failing fast on a genuine stall.
+const REQUEST_TIMEOUT_MS = 20000;
 const pkgPath = join(dirname(fileURLToPath(import.meta.url)), '..', 'package.json');
 const SDK_VERSION = JSON.parse(readFileSync(pkgPath, 'utf-8')).version;
 async function fetchJSON(path, opts = {}) {
@@ -23,11 +28,28 @@ async function fetchJSON(path, opts = {}) {
         }
         headers['Authorization'] = `Bearer ${token}`;
     }
-    const res = await fetch(`${API_BASE}${path}`, {
-        method: opts.method ?? 'GET',
-        headers,
-        ...(opts.body !== undefined ? { body: JSON.stringify(opts.body) } : {}),
-    });
+    // Bound every request with a timeout so a stalled upstream (TLS or connect
+    // hang, slow Worker, KV or origin stall) cannot hang the agent's tool call
+    // indefinitely. An aborted fetch surfaces as a clean Error below instead of
+    // an open-ended await.
+    let res;
+    try {
+        res = await fetch(`${API_BASE}${path}`, {
+            method: opts.method ?? 'GET',
+            headers,
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+            ...(opts.body !== undefined ? { body: JSON.stringify(opts.body) } : {}),
+        });
+    }
+    catch (err) {
+        // AbortSignal.timeout fires a TimeoutError (DOMException name 'TimeoutError');
+        // a manual abort surfaces as 'AbortError'. Either way, rethrow a clean Error
+        // so it reaches the agent as a normal MCP tool error rather than a raw abort.
+        if (err instanceof Error && (err.name === 'TimeoutError' || err.name === 'AbortError')) {
+            throw new Error(`TensorFeed upstream request timed out after ${REQUEST_TIMEOUT_MS / 1000}s`);
+        }
+        throw err;
+    }
     if (!res.ok) {
         let errPayload;
         try {
@@ -129,6 +151,17 @@ server.registerResource('latest_news', 'tensorfeed://news/latest', {
     mimeType: 'application/json',
 }, async (uri) => {
     const data = (await fetchJSON('/news?limit=20'));
+    // This resource is registered directly on the SDK, NOT through the
+    // registerTool wrapper, so its payload does not pass through
+    // sanitizeToolResponse. Scrub the external RSS title/snippet/source
+    // fields here so untrusted article text gets the same role-confusion
+    // and control-char scrub every tool output gets.
+    const articles = data.articles.map((a) => ({
+        ...a,
+        title: sanitizeForLLM(a.title),
+        snippet: sanitizeForLLM(a.snippet),
+        source: sanitizeForLLM(a.source),
+    }));
     return {
         contents: [
             {
@@ -137,8 +170,8 @@ server.registerResource('latest_news', 'tensorfeed://news/latest', {
                 text: JSON.stringify({
                     source: 'TensorFeed.ai',
                     fetched_at: new Date().toISOString(),
-                    count: data.articles.length,
-                    articles: data.articles,
+                    count: articles.length,
+                    articles,
                 }, null, 2),
             },
         ],
@@ -464,14 +497,27 @@ registerTool('get_agent_reputation_card', 'Get a TensorFeed Agent Reputation Bur
         }
         throw e;
     }
-    // The card schema is rich; render the highlights deterministically and
-    // include the raw JSON so the agent can reason over any field it needs.
-    const card = data.card ?? data;
+    // The card schema is rich; select the documented top-level fields and
+    // clamp any array so a large or inflated upstream card cannot blow the
+    // agent's context. Unknown fields still pass through (so the agent can
+    // reason over them) but every array is capped and the whole payload is
+    // bounded by the downstream sanitize char cap as a backstop.
