bharatstock-mcp 0.2.0 → 0.2.2

package/CHANGELOG.md

@@ -2,15 +2,10 @@
 
 All notable changes to `bharatstock-mcp` are documented here (newest first).
 
-## 0.2.0 (2026-11-06)
-- Added an internal **operator mode** (not for customers). When the
-  `BHARATSTOCK_ADMIN_SECRET` env var is set alongside the API key, the server
-  additionally registers four support-ticket tools — `get_support_tickets`,
-  `get_support_ticket`, `set_ticket_status`, `log_ticket_event` — which call
-  the hosted MCP endpoint with that secret to list, inspect, and update
-  support tickets. A normal customer config (no admin secret) never registers
-  them, and the hosted server independently re-checks the secret, so the
-  consumer surface is unchanged.
+## 0.2.2 (2026-11-15)
+- Security maintenance: updated `@modelcontextprotocol/sdk` to ^1.32.2 (fixes the OAuth credential-binding, cross-session task access and request-size/DoS advisories), `zod` to ^4.6.7, and refreshed transitive dependencies (hono, body-parser, qs, fast-uri, ip-address). `npm audit` reports 0 vulnerabilities. No change to the tool surface or behaviour.
+## 0.2.1 (2026-11-06)
+- Maintenance release. No change to the tool surface or behaviour.
 
 ## 0.1.5 (2026-11-03)
 - Broadened the listing metadata for discoverability: a keyword-rich

package/README.md

@@ -127,8 +127,9 @@ This server is a thin layer over the official [`bharatstock`](https://www.npmjs.
 MIT
 
 ## Changelog
+- **0.2.2** (2026-11-15): security maintenance: updated `@modelcontextprotocol/sdk` to ^1.32.2 (fixes the OAuth credential-binding, cross-session task access and request-size/DoS advisories), `zod` to ^4.6.7, and refreshed transitive dependencies (hono, body-parser, qs, fast-uri, ip-address). `npm audit` reports 0 vulnerabilities. No change to the tool surface or behaviour.
 
-- **0.2.0** (2026-11-06): added an internal operator mode (not for customers). Setting `BHARATSTOCK_ADMIN_SECRET` alongside the API key registers four support-ticket management tools that call the hosted MCP endpoint with that secret. A normal customer config (no admin secret) is unaffected — the consumer tool surface is unchanged.
+- **0.2.1** (2026-11-06): maintenance release. No change to the tool surface or behaviour.
 - **0.1.5** (2026-11-03): broadened the registry/npm listing metadata — a keyword-rich `description` and expanded `keywords` (NSE, BSE, NIFTY, SENSEX, mutual funds, shareholding, FII/DII, corporate actions, screener, Indian equities) so the server is easier to find. No tool/schema change.
 - **0.1.4** (2026-11-03): published to the official MCP Registry as `com.bharatstockapi/bharatstock-mcp`. No tool/schema change.
 - **0.1.3** (2026-11-02): picks up `bharatstock` JS SDK 0.1.12, so the financials tool output now carries the as-filed segment reconciliation fields — `segmentResultsTotal` (the filing's own segment total) and `segmentNotes` / `resultsNotes` (the narrative note blocks; the segment note carries the unallocated/elimination/exceptional reconciliation in prose). Pass-through via the SDK; no tool/schema change.

