@tensorfeed/mcp-server 2.0.1 → 2.0.3

package/CHANGELOG.md

@@ -2,6 +2,34 @@
 
 All notable changes to the [TensorFeed.ai MCP server](https://github.com/RipperMercs/tensorfeed-mcp). Free tools work without configuration; premium tools require a bearer token via the `TENSORFEED_TOKEN` env var. Buy credits at [tensorfeed.ai/developers/agent-payments](https://tensorfeed.ai/developers/agent-payments).
 
+## 2.0.3 - 2026-07-06
+
+Error-path and input hardening, completing the 2.0.2 output work.
+
+- Tool errors now pass through the same scrub as tool results. Previously a
+  thrown error's message (which can embed an upstream response body) went to
+  the host raw; every throw is now converted to a sanitized MCP tool error
+  with secrets redacted (the live bearer token, plus anything shaped like a
+  tf_live_ token), the standard control-char and role-token scrub applied,
+  and the text capped at 4k chars.
+- Upstream error bodies embedded in error messages are capped at 1.5k chars
+  at the source.
+- Every free-text tool parameter now carries a schema-level max length
+  (200 for identifiers, larger for comma lists, URLs, and search queries),
+  so oversized inputs are rejected by validation before reaching any code.
+
+No tool signatures change and no behavior changes for valid inputs.
+
+## 2.0.2 - 2026-07-06
+
+Output hardening. Caller-supplied identifiers that a tool echoes back in its
+own message (a service, model, provider, benchmark, publisher domain, CVE id,
+or search query that did not match) are now stripped of angle brackets and
+length-capped before they are placed in the response text. This is a
+defense-in-depth layer on top of the existing output sanitizer, so a value a
+caller passes in cannot be reflected back as markup. No tool signatures,
+endpoints, or behavior for valid inputs change.
+
 ## 2.0.1 - 2026-07-03
 
 Docs release, no code changes to the stdio server. The README now documents

package/dist/index.js

@@ -5,7 +5,7 @@ import { z } from 'zod';
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
-import { sanitizeToolResponse, sanitizeForLLM } from './sanitize.js';
+import { sanitizeToolResponse, sanitizeForLLM, sanitizeReflectedValue, sanitizeErrorText } from './sanitize.js';
 const API_BASE = 'https://tensorfeed.ai/api';
 // Per-request upstream timeout. fetchJSON is the single HTTP helper behind every
 // MCP tool and the latest_news resource, so a missing timeout would let one
@@ -67,16 +67,35 @@ async function fetchJSON(path, opts = {}) {
         catch {
             errPayload = await res.text().catch(() => '');
         }
+        // The upstream error body is untrusted input. Cap it here so a hostile
+        // or malfunctioning upstream (or a middlebox returning an HTML error
+        // page) cannot inflate the error message. The registerTool wrapper
+        // additionally runs the full error scrub before anything reaches the
+        // host LLM; this cap just bounds what gets embedded at the source.
+        const detail = errDetail(errPayload);
         if (res.status === 402) {
-            throw new Error(`Payment required (402). Your token may be out of credits. Top up at https://tensorfeed.ai/developers/agent-payments. Detail: ${JSON.stringify(errPayload)}`);
+            throw new Error(`Payment required (402). Your token may be out of credits. Top up at https://tensorfeed.ai/developers/agent-payments. Detail: ${detail}`);
         }
         if (res.status === 401) {
-            throw new Error(`Token rejected (401). Check that TENSORFEED_TOKEN is set to a valid tf_live_... token. Detail: ${JSON.stringify(errPayload)}`);
+            throw new Error(`Token rejected (401). Check that TENSORFEED_TOKEN is set to a valid tf_live_... token. Detail: ${detail}`);
         }
-        throw new Error(`API error ${res.status}: ${JSON.stringify(errPayload)}`);
+        throw new Error(`API error ${res.status}: ${detail}`);
     }
     return res.json();
 }
+// Stringify an upstream error payload for embedding in an Error message,
+// bounded so an oversized body cannot balloon the error text.
+const MAX_ERR_DETAIL_CHARS = 1500;
+function errDetail(payload) {
+    let s;
+    try {
+        s = JSON.stringify(payload) ?? String(payload);
+    }
+    catch {
+        s = String(payload);
+    }
+    return s.length > MAX_ERR_DETAIL_CHARS ? s.slice(0, MAX_ERR_DETAIL_CHARS) + '...' : s;
+}
 // ── Server setup ────────────────────────────────────────────────────
 const server = new McpServer({
     name: 'tensorfeed',
@@ -141,8 +160,25 @@ function registerTool(name, description, paramsSchema, cb, annotations) {
     // explicitly and bypass this inference.
     const finalAnnotations = annotations ?? (PAID_TOOL_RE.test(description) ? PREMIUM_READ_TOOL : READ_TOOL);
     const wrapped = (async (args, extra) => {
-        const result = await cb(args, extra);
-        return sanitizeToolResponse(result);
+        try {
+            const result = await cb(args, extra);
+            return sanitizeToolResponse(result);
+        }
+        catch (err) {
+            // The error path used to bypass the sanitizer entirely: a thrown
+            // Error's message (which can embed an upstream response body via
+            // fetchJSON) went to the SDK raw. Convert every throw into a
+            // sanitized MCP tool error instead: secrets redacted (the live
+            // bearer token, plus anything token-shaped), the standard
+            // control-char and role-token scrub applied, and the text capped,
+            // so the error channel offers no unsanitized path into the host
+            // LLM's context.