+    const rawCard = data.card ?? data;
+    const MAX_CARD_ARRAY = 25;
+    const clamped = {};
+    for (const [k, v] of Object.entries(rawCard)) {
+        if (Array.isArray(v) && v.length > MAX_CARD_ARRAY) {
+            clamped[k] = [...v.slice(0, MAX_CARD_ARRAY), `...[${v.length - MAX_CARD_ARRAY} more omitted]`];
+        }
+        else {
+            clamped[k] = v;
+        }
+    }
     return {
         content: [
             {
                 type: 'text',
-                text: `Agent reputation card for ${wallet ?? `token_prefix=${token_prefix}`}:\n\n${JSON.stringify(card, null, 2)}`,
+                text: `Agent reputation card for ${wallet ?? `token_prefix=${token_prefix}`}:\n\n${JSON.stringify(clamped, null, 2)}`,
             },
         ],
     };
@@ -539,7 +585,7 @@ registerTool('premium_routing', 'Get a ranked list of recommended AI models for
     return { content: [{ type: 'text', text: `Routing for "${data.task}":\n\n${list}${billing}` }] };
 });
 // ── Tool: pricing_series_free (free, 7-day cap) ─────────────────────
-registerTool('pricing_series_free', 'Daily price points for one AI model over the last 1 to 7 days, free. For windows up to 90 days use pricing_series (1 credit).', {
+registerTool('pricing_series_free', 'Daily price points for one AI model over the last 1 to 7 days, free. For windows up to 90 days use pricing_series (2 credits).', {
     model: z.string().describe('Model id or display name (e.g. "Claude Opus 4.7" or "claude-opus-4-7")'),
     days: z.number().min(1).max(7).optional().describe('Rolling window length 1 to 7 days (default 7)'),
 }, async ({ model, days }) => {
@@ -555,13 +601,13 @@ registerTool('pricing_series_free', 'Daily price points for one AI model over th
         content: [
             {
                 type: 'text',
-                text: `${data.model} (${data.provider ?? 'unknown'}) ${data.points.length} points over ${data.points.length} days\n${summary}\nFor up to 90 days, use the pricing_series tool (1 credit).`,
+                text: `${data.model} (${data.provider ?? 'unknown'}) ${data.points.length} points over ${data.points.length} days\n${summary}\nFor up to 90 days, use the pricing_series tool (2 credits).`,
             },
         ],
     };
 });
 // ── Tool: benchmark_series_free (free, 7-day cap) ───────────────────
-registerTool('benchmark_series_free', 'Daily benchmark scores for one model+benchmark over the last 1 to 7 days, free. Benchmark keys: swe_bench, mmlu_pro, gpqa_diamond, math, human_eval. For windows up to 90 days use benchmark_series (1 credit).', {
+registerTool('benchmark_series_free', 'Daily benchmark scores for one model+benchmark over the last 1 to 7 days, free. Benchmark keys: swe_bench, mmlu_pro, gpqa_diamond, math, human_eval. For windows up to 90 days use benchmark_series (2 credits).', {
     model: z.string().describe('Model id or display name'),
     benchmark: z.string().describe('Benchmark key'),
     days: z.number().min(1).max(7).optional().describe('Rolling window length 1 to 7 days (default 7)'),
@@ -584,7 +630,7 @@ registerTool('benchmark_series_free', 'Daily benchmark scores for one model+benc
     };
 });
 // ── Tool: status_uptime_free (free, 7-day cap) ──────────────────────
-registerTool('status_uptime_free', 'Daily uptime rollup for one provider over the last 1 to 7 days, free. For windows up to 90 days use status_uptime (1 credit).', {
+registerTool('status_uptime_free', 'Daily uptime rollup for one provider over the last 1 to 7 days, free. For windows up to 90 days use status_uptime (2 credits).', {
     provider: z.string().describe('Provider name (e.g. anthropic, openai, google)'),
     days: z.number().min(1).max(7).optional().describe('Rolling window length 1 to 7 days (default 7)'),
 }, async ({ provider, days }) => {
@@ -627,7 +673,7 @@ registerTool('status_leaderboard_free', 'Cross-provider uptime leaderboard, rank
         ],
     };
 });
-// ── Tool: pricing_series (1 credit) ─────────────────────────────────
+// ── Tool: pricing_series (2 credits) ────────────────────────────────