package/dist/{chunk-NXHQTUBJ.js → chunk-PWPXQCNU.js}

@@ -41,115 +41,9 @@ async function checkAuthorization(baseUrl, apiKey, fetchImpl = fetch) {
 // src/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { BharatStock } from "bharatstock";
-import { z as z2 } from "zod";
-
-// src/operator.ts
 import { z } from "zod";
-async function callOperatorTool(opts, name, args) {
-  const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
-  const url = `${opts.baseUrl.replace(/\/$/, "")}/v1/mcp`;
-  const rpc = {
-    jsonrpc: "2.0",
-    id: Date.now(),
-    method: "tools/call",
-    params: { name, arguments: args }
-  };
-  try {
-    const resp = await fetchImpl(url, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        "X-Admin-Secret": opts.adminSecret
-      },
-      body: JSON.stringify(rpc)
-    });
-    const bodyText = await resp.text();
-    let body;
-    try {
-      body = JSON.parse(bodyText);
-    } catch {
-      body = void 0;
-    }
-    if (!resp.ok) {
-      const msg = body?.error?.message || bodyText.slice(0, 500) || `HTTP ${resp.status}`;
-      return { isError: true, content: [{ type: "text", text: `BharatStock operator error: ${msg}` }] };
-    }
-    const rpcErr = body?.error;
-    if (rpcErr) {
-      return { isError: true, content: [{ type: "text", text: `BharatStock operator error: ${rpcErr.message}` }] };
-    }
-    const result = body?.result;
-    if (result && Array.isArray(result.content)) {
-      return result;
-    }
-    return { content: [{ type: "text", text: JSON.stringify(body, null, 2) }] };
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    return { isError: true, content: [{ type: "text", text: `BharatStock operator transport error: ${message}` }] };
-  }
-}
-function registerOperatorTools(server, opts) {
-  server.registerTool(
-    "get_support_tickets",
-    {
-      title: "List support tickets (operator)",
-      description: "OPERATOR-ONLY. List support tickets (customer feedback/email reports) with status (open/investigating/waiting/resolved/closed, or 'all') and category filters. Default shows the live queue (excludes resolved/closed).",
-      inputSchema: {
-        status: z.string().optional(),
-        category: z.string().optional(),
-        limit: z.number().int().positive().optional(),
-        offset: z.number().int().nonnegative().optional()
-      }
-    },
-    async (args) => callOperatorTool(opts, "get_support_tickets", args)
-  );
-  server.registerTool(
-    "get_support_ticket",
-    {
-      title: "Get one support ticket in full (operator)",
-      description: "OPERATOR-ONLY. One support ticket in full: the original message, its activity trail (status changes, notes, fixes applied), and any drafted reply. Use this to pick up a ticket and see everything already tried.",
-      inputSchema: { id: z.number().int().positive() }
-    },
-    async (args) => callOperatorTool(opts, "get_support_ticket", args)
-  );
-  server.registerTool(
-    "set_ticket_status",
-    {
-      title: "Set a support ticket's status (operator, write)",
-      description: "OPERATOR-ONLY WRITE. Transition a ticket's status (open/investigating/waiting/resolved/closed) with an optional note. Moving to resolved/closed with a note records the resolution summary.",
-      inputSchema: {
-        id: z.number().int().positive(),
-        status: z.enum(["open", "investigating", "waiting", "resolved", "closed"]),
-        note: z.string().optional()
-      }
-    },
-    async (args) => callOperatorTool(opts, "set_ticket_status", args)
-  );
-  server.registerTool(
-    "log_ticket_event",
-    {
-      title: "Append an event to a ticket's trail (operator, write)",
-      description: "OPERATOR-ONLY WRITE. Append an entry to a ticket's activity trail, e.g. event_type='fix_applied', detail='ran fix_eps_sign, 4 rows, DQ green'. event_type one of status_change/note/reply_sent/fix_applied/reopened/category_change.",
-      inputSchema: {
-        id: z.number().int().positive(),
-        event_type: z.enum([
-          "status_change",
-          "note",
-          "reply_sent",
-          "fix_applied",
-          "reopened",
-          "category_change"
-        ]),
-        detail: z.string().min(1)
-      }
-    },
-    async (args) => callOperatorTool(opts, "log_ticket_event", args)
-  );
-}
-
-// src/server.ts
 var SERVER_NAME = "bharatstock";