+            const raw = err instanceof Error ? err.message : String(err);
+            return {
+                content: [{ type: 'text', text: sanitizeErrorText(raw, [process.env.TENSORFEED_TOKEN]) }],
+                isError: true,
+            };
+        }
     });
     // Direct dispatch to the SDK's underlying registration. Do not call
     // registerTool() here or it will recurse forever.
@@ -188,7 +224,7 @@ server.registerResource('latest_news', 'tensorfeed://news/latest', {
 });
 // ── Tool: get_ai_news ───────────────────────────────────────────────
 registerTool('get_ai_news', 'Get the latest AI news from TensorFeed.ai as a ranked list with title, source, URL, snippet, and publish time, filterable by category (e.g. "anthropic", "openai", "research", "tools"). Aggregates 15+ sources (Anthropic, OpenAI, Google, TechCrunch, The Verge, arXiv, and more) into one normalized feed, so an agent reads one schema instead of polling each outlet. Free, no auth.', {
-    category: z.string().optional().describe('Filter by category (e.g. "anthropic", "openai", "research", "tools")'),
+    category: z.string().max(100).optional().describe('Filter by category (e.g. "anthropic", "openai", "research", "tools")'),
     limit: z.number().min(1).max(50).optional().describe('Number of articles to return (default 10, max 50)'),
     digest: z.boolean().optional().describe('When true, return a headline-only digest (title, source, URL per story) instead of the full article set.'),
 }, async ({ category, limit, digest }) => {
@@ -219,7 +255,7 @@ registerTool('get_ai_news', 'Get the latest AI news from TensorFeed.ai as a rank
 });
 // ── Tool: find_tensorfeed_data (discovery, long-tail surface) ───────
 registerTool('find_tensorfeed_data', 'Discover which TensorFeed endpoint answers a data need. Describe what you want in plain language (e.g. "trending AI papers", "is OpenAI down", "model price history") and this returns the 2 to 3 best-matching TensorFeed endpoints, each with its HTTP path, what it returns, and whether it is free or paid. TensorFeed exposes 100+ AI-ecosystem data and signed-verdict endpoints; the core ones are also dedicated tools, but the full catalog is reachable here and callable over HTTP (paid ones via x402 or a credits token). Free, no auth. Use this first when no dedicated tool obviously fits.', {
-    query: z.string().describe('Plain-language description of the data or decision you need.'),
+    query: z.string().max(500).describe('Plain-language description of the data or decision you need.'),
     limit: z.number().int().min(1).max(5).optional().describe('Max endpoints to return (default 3).'),
 }, async ({ query, limit }) => {
     const { flattenCatalog, scoreEndpoints } = await import('./discovery.js');
@@ -235,10 +271,10 @@ registerTool('find_tensorfeed_data', 'Discover which TensorFeed endpoint answers
     const rows = flattenCatalog(meta);
     const top = scoreEndpoints(rows, query, limit ?? 3);
     if (top.length === 0) {
-        return { content: [{ type: 'text', text: `No TensorFeed endpoint matched "${query}". Browse the full catalog at https://tensorfeed.ai/api/meta or https://tensorfeed.ai/developers.` }] };
+        return { content: [{ type: 'text', text: `No TensorFeed endpoint matched "${sanitizeReflectedValue(query)}". Browse the full catalog at https://tensorfeed.ai/api/meta or https://tensorfeed.ai/developers.` }] };
     }
     const lines = top.map((r) => `- ${r.path}\n  ${r.description}`).join('\n');
-    return { content: [{ type: 'text', text: `Top TensorFeed endpoints for "${query}":\n${lines}\n\nCall free endpoints directly over HTTP. Paid endpoints (marked with a credit cost) accept x402 payment or a TENSORFEED_TOKEN bearer; see https://tensorfeed.ai/developers/agent-payments.` }] };
+    return { content: [{ type: 'text', text: `Top TensorFeed endpoints for "${sanitizeReflectedValue(query)}":\n${lines}\n\nCall free endpoints directly over HTTP. Paid endpoints (marked with a credit cost) accept x402 payment or a TENSORFEED_TOKEN bearer; see https://tensorfeed.ai/developers/agent-payments.` }] };
 });
 // ── Tool: get_ai_status ─────────────────────────────────────────────
 registerTool('get_ai_status', 'Get the real-time operational status of major AI services (Claude, OpenAI, Gemini, Mistral, Cohere, Replicate, Hugging Face), including per-component breakdowns and an operational/degraded/down rollup per provider. One cross-provider status call instead of checking each vendor\'s status page, useful before an agent routes a request to a model that may be impaired. Free, no auth.', {}, async () => {
@@ -255,13 +291,13 @@ registerTool('get_ai_status', 'Get the real-time operational status of major AI
 });
 // ── Tool: is_service_down ───────────────────────────────────────────
 registerTool('is_service_down', 'Check whether one named AI service (e.g. "claude", "openai", "gemini", "mistral", "cohere", "hugging face", "replicate") is currently operational, degraded, or down, with its component-level breakdown. Matches on service or provider name and lists available services if there is no match, so an agent can gate a call on live status before sending traffic. Free, no auth.', {