 registerTool('pricing_series', 'Daily price points for one AI model with min/max/delta summary. Default range = last 30 days, max 90 days. Costs 2 credits ($0.04). Strict premium, no free trial; the 7-day-capped sibling pricing_series_free is the discovery option.', {
     model: z.string().describe('Model id or display name (e.g. "Claude Opus 4.7" or "claude-opus-4-7")'),
     from: z.string().optional().describe('Start date YYYY-MM-DD UTC (default: 30 days ago)'),
@@ -652,7 +698,7 @@ registerTool('pricing_series', 'Daily price points for one AI model with min/max
         ],
     };
 });
-// ── Tool: benchmark_series (1 credit) ───────────────────────────────
+// ── Tool: benchmark_series (2 credits) ──────────────────────────────
 registerTool('benchmark_series', 'Score evolution for a single benchmark on one AI model. Costs 2 credits ($0.04). Strict premium, no free trial; the 7-day-capped sibling benchmark_series_free is the discovery option. Benchmark keys: swe_bench, mmlu_pro, gpqa_diamond, math, human_eval.', {
     model: z.string().describe('Model id or display name'),
     benchmark: z.string().describe('Benchmark key (e.g. swe_bench, mmlu_pro, gpqa_diamond, math, human_eval)'),
@@ -678,7 +724,7 @@ registerTool('benchmark_series', 'Score evolution for a single benchmark on one
         ],
     };
 });
-// ── Tool: status_uptime (1 credit) ──────────────────────────────────
+// ── Tool: status_uptime (2 credits) ─────────────────────────────────
 registerTool('status_uptime', 'Daily uptime rollup for one provider with operational/degraded/down day counts and uptime % (degraded counts as half-credit). Costs 2 credits ($0.04). Strict premium, no free trial; the 7-day-capped sibling status_uptime_free is the discovery option.', {
     provider: z.string().describe('Provider name (e.g. anthropic, openai, google)'),
     from: z.string().optional().describe('Start date YYYY-MM-DD UTC (default: 30 days ago)'),
@@ -1046,9 +1092,13 @@ registerTool('create_leaderboard_rank_watch', 'Register a webhook that fires whe
 }, CREATE_TOOL);
 // ── Tool: delete_watch ──────────────────────────────────────────────
 registerTool('delete_watch', 'Delete one of your active webhook watches by id. Free, requires TENSORFEED_TOKEN.', {
-    watch_id: z.string().describe('The wat_... id from create_price_watch / create_status_watch / list_watches'),
+    watch_id: z
+        .string()
+        .regex(/^[A-Za-z0-9_-]+$/, 'watch_id may only contain letters, digits, underscores, and hyphens')
+        .max(128)
+        .describe('The wat_... id from create_price_watch / create_status_watch / list_watches'),
 }, async ({ watch_id }) => {
-    await fetchJSON(`/premium/watches/${watch_id}`, { method: 'DELETE', auth: true });
+    await fetchJSON(`/premium/watches/${encodeURIComponent(watch_id)}`, { method: 'DELETE', auth: true });
     return { content: [{ type: 'text', text: `Deleted watch ${watch_id}.` }] };
 }, DELETE_TOOL);
 // ── Tool: probe_latest (free) ───────────────────────────────────────
@@ -1387,7 +1437,7 @@ registerTool('get_recent_earthquakes', "Recent earthquakes from the USGS Earthqu
     return { content: [{ type: 'text', text: `${header}\n\n${lines || '  (no events in this window)'}\n\nSource: USGS Earthquake Hazards Program. Public domain (17 USC §105).` }] };
 });
 // ── Tool: get_weather_alerts (free, US only) ────────────────────────
-registerTool('get_weather_alerts', "Active US weather alerts from the National Weather Service. US-only. Filter by 2-letter state code (area), exact NWS event name, severity, urgency, status. Returns id, event, severity, urgency, headline, description, areaDesc, sent/effective/expires/ends, sender_name, web URL. Active alerts only — expired alerts fall off the upstream feed automatically. License: US Government public domain. Free, no auth.", {
+registerTool('get_weather_alerts', "Active US weather alerts from the National Weather Service. US-only. Filter by 2-letter state code (area), exact NWS event name, severity, urgency, status. Returns id, event, severity, urgency, headline, description, areaDesc, sent/effective/expires/ends, sender_name, web URL. Active alerts only. Expired alerts fall off the upstream feed automatically. License: US Government public domain. Free, no auth.", {