-var SERVER_VERSION = "0.2.0";
+var SERVER_VERSION = "0.2.2";
 async function run(fn) {
   try {
     const data = await fn();
@@ -165,13 +59,12 @@ async function run(fn) {
   }
 }
 function buildServer(options = {}) {
-  const { adminSecret, operatorFetchImpl, ...sdkOptions } = options;
-  const client = new BharatStock(sdkOptions);
+  const client = new BharatStock(options);
   const server = new McpServer({ name: SERVER_NAME, version: SERVER_VERSION });
-  const ticker = z2.string().describe("NSE/BSE ticker symbol (e.g. RELIANCE, TCS) or ISIN.");
-  const exchange = z2.enum(["NSE", "BSE"]).optional().describe("Optional exchange to disambiguate a cross-listed stock.");
-  const fromDate = z2.string().optional().describe("Start date, YYYY-MM-DD (inclusive).");
-  const toDate = z2.string().optional().describe("End date, YYYY-MM-DD (inclusive).");
+  const ticker = z.string().describe("NSE/BSE ticker symbol (e.g. RELIANCE, TCS) or ISIN.");
+  const exchange = z.enum(["NSE", "BSE"]).optional().describe("Optional exchange to disambiguate a cross-listed stock.");
+  const fromDate = z.string().optional().describe("Start date, YYYY-MM-DD (inclusive).");
+  const toDate = z.string().optional().describe("End date, YYYY-MM-DD (inclusive).");
   server.registerTool(
     "get_stock_quote",
     {
@@ -196,7 +89,7 @@ function buildServer(options = {}) {
       title: "Get quotes for multiple stocks",
       description: "Latest price snapshot for up to 50 tickers in one call. Prefer this over many get_stock_quote calls when comparing several stocks.",
       inputSchema: {
-        symbols: z2.array(z2.string()).min(1).max(50).describe("List of ticker symbols (max 50).")
+        symbols: z.array(z.string()).min(1).max(50).describe("List of ticker symbols (max 50).")
       }
     },
     async ({ symbols }) => run(() => client.stocks.quotes(symbols))
@@ -211,8 +104,8 @@ function buildServer(options = {}) {
         fromDate,
         toDate,
         exchange,
-        page: z2.number().int().positive().optional(),
-        pageSize: z2.number().int().positive().max(500).optional()
+        page: z.number().int().positive().optional(),
+        pageSize: z.number().int().positive().max(500).optional()
       }
     },
     async ({ ticker: ticker2, fromDate: fromDate2, toDate: toDate2, exchange: exchange2, page, pageSize }) => run(() => client.stocks.prices(ticker2, { fromDate: fromDate2, toDate: toDate2, exchange: exchange2, page, pageSize }))
@@ -224,10 +117,10 @@ function buildServer(options = {}) {
       description: "Quarterly or annual financial statements (P&L, balance sheet, cash flow) for a stock, as filed with the exchange. Set periodType to 'annual' for yearly figures or 'quarterly' for quarterly results.",
       inputSchema: {
         ticker,
-        periodType: z2.enum(["quarterly", "annual"]).optional().describe("Reporting cadence. Defaults to quarterly."),
+        periodType: z.enum(["quarterly", "annual"]).optional().describe("Reporting cadence. Defaults to quarterly."),
         exchange,
-        page: z2.number().int().positive().optional(),
-        pageSize: z2.number().int().positive().max(50).optional()
+        page: z.number().int().positive().optional(),
+        pageSize: z.number().int().positive().max(50).optional()
       }
     },
     async ({ ticker: ticker2, periodType, exchange: exchange2, page, pageSize }) => run(() => client.stocks.financials(ticker2, { periodType, exchange: exchange2, page, pageSize }))
@@ -251,8 +144,8 @@ function buildServer(options = {}) {
         fromDate,
         toDate,
         exchange,
-        page: z2.number().int().positive().optional(),
-        pageSize: z2.number().int().positive().max(500).optional()
+        page: z.number().int().positive().optional(),
+        pageSize: z.number().int().positive().max(500).optional()
       }
     },
     async ({ ticker: ticker2, fromDate: fromDate2, toDate: toDate2, exchange: exchange2, page, pageSize }) => run(
@@ -267,8 +160,8 @@ function buildServer(options = {}) {
       inputSchema: {
         ticker,
         exchange,
-        page: z2.number().int().positive().optional(),
-        pageSize: z2.number().int().positive().max(50).optional()
+        page: z.number().int().positive().optional(),
+        pageSize: z.number().int().positive().max(50).optional()
       }
     },