-    service: z.string().describe('Service name to check (e.g. "claude", "openai", "gemini", "mistral", "cohere", "hugging face", "replicate")'),
+    service: z.string().max(200).describe('Service name to check (e.g. "claude", "openai", "gemini", "mistral", "cohere", "hugging face", "replicate")'),
 }, async ({ service }) => {
     const data = await fetchJSON('/status');
     const match = data.services.find(s => s.name.toLowerCase().includes(service.toLowerCase()) ||
         s.provider.toLowerCase().includes(service.toLowerCase()));
     if (!match) {
-        return { content: [{ type: 'text', text: `Service "${service}" not found. Available services: ${data.services.map(s => s.name).join(', ')}` }] };
+        return { content: [{ type: 'text', text: `Service "${sanitizeReflectedValue(service)}" not found. Available services: ${data.services.map(s => s.name).join(', ')}` }] };
     }
     const statusEmoji = match.status === 'operational' ? 'OK' : match.status === 'degraded' ? 'DEGRADED' : 'DOWN';
     const components = match.components.length > 0
@@ -332,7 +368,7 @@ registerTool('account_status', 'Check the configured TensorFeed token: current c
 registerTool('route_verdict', "TensorFeed's signed model-routing decision: the single best model for a task or named model, fused from live pricing, contamination-discounted benchmarks, real production usage, measured p95 latency, incident state, and deprecation flags, with the reasoning. tier='preview' (default) is free (10 calls per day per IP), top verdict only. tier='full' costs 1 credit ($0.02), adds ranked runners-up, constraint filters, and an AFTA-signed receipt you can audit, and needs a TENSORFEED_TOKEN. Get credits at tensorfeed.ai/developers/agent-payments.", {
     tier: z.enum(['preview', 'full']).optional().describe("'preview' (default, free) or 'full' (1 credit; adds runners-up, filters, signed receipt)."),
     task: z.enum(['code', 'reasoning', 'creative', 'general']).optional().describe('Task type to route for (code, reasoning, creative, general). Provide task or model.'),
-    model: z.string().optional().describe('Model id or display name to narrow the verdict to one model (e.g. "Claude Opus 4.7" or "claude-opus-4-7"). Provide task or model.'),
+    model: z.string().max(200).optional().describe('Model id or display name to narrow the verdict to one model (e.g. "Claude Opus 4.7" or "claude-opus-4-7"). Provide task or model.'),
     max_latency_p95_ms: z.number().optional().describe('Full tier only. Drop candidates whose measured p95 latency exceeds this value (ms).'),
     budget: z.number().optional().describe('Full tier only. Max blended USD per 1M tokens.'),
     min_quality: z.number().min(0).max(1).optional().describe('Full tier only. Minimum trust-discounted quality score in [0, 1].'),
@@ -549,7 +585,7 @@ registerTool('x402_settlement_verdict', "TensorFeed's signed ruling on the state
 // ── Tool: x402_publisher_verdict (preview free / full 1 credit) ──────
 registerTool('x402_publisher_verdict', "TensorFeed's signed trust verdict on one x402 publisher, over its OWN on-chain settlement index: whether a named publisher domain is actively settling, recently quiet, registered with no settlement, unreachable, missing a Base payTo, or not indexed. Requires a domain. tier='preview' (default) is free (10 calls per day per IP), the trust verdict only. tier='full' costs 1 credit ($0.02), adds the 30-day settlement momentum, the shared-wallet risk flag, the settlement evidence (volume, count, last settled), and an AFTA-signed receipt, and needs a TENSORFEED_TOKEN. Get credits at tensorfeed.ai/developers/agent-payments.", {
     tier: z.enum(['preview', 'full']).optional().describe("'preview' (default, free) or 'full' (1 credit; adds momentum, shared-wallet flag, evidence, signed receipt)."),
-    domain: z.string().describe('Publisher domain to rule on, e.g. "x402.tavily.com". Required.'),
+    domain: z.string().max(253).describe('Publisher domain to rule on, e.g. "x402.tavily.com". Required.'),
 }, async ({ tier, domain }) => {
     if (!domain || !domain.trim()) {
         return { content: [{ type: 'text', text: 'Provide a publisher domain (e.g. domain "x402.tavily.com") to get a trust verdict.' }] };
@@ -563,7 +599,7 @@ registerTool('x402_publisher_verdict', "TensorFeed's signed trust verdict on one
             content: [
                 {
                     type: 'text',
-                    text: `x402 Publisher Verdict for ${data.domain}: ${data.verdict}\n` +
+                    text: `x402 Publisher Verdict for ${sanitizeReflectedValue(data.domain)}: ${data.verdict}\n` +
                         `Momentum: ${data.momentum}. Shared wallet: ${t.wallet_shared ? 'yes (risk flag)' : 'no'}` +
                         (t.last_settled ? `. Last settled ${t.last_settled}` : '') +
                         '\n' +