     area: z.string().regex(/^[A-Za-z]{2}$/).optional().describe('2-letter US state or territory code (CA, TX, PR, etc)'),
     event: z.string().optional().describe('Exact NWS event name (e.g. "Tornado Warning", "Heat Advisory")'),
     severity: z.enum(['Extreme', 'Severe', 'Moderate', 'Minor', 'Unknown']).optional().describe('Severity filter'),
@@ -1697,10 +1747,13 @@ registerTool('get_ai_company_filings', 'Get recent SEC filings (10-K, 10-Q, 8-K,
 });
 // ── Tool: premium_ai_company (1 credit) ─────────────────────────────
 registerTool('premium_ai_company', 'Get the per-ticker AI intelligence envelope for one AI bellwether: latest 10 SEC filings, latest 10 AI-tagged news mentions filtered by curated aliases, strategic and equity funding rounds where the company is a lead or notable investor, and cohort metadata. One call replaces four free siblings (sec/filings, news, funding, cohort) plus the agent-side alias filter. Costs 1 credit ($0.02). Strict-premium; ticker must be in the cohort.', {
-    ticker: z.string().describe('AI bellwether ticker (case-insensitive). One of NVDA, AMD, AVGO, TSM, ARM, MSFT, GOOGL, AMZN, ORCL, PLTR, SMCI, AAPL, META, TSLA.'),
+    ticker: z
+        .string()
+        .regex(/^[A-Za-z.\-]{1,8}$/, 'ticker may only contain letters, dots, and hyphens (1 to 8 chars)')
+        .describe('AI bellwether ticker (case-insensitive). One of NVDA, AMD, AVGO, TSM, ARM, MSFT, GOOGL, AMZN, ORCL, PLTR, SMCI, AAPL, META, TSLA.'),
 }, async ({ ticker }) => {
     const upper = ticker.toUpperCase();
-    const data = (await fetchJSON(`/premium/ai-companies/${upper}`, { auth: true }));
+    const data = (await fetchJSON(`/premium/ai-companies/${encodeURIComponent(upper)}`, { auth: true }));
     const filingsList = data.filings.items
         .slice(0, 10)
         .map((f, i) => `   ${i + 1}. ${f.form} on ${f.filing_date}: ${f.primary_doc_description}`)
@@ -1724,6 +1777,139 @@ registerTool('premium_ai_company', 'Get the per-ticker AI intelligence envelope
         ],
     };
 });
+// ── Tool: get_x402_summary (free) ───────────────────────────────────
+registerTool('get_x402_summary', 'Get ecosystem-level x402 USDC settlement rollup on Base mainnet. Returns volume_usdc, count, unique_publishers, and change_vs_prior_window across a 24h, 7d, or 30d window. TensorFeed indexes Base USDC Transfer events filtered to wallets self-published by x402-compliant publishers in their /.well-known/x402.json manifests. Forward-only from 2026-05-28; ~6 min worst-case freshness (10 min SLA). Free, capped to one window per call.', {
+    window: z.enum(['24h', '7d', '30d']).optional().describe('Aggregation window. Defaults to 24h if omitted.'),
+}, async ({ window }) => {
+    const w = window ?? '24h';
+    const data = (await fetchJSON(`/x402-index/summary?window=${w}`));
+    return {
+        content: [
+            {
+                type: 'text',
+                text: `x402 settlement rollup (window ${data.window}, captured ${data.captured_at}):\n  volume_usdc: ${data.volume_usdc}\n  count: ${data.count}\n  unique_publishers: ${data.unique_publishers}\n  change vs prior window: volume ${data.change_vs_prior_window.volume_pct}%, count ${data.change_vs_prior_window.count_pct}%`,
+            },
+        ],
+    };
+});
+// ── Tool: get_x402_publishers (free) ────────────────────────────────
+registerTool('get_x402_publishers', 'List x402-compliant publishers TensorFeed currently indexes. Each entry: domain, pay_to_wallets, first_seen, last_crawled, last_event_at, last_crawl_error. Publishers are auto-discovered daily via /.well-known/x402.json crawls. Use this to enumerate which publishers can then be queried in depth via premium_x402_publisher_receipts. Free, no input.', {}, async () => {
+    const data = (await fetchJSON('/x402-index/publishers'));
+    if (data.count === 0) {
+        return { content: [{ type: 'text', text: 'No x402 publishers indexed yet.' }] };
+    }
+    // Cap the rendered list so a large index cannot flood the agent's
+    // context. Sanitize layer also enforces a hard char cap downstream.