     async ({ ticker: ticker2, exchange: exchange2, page, pageSize }) => run(() => client.stocks.shareholding(ticker2, { exchange: exchange2, page, pageSize }))
@@ -280,10 +173,10 @@ function buildServer(options = {}) {
       description: "Corporate actions for a stock: dividends, bonuses, stock splits, rights issues, and buybacks, with ex-dates.",
       inputSchema: {
         ticker,
-        actionType: z2.string().optional().describe("Filter by type, e.g. dividend, bonus, split."),
+        actionType: z.string().optional().describe("Filter by type, e.g. dividend, bonus, split."),
         exchange,
-        page: z2.number().int().positive().optional(),
-        pageSize: z2.number().int().positive().max(50).optional()
+        page: z.number().int().positive().optional(),
+        pageSize: z.number().int().positive().max(50).optional()
       }
     },
     async ({ ticker: ticker2, actionType, exchange: exchange2, page, pageSize }) => run(() => client.stocks.corporateActions(ticker2, { actionType, exchange: exchange2, page, pageSize }))
@@ -295,8 +188,8 @@ function buildServer(options = {}) {
       description: "Bulk deals reported for a specific stock.",
       inputSchema: {
         ticker,
-        page: z2.number().int().positive().optional(),
-        pageSize: z2.number().int().positive().max(100).optional()
+        page: z.number().int().positive().optional(),
+        pageSize: z.number().int().positive().max(100).optional()
       }
     },
     async ({ ticker: ticker2, page, pageSize }) => run(() => client.stocks.bulkDeals(ticker2, { page, pageSize }))
@@ -308,8 +201,8 @@ function buildServer(options = {}) {
       description: "Block deals reported for a specific stock.",
       inputSchema: {
         ticker,
-        page: z2.number().int().positive().optional(),
-        pageSize: z2.number().int().positive().max(100).optional()
+        page: z.number().int().positive().optional(),
+        pageSize: z.number().int().positive().max(100).optional()
       }
     },
     async ({ ticker: ticker2, page, pageSize }) => run(() => client.stocks.blockDeals(ticker2, { page, pageSize }))
@@ -321,8 +214,8 @@ function buildServer(options = {}) {
       description: "SEBI PIT insider-trading disclosures for a specific stock.",
       inputSchema: {
         ticker,
-        page: z2.number().int().positive().optional(),
-        pageSize: z2.number().int().positive().max(100).optional()
+        page: z.number().int().positive().optional(),
+        pageSize: z.number().int().positive().max(100).optional()
       }
     },
     async ({ ticker: ticker2, page, pageSize }) => run(() => client.stocks.insiderTrades(ticker2, { page, pageSize }))
@@ -333,9 +226,9 @@ function buildServer(options = {}) {
       title: "Compare peers in a sector",
       description: "Compare valuation/profitability ratios across the peers in a sector, for a quick relative-value view.",
       inputSchema: {
-        sector: z2.string().describe("Sector name, e.g. 'Information Technology'."),
-        sort: z2.string().optional().describe("Sort key, e.g. market_cap, pe_ratio."),
-        limit: z2.number().int().positive().max(100).optional()
+        sector: z.string().describe("Sector name, e.g. 'Information Technology'."),
+        sort: z.string().optional().describe("Sort key, e.g. market_cap, pe_ratio."),
+        limit: z.number().int().positive().max(100).optional()
       }
     },
     async ({ sector, sort, limit }) => run(() => client.stocks.compare(sector, { sort, limit }))
@@ -346,8 +239,8 @@ function buildServer(options = {}) {
       title: "Search stocks",
       description: "Fuzzy-search listed stocks by ticker symbol or company name. Use this to resolve a company name to a ticker before calling other tools.",
       inputSchema: {
-        q: z2.string().describe("Search text (symbol fragment or company name)."),
-        limit: z2.number().int().positive().max(50).optional()
+        q: z.string().describe("Search text (symbol fragment or company name)."),
+        limit: z.number().int().positive().max(50).optional()
       }
     },
     async ({ q, limit }) => run(() => client.search(q, { limit }))
@@ -358,8 +251,8 @@ function buildServer(options = {}) {
       title: "Get top market movers",
       description: "Ranked market movers: top gainers, top losers, or most-active stocks for the latest trading session. Use category to pick which.",