@@ -580,7 +616,7 @@ registerTool('x402_publisher_verdict', "TensorFeed's signed trust verdict on one
         content: [
             {
                 type: 'text',
-                text: `x402 Publisher Verdict for ${data.domain}: ${data.verdict}\n` +
+                text: `x402 Publisher Verdict for ${sanitizeReflectedValue(data.domain)}: ${data.verdict}\n` +
                     `Claim: ${data.claim}` +
                     (data.captured_at ? `\nIndex captured ${data.captured_at}` : '') +
                     '\n' +
@@ -591,7 +627,7 @@ registerTool('x402_publisher_verdict', "TensorFeed's signed trust verdict on one
 });
 registerTool('stack_safety_verdict', "TensorFeed's deploy gate for an AI software stack: pass each package as comma-separated name@version and get the overall BLOCK / HOLD / PASS / UNKNOWN gate plus a per-package verdict, fusing the ingested AI-stack CVE batch with the CISA KEV catalog. Conservative by design: BLOCK only on an exploited CVE with no fix, HOLD when a known CVE applies and you must verify your version, PASS on no match, UNKNOWN outside the curated AI-stack cohort. tier='preview' (default) is free (10 calls per day per IP), caps at 3 packages, gate plus worst offender. tier='full' costs 1 credit ($0.02), raises the cap to 10 packages, adds the matched-CVE evidence (ids, affected ranges, fixed versions, KEV status) and an AFTA-signed receipt, and needs a TENSORFEED_TOKEN. Get credits at tensorfeed.ai/developers/agent-payments.", {
     tier: z.enum(['preview', 'full']).optional().describe("'preview' (default, free, caps at 3 packages) or 'full' (1 credit; up to 10 packages, matched-CVE evidence, signed receipt)."),
-    packages: z.string().describe('Comma-separated AI-stack packages as name@version (e.g. "vllm@0.5.0,transformers@4.40.0"). Required. Preview caps at 3, full up to 10.'),
+    packages: z.string().max(1000).describe('Comma-separated AI-stack packages as name@version (e.g. "vllm@0.5.0,transformers@4.40.0"). Required. Preview caps at 3, full up to 10.'),
 }, async ({ tier, packages }) => {
     if (!packages || !packages.trim()) {
         return { content: [{ type: 'text', text: 'Provide packages as a comma-separated name@version list (e.g. "vllm@0.5.0,transformers@4.40.0") to get a deploy gate.' }] };
@@ -643,8 +679,8 @@ registerTool('stack_safety_verdict', "TensorFeed's deploy gate for an AI softwar
 });
 registerTool('benchmark_trust_verdict', "TensorFeed's signed ruling on whether an AI benchmark is still a trustworthy capability signal or saturated, contaminated, or near ceiling so a high score should be down-weighted: a trust band (reliable, use_with_caution, saturated, contaminated, deprecated) and a 0-100 trust score per benchmark. Pass benchmark to narrow to one, or category to filter, or neither for the registry. tier='preview' (default) is free (10 calls per day per IP), top verdict and bands only. tier='full' costs 1 credit ($0.02), adds the per-signal detail (ceiling proximity, frontier compression, contamination), a down-weight recommendation with an alternative benchmark, and an AFTA-signed receipt, and needs a TENSORFEED_TOKEN. Get credits at tensorfeed.ai/developers/agent-payments.", {
     tier: z.enum(['preview', 'full']).optional().describe("'preview' (default, free) or 'full' (1 credit; adds per-signal detail, recommendation, signed receipt)."),
-    benchmark: z.string().optional().describe('Benchmark registry id or name to narrow to one (e.g. "mmlu", "swe-bench"). Optional.'),
-    category: z.string().optional().describe('Category to filter the benchmarks (e.g. "coding", "reasoning"). Optional.'),
+    benchmark: z.string().max(200).optional().describe('Benchmark registry id or name to narrow to one (e.g. "mmlu", "swe-bench"). Optional.'),
+    category: z.string().max(100).optional().describe('Category to filter the benchmarks (e.g. "coding", "reasoning"). Optional.'),
 }, async ({ tier, benchmark, category }) => {
     const params = new URLSearchParams();
     if (benchmark)
@@ -699,7 +735,7 @@ registerTool('benchmark_trust_verdict', "TensorFeed's signed ruling on whether a
 });
 registerTool('failover_verdict', "Provider A is degraded; TensorFeed's signed ruling on the single best operational provider to fail over to for a task right now. Confirms A against the live incident-triage feed, then runs the route-verdict fusion with A (and any provider already in failover) excluded. Requires from. tier='preview' (default) is free (10 calls per day per IP), the failover target only. tier='full' costs 1 credit ($0.02), adds the full candidate (pricing, measured p95 latency, quality), the ranked alternatives, the confirmed incident on A, and an AFTA-signed receipt, and needs a TENSORFEED_TOKEN. Get credits at tensorfeed.ai/developers/agent-payments.", {
     tier: z.enum(['preview', 'full']).optional().describe("'preview' (default, free) or 'full' (1 credit; adds candidate detail, ranked alternatives, incident, signed receipt)."),
-    from: z.string().describe('The degraded provider to fail over FROM (e.g. "anthropic", "openai"). Required.'),