+    const MAX_PUBLISHERS = 50;
+    const shown = data.publishers.slice(0, MAX_PUBLISHERS);
+    const lines = shown
+        .map((p, i) => `${i + 1}. ${p.domain}\n   wallets: ${p.pay_to_wallets.join(', ')}\n   first_seen: ${p.first_seen}${p.last_event_at ? `\n   last_event_at: ${p.last_event_at}` : ''}${p.last_crawled ? `\n   last_crawled: ${p.last_crawled}` : ''}${p.last_crawl_error ? `\n   last_crawl_error: ${p.last_crawl_error}` : ''}`)
+        .join('\n\n');
+    const more = data.count > shown.length ? `\n\n...and ${data.count - shown.length} more (showing first ${shown.length}).` : '';
+    return {
+        content: [
+            {
+                type: 'text',
+                text: `x402 publishers (${data.count}, captured ${data.captured_at}):\n\n${lines}${more}`,
+            },
+        ],
+    };
+});
+// ── Tool: get_x402_leaderboard (free) ───────────────────────────────
+registerTool('get_x402_leaderboard', 'Top publishers by x402 USDC settlement volume across a 24h, 7d, or 30d window. Each leader: rank, domain, volume_usdc, count, share_pct of the sliced total. Limit clamped 1 to 25. Useful for surfacing which x402 services are receiving the most agent traffic. Free.', {
+    window: z.enum(['24h', '7d', '30d']).optional().describe('Aggregation window. Defaults to 24h.'),
+    limit: z.number().min(1).max(25).optional().describe('Top N publishers to return. Default 10, max 25.'),
+}, async ({ window, limit }) => {
+    const w = window ?? '24h';
+    const l = limit ?? 10;
+    const data = (await fetchJSON(`/x402-index/leaderboard?window=${w}&limit=${l}`));
+    if (data.leaders.length === 0) {
+        return { content: [{ type: 'text', text: `No x402 leaders for window ${data.window}.` }] };
+    }
+    const lines = data.leaders
+        .map((e) => `  ${e.rank}. ${e.domain}: $${e.volume_usdc} across ${e.count} settlements (${e.share_pct}% share)`)
+        .join('\n');
+    return {
+        content: [
+            {
+                type: 'text',
+                text: `x402 leaderboard (window ${data.window}, captured ${data.captured_at}):\n${lines}`,
+            },
+        ],
+    };
+});
+// ── Tool: get_x402_recent (free) ────────────────────────────────────
+registerTool('get_x402_recent', 'Most recent x402 USDC settlement events newest-first. Each event: tx_hash, block, ts, from_address, to_address, amount_usdc, publisher_domain, base_explorer_url (basescan.org link). Backed by a 100-event ring buffer updated on every indexer cron tick. Limit clamped 1 to 50, default 20. Free.', {
+    limit: z.number().min(1).max(50).optional().describe('Number of most-recent events. Default 20, max 50.'),
+}, async ({ limit }) => {
+    const l = limit ?? 20;
+    const data = (await fetchJSON(`/x402-index/recent?limit=${l}`));
+    if (data.count === 0) {
+        return { content: [{ type: 'text', text: 'No recent x402 settlement events.' }] };
+    }
+    const lines = data.events
+        .map((e, i) => `${i + 1}. ${e.ts} block ${e.block}\n   ${e.publisher_domain}: $${e.amount_usdc} USDC\n   from ${e.from_address} to ${e.to_address}\n   ${e.base_explorer_url}`)
+        .join('\n\n');
+    return {
+        content: [
+            {
+                type: 'text',
+                text: `Recent x402 settlements (${data.count}, captured ${data.captured_at}):\n\n${lines}`,
+            },
+        ],
+    };
+});
+// ── Tool: premium_x402_publisher_receipts (1 credit) ────────────────