       inputSchema: {
-        category: z2.enum(["gainers", "losers", "active"]).optional().describe("Which ranking. Defaults to gainers."),
-        limit: z2.number().int().positive().max(100).optional()
+        category: z.enum(["gainers", "losers", "active"]).optional().describe("Which ranking. Defaults to gainers."),
+        limit: z.number().int().positive().max(100).optional()
       }
     },
     async ({ category, limit }) => run(() => client.movers({ category, limit }))
@@ -370,9 +263,9 @@ function buildServer(options = {}) {
       title: "Get price shockers",
       description: "Stocks that moved at least a threshold percentage vs the previous close, in either direction.",
       inputSchema: {
-        minChangePct: z2.number().positive().optional().describe("Minimum abs % move. Default 5."),
-        direction: z2.enum(["up", "down", "both"]).optional(),
-        limit: z2.number().int().positive().max(100).optional()
+        minChangePct: z.number().positive().optional().describe("Minimum abs % move. Default 5."),
+        direction: z.enum(["up", "down", "both"]).optional(),
+        limit: z.number().int().positive().max(100).optional()
       }
     },
     async ({ minChangePct, direction, limit }) => run(() => client.priceShockers({ minChangePct, direction, limit }))
@@ -383,13 +276,13 @@ function buildServer(options = {}) {
       title: "Run stock screener",
       description: "Screen stocks by fundamental filters. `filters` is a list of 'metric.operator.value' strings, e.g. ['pe_ratio.lt.15', 'roe.gt.18']. marketCap filter values are in Crores. Optionally scope by sector.",
       inputSchema: {
-        filters: z2.array(z2.string()).optional().describe("Filter expressions like 'pe_ratio.lt.15'."),
-        sector: z2.string().optional(),
+        filters: z.array(z.string()).optional().describe("Filter expressions like 'pe_ratio.lt.15'."),
+        sector: z.string().optional(),
         exchange,
-        sortBy: z2.string().optional().describe("Sort key, default market_cap."),
-        sortOrder: z2.enum(["asc", "desc"]).optional(),
-        page: z2.number().int().positive().optional(),
-        pageSize: z2.number().int().positive().max(100).optional()
+        sortBy: z.string().optional().describe("Sort key, default market_cap."),
+        sortOrder: z.enum(["asc", "desc"]).optional(),
+        page: z.number().int().positive().optional(),
+        pageSize: z.number().int().positive().max(100).optional()
       }
     },
     async ({ filters, sector, exchange: exchange2, sortBy, sortOrder, page, pageSize }) => run(
@@ -402,8 +295,8 @@ function buildServer(options = {}) {
       title: "List indices",
       description: "List market indices (NIFTY 50, SENSEX, sectoral indices, etc.) with their latest values.",
       inputSchema: {
-        page: z2.number().int().positive().optional(),
-        pageSize: z2.number().int().positive().max(200).optional()
+        page: z.number().int().positive().optional(),
+        pageSize: z.number().int().positive().max(200).optional()
       }
     },
     async ({ page, pageSize }) => run(() => client.indices.list({ page, pageSize }))
@@ -414,11 +307,11 @@ function buildServer(options = {}) {
       title: "Get historical index prices",
       description: "Historical daily values for an index over a date range. Free-tier keys get a recent window; paid keys get the full archive.",
       inputSchema: {
-        name: z2.string().describe("Index name, e.g. 'NIFTY 50'."),
+        name: z.string().describe("Index name, e.g. 'NIFTY 50'."),
         fromDate,
         toDate,
-        page: z2.number().int().positive().optional(),
-        pageSize: z2.number().int().positive().max(500).optional()
+        page: z.number().int().positive().optional(),
+        pageSize: z.number().int().positive().max(500).optional()
       }
     },
     async ({ name, fromDate: fromDate2, toDate: toDate2, page, pageSize }) => run(() => client.indices.prices(name, { fromDate: fromDate2, toDate: toDate2, page, pageSize }))
@@ -431,8 +324,8 @@ function buildServer(options = {}) {
       inputSchema: {
         fromDate,
         toDate,
-        limit: z2.number().int().positive().max(500).optional(),
-        latest: z2.boolean().optional().describe("Return only the most recent day.")
