@tensorfeed/mcp-server 2.0.4 → 2.0.6

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 All notable changes to the [TensorFeed.ai MCP server](https://github.com/RipperMercs/tensorfeed-mcp). Free tools work without configuration; premium tools require a bearer token via the `TENSORFEED_TOKEN` env var. Buy credits at [tensorfeed.ai/developers/agent-payments](https://tensorfeed.ai/developers/agent-payments).
 
+## 2.0.6 - 2026-10-29
+
+Dependency floor raise. `@modelcontextprotocol/sdk` now requires 1.32.2 or
+later and `zod` 4.6.7 or later, so every install resolves past the published
+advisories in both (zod's memory exhaustion on oversized constrained
+collections, and the SDK's OAuth client and experimental tasks issues).
+`npm audit` on production dependencies reports zero. The server still runs
+over stdio only.
+
+No tool signatures change.
+
+## 2.0.5 - 2026-10-19
+
+Results now name the page they came from. A successful call to a tool whose
+data has a tensorfeed.ai page (news, status, model pricing, the verdicts, the
+pricing and benchmark series, compare_models) ends with a separate
+`Source: https://tensorfeed.ai/...` content item, so an assistant citing the
+answer can link a page a person can read. The data text itself is unchanged,
+including any signed payload; error results carry no Source line.
+
+No tool signatures change.
+
 ## 2.0.3 - 2026-07-06
 
 Error-path and input hardening, completing the 2.0.2 output work.

package/README.md

@@ -8,7 +8,7 @@ This subfolder remains in the main `tensorfeed` repo as the **publishing source*
 
 ## Hosted remote endpoint (zero install, wallet-payable)
 
-You do not need to install this package to use TensorFeed over MCP. A hosted Streamable HTTP endpoint serves a separate 27-tool set (25 free + 2 premium), and the premium tools are payable per call with nothing but a funded USDC wallet: no account, no signup, no API key.
+You do not need to install this package to use TensorFeed over MCP. A hosted Streamable HTTP endpoint serves the same design as 30 listed tools (15 free, 12 with a free tier and a paid full tier, 3 paid only), and the paid tiers are payable per call with nothing but a funded USDC wallet: no account, no signup, no API key.
 
 | Surface | URL |
 | --- | --- |

package/dist/index.js

@@ -6,6 +6,7 @@ import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
 import { sanitizeToolResponse, sanitizeForLLM, sanitizeReflectedValue, sanitizeErrorText } from './sanitize.js';
+import { withSourceLine } from './pages.js';
 const API_BASE = 'https://tensorfeed.ai/api';
 // Per-request upstream timeout. fetchJSON is the single HTTP helper behind every
 // MCP tool and the latest_news resource, so a missing timeout would let one
@@ -162,7 +163,7 @@ function registerTool(name, description, paramsSchema, cb, annotations) {
     const wrapped = (async (args, extra) => {
         try {
             const result = await cb(args, extra);
-            return sanitizeToolResponse(result);
+            return sanitizeToolResponse(withSourceLine(name, result));
         }
         catch (err) {
             // The error path used to bypass the sanitizer entirely: a thrown
@@ -371,7 +372,7 @@ registerTool('route_verdict', "TensorFeed's signed model-routing decision: the s
     model: z.string().max(200).optional().describe('Model id or display name to narrow the verdict to one model (e.g. "Claude Opus 5.5" or "claude-opus-5-5"). Provide task or model.'),
     max_latency_p95_ms: z.number().optional().describe('Full tier only. Drop candidates whose measured p95 latency exceeds this value (ms).'),
     budget: z.number().optional().describe('Full tier only. Max blended USD per 1M tokens.'),
-    min_quality: z.number().min(0).max(1).optional().describe('Full tier only. Minimum trust-discounted quality score in [0, 1].'),
+    min_quality: z.number().min(0).max(1).optional().describe('Full tier only. Minimum quality in [0, 1] as a share of the best candidate measured on the same benchmark set (0.9 keeps models within 10 percent of the top).'),
     require_operational: z.boolean().optional().describe('Full tier only. Default true. Set false to keep candidates known down or in failover.'),
     exclude_deprecated: z.boolean().optional().describe('Full tier only. Default true. Set false to keep deprecated or sunsetted models.'),
 }, async ({ tier, task, model, max_latency_p95_ms, budget, min_quality, require_operational, exclude_deprecated }) => {