+    from: z.string().max(200).describe('The degraded provider to fail over FROM (e.g. "anthropic", "openai"). Required.'),
     task: z.enum(['code', 'reasoning', 'creative', 'general']).optional().describe('Task type to optimize the failover target for. Optional.'),
 }, async ({ tier, from, task }) => {
     if (!from || !from.trim()) {
@@ -711,15 +747,16 @@ registerTool('failover_verdict', "Provider A is degraded; TensorFeed's signed ru
     if ((tier ?? 'preview') === 'full') {
         const data = (await fetchJSON(`/premium/failover-verdict?${params}`, { auth: true }));
         const dest = data.failover_to;
+        const fromProvider = sanitizeReflectedValue(data.from.provider);
         const incidentLine = data.from.incident
-            ? `Incident on ${data.from.provider}: ${data.from.incident.title} (action ${data.from.incident.recommended_action})\n`
+            ? `Incident on ${fromProvider}: ${data.from.incident.title} (action ${data.from.incident.recommended_action})\n`
             : '';
         if (!dest) {
             return {
                 content: [
                     {
                         type: 'text',
-                        text: `Failover Verdict from ${data.from.provider}: no operational failover target found.\n` +
+                        text: `Failover Verdict from ${fromProvider}: no operational failover target found.\n` +
                             incidentLine +
                             `Why: ${data.why}\nClaim: ${data.claim}` +
                             verdictBilling(data.billing),
@@ -734,7 +771,7 @@ registerTool('failover_verdict', "Provider A is degraded; TensorFeed's signed ru
             content: [
                 {
                     type: 'text',
-                    text: `Failover Verdict from ${data.from.provider}: fail over to ${dest.model.name} (${dest.model.provider})\n` +
+                    text: `Failover Verdict from ${fromProvider}: fail over to ${dest.model.name} (${dest.model.provider})\n` +
                         `Why: ${dest.why}\n` +
                         `Blended $${dest.pricing.blended}/1M, p95 ${dest.latency.measured_p95_ms ?? 'n/a'}ms, status ${dest.operational.status}\n` +
                         incidentLine +
@@ -748,13 +785,14 @@ registerTool('failover_verdict', "Provider A is degraded; TensorFeed's signed ru
     }
     const data = (await fetchJSON(`/preview/failover-verdict?${params}`));
     const dest = data.failover_to;
+    const fromProvider = sanitizeReflectedValue(data.from.provider);
     const rl = previewRateLine(data.rate_limit);
     if (!dest) {
         return {
             content: [
                 {
                     type: 'text',
-                    text: `Failover Verdict from ${data.from.provider}: no operational failover target found.\n` +
+                    text: `Failover Verdict from ${fromProvider}: no operational failover target found.\n` +
                         `Why: ${data.why}\n${data.claim}\n` +
                         verdictUpsell('failover_verdict', 'the full failover candidate (pricing, measured latency, quality) and the ranked alternatives', rl),
                 },
@@ -765,7 +803,7 @@ registerTool('failover_verdict', "Provider A is degraded; TensorFeed's signed ru
         content: [
             {
                 type: 'text',
-                text: `Failover Verdict from ${data.from.provider}` +
+                text: `Failover Verdict from ${fromProvider}` +
                     (data.from.in_incident ? ' (confirmed in incident)' : '') +
                     `: fail over to ${dest.model.name} (${dest.model.provider})\n` +
                     `Why: ${data.why}\n` +
@@ -779,7 +817,7 @@ registerTool('failover_verdict', "Provider A is degraded; TensorFeed's signed ru
 // ── Tool: ssvc_verdict (preview free / full 1 credit) ────────────────
 registerTool('ssvc_verdict', "TensorFeed's signed SSVC patch-urgency decision for one CVE, applying the CISA SSVC Coordinator decision tree to the recorded Vulnrichment decision points (exploitation, automatable, technical impact). Requires a CVE id. tier='preview' (default) is free (10 calls per day per IP): the three decision points and the decision-tree provenance, WITHOUT the computed Act / Attend / Track / Track* decision. tier='full' costs 1 credit ($0.02), adds the computed decision across the full low/medium/high Mission and Well-being envelope, the per-level reasoning, a live CISA KEV cross-check, and an AFTA-signed receipt, and needs a TENSORFEED_TOKEN. Get credits at tensorfeed.ai/developers/agent-payments.", {
     tier: z.enum(['preview', 'full']).optional().describe("'preview' (default, free) or 'full' (1 credit; adds the computed decision, envelope, reasoning, KEV cross-check, signed receipt)."),
-    cve: z.string().describe('CVE id to rule on, e.g. "CVE-2024-3094". Required.'),
+    cve: z.string().max(64).describe('CVE id to rule on, e.g. "CVE-2024-3094". Required.'),
 }, async ({ tier, cve }) => {
     if (!cve || !cve.trim()) {