+        limit: z.number().int().positive().max(500).optional(),
+        latest: z.boolean().optional().describe("Return only the most recent day.")
       }
     },
     async ({ fromDate: fromDate2, toDate: toDate2, limit, latest }) => run(() => client.market.fiiDii({ fromDate: fromDate2, toDate: toDate2, limit, latest }))
@@ -443,9 +336,9 @@ function buildServer(options = {}) {
       title: "Get market-wide bulk deals",
       description: "Bulk deals across the whole market for the latest sessions.",
       inputSchema: {
-        buySell: z2.enum(["BUY", "SELL"]).optional(),
-        page: z2.number().int().positive().optional(),
-        pageSize: z2.number().int().positive().max(100).optional()
+        buySell: z.enum(["BUY", "SELL"]).optional(),
+        page: z.number().int().positive().optional(),
+        pageSize: z.number().int().positive().max(100).optional()
       }
     },
     async ({ buySell, page, pageSize }) => run(() => client.deals.bulk({ buySell, page, pageSize }))
@@ -456,9 +349,9 @@ function buildServer(options = {}) {
       title: "Get market-wide block deals",
       description: "Block deals across the whole market for the latest sessions.",
       inputSchema: {
-        buySell: z2.enum(["BUY", "SELL"]).optional(),
-        page: z2.number().int().positive().optional(),
-        pageSize: z2.number().int().positive().max(100).optional()
+        buySell: z.enum(["BUY", "SELL"]).optional(),
+        page: z.number().int().positive().optional(),
+        pageSize: z.number().int().positive().max(100).optional()
       }
     },
     async ({ buySell, page, pageSize }) => run(() => client.deals.block({ buySell, page, pageSize }))
@@ -469,8 +362,8 @@ function buildServer(options = {}) {
       title: "Get market-wide insider trades",
       description: "SEBI PIT insider-trading disclosures across the whole market.",
       inputSchema: {
-        page: z2.number().int().positive().optional(),
-        pageSize: z2.number().int().positive().max(100).optional()
+        page: z.number().int().positive().optional(),
+        pageSize: z.number().int().positive().max(100).optional()
       }
     },
     async ({ page, pageSize }) => run(() => client.deals.insiderTrades({ page, pageSize }))
@@ -481,14 +374,14 @@ function buildServer(options = {}) {
       title: "Search mutual-fund schemes",
       description: "List/search mutual-fund schemes across all AMCs (industry-wide AMFI dataset). Filter by name (q), AMC, category, plan (Direct/Regular), option (Growth/IDCW), or exact ISIN. Use this to find a scheme_code.",
       inputSchema: {
-        q: z2.string().optional(),
-        amc: z2.string().optional(),
-        category: z2.string().optional(),
-        plan: z2.string().optional(),
-        option: z2.string().optional(),
-        isin: z2.string().optional(),
-        limit: z2.number().int().positive().max(200).optional(),
-        offset: z2.number().int().nonnegative().optional()
+        q: z.string().optional(),
+        amc: z.string().optional(),
+        category: z.string().optional(),
+        plan: z.string().optional(),
+        option: z.string().optional(),
+        isin: z.string().optional(),
+        limit: z.number().int().positive().max(200).optional(),
+        offset: z.number().int().nonnegative().optional()
       }
     },
     async (args) => run(() => client.mutualFunds.listSchemes(args))
@@ -499,7 +392,7 @@ function buildServer(options = {}) {
       title: "Get mutual-fund scheme detail",
       description: "One scheme's identity plus its latest NAV (with as-of date).",
       inputSchema: {
-        schemeCode: z2.string().describe("AMFI scheme code.")