package/dist/pages.d.ts

@@ -0,0 +1,3 @@
+export declare const TOOL_PAGES: Record<string, string>;
+/** Appends the Source line as its own content item, leaving the data text byte-identical. */
+export declare function withSourceLine<T>(name: string, result: T): T;

package/dist/pages.js

@@ -0,0 +1,29 @@
+// The tensorfeed.ai page that shows each tool's data. A successful result
+// ends with a Source line naming it, so an assistant that cites TensorFeed
+// links a page a person can read rather than nothing or a JSON endpoint.
+// Mirrors worker/src/mcp-pages.ts for the tools both servers share.
+export const TOOL_PAGES = {
+    get_ai_news: 'https://tensorfeed.ai',
+    get_ai_status: 'https://tensorfeed.ai/status',
+    is_service_down: 'https://tensorfeed.ai/status',
+    get_model_pricing: 'https://tensorfeed.ai/models',
+    route_verdict: 'https://tensorfeed.ai/intelligence',
+    provider_reliability_verdict: 'https://tensorfeed.ai/status',
+    failover_verdict: 'https://tensorfeed.ai/status',
+    status_uptime: 'https://tensorfeed.ai/status',
+    status_leaderboard: 'https://tensorfeed.ai/status',
+    stack_safety_verdict: 'https://tensorfeed.ai/cve-watch',
+    ssvc_verdict: 'https://tensorfeed.ai/cve-watch',
+    benchmark_trust_verdict: 'https://tensorfeed.ai/benchmarks',
+    benchmark_series: 'https://tensorfeed.ai/benchmarks',
+    pricing_series: 'https://tensorfeed.ai/models',
+    compare_models: 'https://tensorfeed.ai/compare',
+};
+/** Appends the Source line as its own content item, leaving the data text byte-identical. */
+export function withSourceLine(name, result) {
+    const page = TOOL_PAGES[name];
+    const r = result;
+    if (!page || !r || r.isError || !Array.isArray(r.content))
+        return result;
+    return { ...r, content: [...r.content, { type: 'text', text: `Source: ${page}` }] };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tensorfeed/mcp-server",
-  "version": "2.0.4",
+  "version": "2.0.6",
   "mcpName": "ai.tensorfeed/mcp-server",
   "description": "MCP server for TensorFeed.ai - AI news, service status, model pricing, signed decision verdicts, time series, model comparison, webhook watches, and a discovery tool for the full TensorFeed data catalog, for AI agents",
   "main": "dist/index.js",
@@ -45,8 +45,8 @@
     "url": "https://github.com/RipperMercs/tensorfeed-mcp/issues"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.28.0",
-    "zod": "^4.3.6"
+    "@modelcontextprotocol/sdk": "^1.32.2",
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",

package/server.json

@@ -3,7 +3,7 @@
   "name": "ai.tensorfeed/mcp-server",
   "title": "TensorFeed",
   "description": "AI news, model pricing, service status, and machine-payable premium tools. AFTA-certified.",
-  "version": "2.0.4",
+  "version": "2.0.6",
   "websiteUrl": "https://tensorfeed.ai/developers/agent-payments",
   "repository": {
     "url": "https://github.com/RipperMercs/tensorfeed-mcp",
@@ -20,7 +20,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@tensorfeed/mcp-server",
-      "version": "2.0.4",
+      "version": "2.0.6",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"