agent402-mcp 0.12.11 → 0.12.12
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/index.js +10 -0
- package/package.json +1 -1
package/index.js
CHANGED
|
@@ -671,6 +671,10 @@ server.setRequestHandler(CallToolRequestSchema, async (req) => {
|
|
|
671
671
|
payersWindow: r.payers,
|
|
672
672
|
volumeUsdc7d: Math.round((r.d7?.volumeUsdc || 0) * 10000) / 10000,
|
|
673
673
|
routable: !!r.routable,
|
|
674
|
+
// Seller names/homepages are self-reported third-party content (same
|
|
675
|
+
// F09 rule as the hosted connector): never let a downstream agent read
|
|
676
|
+
// seller copy as an instruction.
|
|
677
|
+
...(r.self ? {} : { untrustedContent: true }),
|
|
674
678
|
}));
|
|
675
679
|
return mcpJsonResult({
|
|
676
680
|
wire: "mpp",
|
|
@@ -680,6 +684,7 @@ server.setRequestHandler(CallToolRequestSchema, async (req) => {
|
|
|
680
684
|
sort, include,
|
|
681
685
|
totalSellers: Array.isArray(lb.rows) ? lb.rows.length : 0,
|
|
682
686
|
results: rows,
|
|
687
|
+
...(rows.some((r) => r.untrustedContent) ? { containsUntrustedContent: true } : {}),
|
|
683
688
|
...(lb.stale ? { note: "Leaderboard is stale or still warming - retry in a few minutes." } : {}),
|
|
684
689
|
source: `${BASE}/api/mpp-leaderboard`,
|
|
685
690
|
});
|
|
@@ -703,6 +708,9 @@ server.setRequestHandler(CallToolRequestSchema, async (req) => {
|
|
|
703
708
|
// Trim to the same compact row shape the hosted MCP connector returns —
|
|
704
709
|
// cross-surface agents see one mental model. Full row (origins,
|
|
705
710
|
// endpoints, scan metadata) stays accessible at /api/leaderboard.
|
|
711
|
+
// Same untrusted-content marking as the hosted connector: a seller's
|
|
712
|
+
// name/homepage is self-reported external content. `snap.self` (or a
|
|
713
|
+
// row flagged self) is this host's own wallet when the API says so.
|
|
706
714
|
const rows = (snap.leaderboard || []).map((r) => ({
|
|
707
715
|
rank: r.rank,
|
|
708
716
|
name: r.name,
|
|
@@ -712,8 +720,10 @@ server.setRequestHandler(CallToolRequestSchema, async (req) => {
|
|
|
712
720
|
callsSettled: r.callsSettled || 0,
|
|
713
721
|
totalUsd: Math.round((r.totalUsd || 0) * 10000) / 10000,
|
|
714
722
|
uniqueBuyers: r.uniqueBuyers || 0,
|
|
723
|
+
...(r.self ? {} : { untrustedContent: true }),
|
|
715
724
|
}));
|
|
716
725
|
return mcpJsonResult({
|
|
726
|
+
...(rows.some((r) => r.untrustedContent) ? { containsUntrustedContent: true } : {}),
|
|
717
727
|
window: snap.windowLabel || snap.windowServed || "24h",
|
|
718
728
|
asOf: snap.asOf,
|
|
719
729
|
sort: snap.sortServed || sort,
|
package/package.json
CHANGED