         return { content: [{ type: 'text', text: 'Provide a CVE id (e.g. cve "CVE-2024-3094") to get the SSVC decision points.' }] };
@@ -797,7 +835,7 @@ registerTool('ssvc_verdict', "TensorFeed's signed SSVC patch-urgency decision fo
             content: [
                 {
                     type: 'text',
-                    text: `SSVC Verdict for ${data.cve}: ${data.decision_primary} (Mission and Well-being assumed medium)\n` +
+                    text: `SSVC Verdict for ${sanitizeReflectedValue(data.cve)}: ${data.decision_primary} (Mission and Well-being assumed medium)\n` +
                         `Envelope: low ${env.low}, medium ${env.medium}, high ${env.high}\n` +
                         `Decision points: exploitation ${dp.exploitation}, automatable ${dp.automatable}, technical impact ${dp.technical_impact}\n` +
                         `${kevLine}\n` +
@@ -815,7 +853,7 @@ registerTool('ssvc_verdict', "TensorFeed's signed SSVC patch-urgency decision fo
         content: [
             {
                 type: 'text',
-                text: `SSVC decision points for ${data.cve}:\n` +
+                text: `SSVC decision points for ${sanitizeReflectedValue(data.cve)}:\n` +
                     `  exploitation: ${dp.exploitation}\n` +
                     `  automatable: ${dp.automatable}\n` +
                     `  technical impact: ${dp.technical_impact}\n` +
@@ -837,7 +875,7 @@ function seriesFromDate(days) {
 }
 // ── Tool: pricing_series (free 1 to 7 days, paid 8 to 90 days) ──────
 registerTool('pricing_series', 'Daily price points for one AI model over a window. days 1 to 7 is free; days 8 to 90 costs 1 credit ($0.02) and needs a TENSORFEED_TOKEN, adding the min/max/delta summary over the longer window. Get credits at tensorfeed.ai/developers/agent-payments.', {
-    model: z.string().describe('Model id or display name (e.g. "Claude Opus 4.7" or "claude-opus-4-7").'),
+    model: z.string().max(200).describe('Model id or display name (e.g. "Claude Opus 4.7" or "claude-opus-4-7").'),
     days: z.number().int().min(1).max(90).optional().describe('Window length (default 7). 1 to 7 free; 8 to 90 costs 1 credit.'),
 }, async ({ model, days }) => {
     const d = days ?? 7;
@@ -852,7 +890,7 @@ registerTool('pricing_series', 'Daily price points for one AI model over a windo
             content: [
                 {
                     type: 'text',
-                    text: `${data.model} (${data.provider ?? 'unknown'}) ${data.points.length} points\n${summary}\nCredits remaining: ${data.billing?.credits_remaining ?? '?'}`,
+                    text: `${sanitizeReflectedValue(data.model)} (${sanitizeReflectedValue(data.provider ?? 'unknown')}) ${data.points.length} points\n${summary}\nCredits remaining: ${data.billing?.credits_remaining ?? '?'}`,
                 },
             ],
         };
@@ -867,15 +905,15 @@ registerTool('pricing_series', 'Daily price points for one AI model over a windo
         content: [
             {
                 type: 'text',
-                text: `${data.model} (${data.provider ?? 'unknown'}) ${data.points.length} points over ${data.points.length} days\n${summary}\nFor up to 90 days, pass days 8 to 90 (1 credit).`,
+                text: `${sanitizeReflectedValue(data.model)} (${sanitizeReflectedValue(data.provider ?? 'unknown')}) ${data.points.length} points over ${data.points.length} days\n${summary}\nFor up to 90 days, pass days 8 to 90 (1 credit).`,
             },
         ],
     };
 });
 // ── Tool: benchmark_series (free 1 to 7 days, paid 8 to 90 days) ────
 registerTool('benchmark_series', 'Daily benchmark scores for one model+benchmark over a window. Benchmark keys: swe_bench, mmlu_pro, gpqa_diamond, math, human_eval. days 1 to 7 is free; days 8 to 90 costs 1 credit ($0.02) and needs a TENSORFEED_TOKEN, tracking score evolution over the longer window. Get credits at tensorfeed.ai/developers/agent-payments.', {
-    model: z.string().describe('Model id or display name.'),
-    benchmark: z.string().describe('Benchmark key (e.g. swe_bench, mmlu_pro, gpqa_diamond, math, human_eval).'),
+    model: z.string().max(200).describe('Model id or display name.'),
+    benchmark: z.string().max(200).describe('Benchmark key (e.g. swe_bench, mmlu_pro, gpqa_diamond, math, human_eval).'),
     days: z.number().int().min(1).max(90).optional().describe('Window length (default 7). 1 to 7 free; 8 to 90 costs 1 credit.'),
 }, async ({ model, benchmark, days }) => {
     const d = days ?? 7;
@@ -890,7 +928,7 @@ registerTool('benchmark_series', 'Daily benchmark scores for one model+benchmark
             content: [
                 {
                     type: 'text',
-                    text: `${data.model} on ${data.benchmark}: ${data.points.length} points\n${summary}\nCredits remaining: ${data.billing?.credits_remaining ?? '?'}`,
+                    text: `${sanitizeReflectedValue(data.model)} on ${sanitizeReflectedValue(data.benchmark)}: ${data.points.length} points\n${summary}\nCredits remaining: ${data.billing?.credits_remaining ?? '?'}`,
                 },
             ],