+registerTool('premium_x402_publisher_receipts', 'Per-publisher receipt feed for one x402-compliant domain across a from/to date range. Returns publisher meta (domain, pay_to_wallets, first_seen), window rollup (volume_usdc, count, avg_amount, daily_series), and attribution. \n\nVS FREE: get_x402_publishers tells you WHICH publishers exist but only with rolled-up scalar counters. This endpoint composes the per-day rollup across a date range with avg_amount, daily series for charts, and structured attribution license metadata in one paid call. An agent building a per-publisher analytics dashboard would otherwise need to call get_x402_publishers + reconstruct daily series from get_x402_summary per-day (impossible because /summary returns ecosystem totals not per-publisher) or wait for the next free-tier expansion. The premium endpoint saves the integration overhead and serves a forensic / compliance-grade payload for $0.02. \n\nForward-only index. Costs 1 credit ($0.02). Strict-premium; domain must exist in get_x402_publishers, otherwise 404.', {
+    domain: z.string().describe('Publisher domain to query, e.g. tensorfeed.ai. Must exist in get_x402_publishers result.'),
+    from: z.string().describe('Inclusive start date YYYY-MM-DD.'),
+    to: z.string().describe('Inclusive end date YYYY-MM-DD.'),
+}, async ({ domain, from, to }) => {
+    const params = new URLSearchParams({ from, to });
+    const data = (await fetchJSON(`/premium/x402-index/publisher/${encodeURIComponent(domain)}?${params}`, { auth: true }));
+    const series = data.rollup.daily_series
+        .map((d) => `   ${d.date}: $${d.volume_usdc} across ${d.count}`)
+        .join('\n');
+    const billing = data.billing
+        ? `\n\nCharged ${data.billing.credits_charged} credit. Remaining: ${data.billing.credits_remaining ?? '?'}.`
+        : '';
+    return {
+        content: [
+            {
+                type: 'text',
+                text: `${data.publisher.domain} (first_seen ${data.publisher.first_seen})\nwallets: ${data.publisher.pay_to_wallets.join(', ')}\nwindow: ${data.window.from} to ${data.window.to} (${data.window.days} days)\n\nRollup:\n  volume_usdc: ${data.rollup.volume_usdc}\n  count: ${data.rollup.count}\n  avg_amount: ${data.rollup.avg_amount}\n\nDaily series:\n${series || '   none'}\n\nAttribution: ${data.attribution}\nLicense: ${data.license}${billing}`,
+            },
+        ],
+    };
+});
+// ── Tool: premium_x402_series (1 credit) ────────────────────────────
+registerTool('premium_x402_series', 'Time-series of ecosystem or per-publisher x402 settlement volume or count across a from/to date range, chart-feeding. Required: metric (volume or count), granularity (day or hour), from + to (YYYY-MM-DD). Optional: domain filter (omit for ecosystem). \n\nVS FREE: get_x402_summary returns one rolled-up scalar per call for a fixed window length (24h / 7d / 30d). For ANY chart or dashboard, the caller needs a series, not a scalar. The premium endpoint returns the full series in one call instead of N calls + N rate-limit budget burns. For a publisher-scoped series, it is the ONLY way to get per-publisher daily data (get_x402_summary is ecosystem-only). \n\nMVP supports granularity=day; hour returns an empty series with an attribution note (hourly rollups land in a future indexer version). Costs 1 credit ($0.02).', {
+    metric: z.enum(['volume', 'count']).describe('Which series to return.'),
+    granularity: z.enum(['day', 'hour']).describe('Bucket size. MVP: day only; hour returns empty series.'),
+    from: z.string().describe('Inclusive start date YYYY-MM-DD.'),
+    to: z.string().describe('Inclusive end date YYYY-MM-DD.'),