         };
@@ -905,14 +943,14 @@ registerTool('benchmark_series', 'Daily benchmark scores for one model+benchmark
         content: [
             {
                 type: 'text',
-                text: `${data.model} on ${data.benchmark}: ${data.points.length} points\n${summary}`,
+                text: `${sanitizeReflectedValue(data.model)} on ${sanitizeReflectedValue(data.benchmark)}: ${data.points.length} points\n${summary}`,
             },
         ],
     };
 });
 // ── Tool: status_uptime (free 1 to 7 days, paid 8 to 90 days) ───────
 registerTool('status_uptime', 'Daily uptime rollup for one provider over a window with operational/degraded/down day counts and uptime % (degraded counts as half-credit). days 1 to 7 is free; days 8 to 90 costs 1 credit ($0.02) and needs a TENSORFEED_TOKEN, adding per-incident-day detail over the longer window. Get credits at tensorfeed.ai/developers/agent-payments.', {
-    provider: z.string().describe('Provider name (e.g. anthropic, openai, google).'),
+    provider: z.string().max(200).describe('Provider name (e.g. anthropic, openai, google).'),
     days: z.number().int().min(1).max(90).optional().describe('Window length (default 7). 1 to 7 free; 8 to 90 costs 1 credit.'),
 }, async ({ provider, days }) => {
     const d = days ?? 7;
@@ -926,7 +964,7 @@ registerTool('status_uptime', 'Daily uptime rollup for one provider over a windo
             content: [
                 {
                     type: 'text',
-                    text: `${data.provider} uptime: ${data.uptime_pct ?? 'n/a'}% over ${data.days_with_data} measured days (of ${data.days_total} in range)\n` +
+                    text: `${sanitizeReflectedValue(data.provider)} uptime: ${data.uptime_pct ?? 'n/a'}% over ${data.days_with_data} measured days (of ${data.days_total} in range)\n` +
                         `  operational: ${data.days_operational}, degraded: ${data.days_degraded}, down: ${data.days_down}` +
                         incidents +
                         `\nCredits remaining: ${data.billing?.credits_remaining ?? '?'}`,
@@ -940,7 +978,7 @@ registerTool('status_uptime', 'Daily uptime rollup for one provider over a windo
         content: [
             {
                 type: 'text',
-                text: `${data.provider} over ${data.days_total} days: ${data.uptime_pct ?? '?'}% uptime (${data.days_operational} operational, ${data.days_degraded} degraded, ${data.days_down} down)`,
+                text: `${sanitizeReflectedValue(data.provider)} over ${data.days_total} days: ${data.uptime_pct ?? '?'}% uptime (${data.days_operational} operational, ${data.days_degraded} degraded, ${data.days_down} down)`,
             },
         ],
     };
@@ -1025,12 +1063,12 @@ registerTool('whats_new', 'Catch up on everything that changed in AI in one call
 });
 // ── Tool: compare_models (1 credit) ─────────────────────────────────
 registerTool('compare_models', 'Pick between models in one call: pricing, benchmarks, status, and recent news for 2 to 5 models side by side, with cheapest-blended and per-benchmark rankings, so you choose without scraping each provider. Costs 1 credit ($0.02).', {
-    ids: z.string().describe('Comma-separated list of 2-5 model ids or display names. Examples: "Claude Opus 4.8,GPT-5.5,Gemini 3.5 Flash" or "opus-4-8,gpt-5-5"'),
+    ids: z.string().max(500).describe('Comma-separated list of 2-5 model ids or display names. Examples: "Claude Opus 4.8,GPT-5.5,Gemini 3.5 Flash" or "opus-4-8,gpt-5-5"'),
 }, async ({ ids }) => {
     const data = (await fetchJSON(`/premium/compare/models?ids=${encodeURIComponent(ids)}`, { auth: true }));
     const lines = data.models.map(m => {
         if (!m.matched)
-            return `  ${m.query}: not found`;
+            return `  ${sanitizeReflectedValue(m.query)}: not found`;
         const benches = data.benchmark_keys
             .map(k => `${k}=${m.benchmarks[k] ?? '-'}`)
             .join(', ');
@@ -1052,7 +1090,7 @@ registerTool('compare_models', 'Pick between models in one call: pricing, benchm
 });
 // ── Tool: provider_deepdive (1 credit) ──────────────────────────────
 registerTool('provider_deepdive', 'Everything about one AI provider in a single call: live status, every model with pricing, tier, and benchmarks joined in, recent news, and agent traffic, replacing about four separate lookups. Costs 3 credits ($0.06). Strict premium, no free trial.', {
-    provider: z.string().describe('Provider id or display name (case-insensitive). Examples: anthropic, openai, google, mistral, cohere'),
+    provider: z.string().max(200).describe('Provider id or display name (case-insensitive). Examples: anthropic, openai, google, mistral, cohere'),
 }, async ({ provider }) => {
     const data = (await fetchJSON(`/premium/providers/${encodeURIComponent(provider)}`, { auth: true }));
     const modelLines = data.models
@@ -1103,12 +1141,12 @@ registerTool('list_watches', 'List the active webhook watches owned by the confi
 // create_*_watch tool used, against the same /premium/watches endpoint.
 registerTool('create_watch', 'Register a webhook watch. type selects what to watch: "price" (a model price change), "status" (a service status transition), "digest" (a scheduled daily or weekly pricing summary), or "leaderboard_rank" (a provider crossing an uptime-rank threshold). Costs 1 credit ($0.02) at registration; the watch lives 90 days and each fire is an HMAC-signed POST to callback_url. Needs a TENSORFEED_TOKEN.', {
     type: z.enum(['price', 'status', 'digest', 'leaderboard_rank']).describe('What to watch.'),
-    callback_url: z.string().describe('HTTPS URL that receives the HMAC-signed POST when the watch fires.'),
-    secret: z.string().optional().describe('Optional shared secret used to HMAC-sign delivery bodies.'),
-    model: z.string().optional().describe('type=price only. Model name (e.g. "Claude Opus 4.7").'),
+    callback_url: z.string().max(2048).describe('HTTPS URL that receives the HMAC-signed POST when the watch fires.'),
+    secret: z.string().max(256).optional().describe('Optional shared secret used to HMAC-sign delivery bodies.'),
+    model: z.string().max(200).optional().describe('type=price only. Model name (e.g. "Claude Opus 4.7").'),
     field: z.enum(['inputPrice', 'outputPrice', 'blended']).optional().describe('type=price only. Which price field to watch.'),
     cadence: z.enum(['daily', 'weekly']).optional().describe('type=digest only. How often the digest fires.'),
-    provider: z.string().optional().describe('type=status or type=leaderboard_rank only. Provider name or slug (case-insensitive). e.g. anthropic, openai, gemini, bedrock, azure.'),
+    provider: z.string().max(200).optional().describe('type=status or type=leaderboard_rank only. Provider name or slug (case-insensitive). e.g. anthropic, openai, gemini, bedrock, azure.'),
     op: z
         .enum(['lt', 'gt', 'changes', 'becomes', 'drops_below', 'rises_above'])
         .optional()
@@ -1209,9 +1247,10 @@ registerTool('create_watch', 'Register a webhook watch. type selects what to wat
             if (secret !== undefined)
                 body.secret = secret;
             const data = (await fetchJSON('/premium/watches', { method: 'POST', body, auth: true }));
+            const safeProvider = sanitizeReflectedValue(provider);
             const desc = op === 'changes'
-                ? `${provider} rank changes`
-                : `${provider} ${(op ?? '').replace('_', ' ')} #${threshold}`;
+                ? `${safeProvider} rank changes`
+                : `${safeProvider} ${(op ?? '').replace('_', ' ')} #${threshold}`;
             return {
                 content: [
                     {

package/dist/sanitize.d.ts

@@ -28,6 +28,40 @@
  * Scrub a single string for return to a host LLM. Idempotent and pure.
  */
 export declare function sanitizeForLLM(input: string): string;
+/**
+ * Scrub an error message before it is returned to the host LLM as a tool
+ * error. Errors are the one path that used to bypass sanitizeToolResponse:
+ * a thrown Error's message (which may embed an upstream response body) went
+ * to the SDK raw. This applies, in order:
+ *
+ *   1. Redact any caller-provided secret values (e.g. the live
+ *      TENSORFEED_TOKEN) wherever they appear in the text.
+ *   2. Redact anything shaped like a TensorFeed bearer token
+ *      (tf_live_...), even if the exact env value was not passed, in case
+ *      an upstream or proxy ever echoes an Authorization header back.
+ *   3. Run the standard sanitizeForLLM scrub (control chars, bidi and
+ *      zero-width chars, role-confusion tokens).
+ *   4. Cap the result at MAX_ERROR_CHARS.
+ *
+ * Secrets shorter than 8 chars are ignored to avoid redacting common
+ * substrings if a trivial value is ever passed by mistake.
+ */
+export declare function sanitizeErrorText(input: string, secrets?: (string | undefined)[]): string;
+/**
+ * Neutralize a caller-supplied identifier before echoing it back inside a
+ * human-readable message (for example `Service "X" not found`). Model,
+ * provider, service and benchmark names are the only caller text that lands
+ * in our response strings, and a well-formed one never contains angle
+ * brackets. Stripping `<` and `>` means a value like
+ * `<script>alert(1)</script>` cannot be reflected as live markup into a
+ * downstream web renderer, nor masquerade as a tag in an LLM's context. The
+ * length cap stops a caller padding the message. This runs on echoed caller
+ * input only, never on the structured data we return, so arrow notation
+ * (`->`) and other formatted output elsewhere is untouched. The full
+ * response still passes through sanitizeForLLM afterward for control-char
+ * and role-token scrubbing.
+ */
+export declare function sanitizeReflectedValue(input: unknown): string;
 /**
  * Recursively scrub the `text` field of every text-content item in an
  * MCP tool response. Non-text items (resources, images) pass through

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tensorfeed/mcp-server",
-  "version": "2.0.1",
+  "version": "2.0.3",
   "mcpName": "ai.tensorfeed/mcp-server",
   "description": "MCP server for TensorFeed.ai - AI news, service status, model pricing, signed decision verdicts, time series, model comparison, webhook watches, and a discovery tool for the full TensorFeed data catalog, for AI agents",
   "main": "dist/index.js",

package/server.json

@@ -3,7 +3,7 @@
   "name": "ai.tensorfeed/mcp-server",
   "title": "TensorFeed",
   "description": "AI news, model pricing, service status, and machine-payable premium tools. AFTA-certified.",
-  "version": "2.0.1",
+  "version": "2.0.3",
   "websiteUrl": "https://tensorfeed.ai/developers/agent-payments",
   "repository": {
     "url": "https://github.com/RipperMercs/tensorfeed-mcp",
@@ -20,7 +20,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@tensorfeed/mcp-server",
-      "version": "2.0.1",
+      "version": "2.0.3",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"