+    domain: z.string().optional().describe('Optional publisher domain filter. Omit for ecosystem-wide series.'),
+}, async ({ metric, granularity, from, to, domain }) => {
+    const params = new URLSearchParams({ metric, granularity, from, to });
+    if (domain)
+        params.set('domain', domain);
+    const data = (await fetchJSON(`/premium/x402-index/series?${params}`, { auth: true }));
+    const scope = domain ? `domain=${domain}` : 'ecosystem-wide';
+    const seriesLines = data.series.length
+        ? data.series.map((p) => `   ${p.ts}: ${p.value}`).join('\n')
+        : '   (empty)';
+    const billing = data.billing
+        ? `\n\nCharged ${data.billing.credits_charged} credit. Remaining: ${data.billing.credits_remaining ?? '?'}.`
+        : '';
+    return {
+        content: [
+            {
+                type: 'text',
+                text: `x402 ${data.metric} series (${data.granularity}, ${scope})\nwindow: ${data.window.from} to ${data.window.to}\n\nSeries:\n${seriesLines}\n\nAttribution: ${data.attribution}${billing}`,
+            },
+        ],
+    };
+});
 // ── Start ───────────────────────────────────────────────────────────
 async function main() {
     const transport = new StdioServerTransport();

package/dist/sanitize.d.ts

@@ -19,8 +19,10 @@
  *     tokens, jailbreak preamble lines, "ignore previous instructions")
  *   - Collapse runs of whitespace
  *
- * No length cap is applied here. Tool output is conversational and may
- * legitimately be tens of KB; upstream KV size limits already bound it.
+ * A hard per-response character cap is applied (see MAX_RESPONSE_CHARS).
+ * Tool output is conversational and usually small, but a large or inflated
+ * upstream response would otherwise blow the host agent's context window.
+ * Anything past the cap is dropped and a clear marker is appended.
  */
 /**
  * Scrub a single string for return to a host LLM. Idempotent and pure.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tensorfeed/mcp-server",
-  "version": "1.35.0",
+  "version": "1.36.1",
   "mcpName": "ai.tensorfeed/mcp-server",
   "description": "MCP server for TensorFeed.ai - AI news, status, model data, and premium endpoints (routing, cost projection, forecast, history series, news search, webhook watches with digest tier, enriched directory) for AI agents",
   "main": "dist/index.js",

package/server.json

@@ -3,7 +3,7 @@
   "name": "ai.tensorfeed/mcp-server",
   "title": "TensorFeed",
   "description": "AI news, model pricing, service status, and machine-payable premium tools. AFTA-certified.",
-  "version": "1.35.0",
+  "version": "1.36.1",
   "websiteUrl": "https://tensorfeed.ai/developers/agent-payments",
   "repository": {
     "url": "https://github.com/RipperMercs/tensorfeed-mcp",
@@ -20,7 +20,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@tensorfeed/mcp-server",
-      "version": "1.35.0",
+      "version": "1.36.1",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"
@@ -69,7 +69,11 @@
         "get_ai_cves_latest",
         "get_ai_cves_feed",
         "get_ai_cves_stats",
-        "get_ai_company_filings"
+        "get_ai_company_filings",
+        "get_x402_summary",
+        "get_x402_publishers",
+        "get_x402_leaderboard",
+        "get_x402_recent"
       ],
       "premiumTools": [
         "premium_routing",
@@ -93,7 +97,9 @@
         "delete_watch",
         "get_account_balance",
         "get_account_usage",
-        "premium_ai_company"
+        "premium_ai_company",
+        "premium_x402_publisher_receipts",
+        "premium_x402_series"
       ]
     }
   }