+        schemeCode: z.string().describe("AMFI scheme code.")
       }
     },
     async ({ schemeCode }) => run(() => client.mutualFunds.getScheme(schemeCode))
@@ -510,10 +403,10 @@ function buildServer(options = {}) {
       title: "Get mutual-fund NAV history",
       description: "Daily NAV history for a scheme, most recent first. Free-tier keys are limited to a recent window; paid keys get the full archive.",
       inputSchema: {
-        schemeCode: z2.string().describe("AMFI scheme code."),
+        schemeCode: z.string().describe("AMFI scheme code."),
         fromDate,
         toDate,
-        limit: z2.number().int().positive().max(2e3).optional()
+        limit: z.number().int().positive().max(2e3).optional()
       }
     },
     async ({ schemeCode, fromDate: fromDate2, toDate: toDate2, limit }) => run(() => client.mutualFunds.nav(schemeCode, { fromDate: fromDate2, toDate: toDate2, limit }))
@@ -524,7 +417,7 @@ function buildServer(options = {}) {
       title: "Get mutual-fund trailing returns",
       description: "Trailing returns (1m/3m/6m/1y/3y/5y + since-inception) computed from the scheme's NAV series (CAGR for >=1y horizons).",
       inputSchema: {
-        schemeCode: z2.string().describe("AMFI scheme code.")
+        schemeCode: z.string().describe("AMFI scheme code.")
       }
     },
     async ({ schemeCode }) => run(() => client.mutualFunds.returns(schemeCode))
@@ -536,9 +429,9 @@ function buildServer(options = {}) {
       description: "Which mutual-fund schemes hold a given stock (portfolio positions aggregated per stock), optionally for a specific portfolio month. Answers 'which funds own X'.",
       inputSchema: {
         ticker,
-        month: z2.string().optional().describe("Portfolio month YYYY-MM-DD (month-end). Latest if omitted."),
-        page: z2.number().int().positive().optional(),
-        pageSize: z2.number().int().positive().max(200).optional()
+        month: z.string().optional().describe("Portfolio month YYYY-MM-DD (month-end). Latest if omitted."),
+        page: z.number().int().positive().optional(),
+        pageSize: z.number().int().positive().max(200).optional()
       }
     },
     async ({ ticker: ticker2, month, page, pageSize }) => run(() => client.stocks.mfHoldings(ticker2, { month, page, pageSize }))
@@ -549,10 +442,10 @@ function buildServer(options = {}) {
       title: "List / search mutual-fund portfolios",
       description: "List/search the mutual-fund schemes we hold monthly PORTFOLIO data for (scheme discovery, to populate a picker). This is the INVERSE of get_mutual_fund_holdings: that answers 'which funds own stock X', this answers 'which schemes do we have portfolios for'. Each row is keyed by the holdings scheme-NAME string (NOT the AMFI scheme_code used by the scheme/NAV tools) and has no Direct/Regular distinction, since AMFI publishes monthly portfolios at the scheme level. Use the returned scheme_name with get_mutual_fund_portfolio_holdings.",
       inputSchema: {
-        q: z2.string().optional().describe("Substring match on scheme name."),
-        fundHouse: z2.string().optional().describe("Filter by fund house (substring)."),
-        limit: z2.number().int().positive().max(200).optional(),
-        offset: z2.number().int().nonnegative().optional()
+        q: z.string().optional().describe("Substring match on scheme name."),
+        fundHouse: z.string().optional().describe("Filter by fund house (substring)."),
+        limit: z.number().int().positive().max(200).optional(),
+        offset: z.number().int().nonnegative().optional()
       }
     },
     async ({ q, fundHouse, limit, offset }) => run(() => client.mutualFunds.listPortfolios({ q, fundHouse, limit, offset }))
@@ -563,10 +456,10 @@ function buildServer(options = {}) {
       title: "Get a mutual-fund scheme's portfolio holdings",
       description: "One scheme's equity PORTFOLIO for a month (the stocks it holds) with month-over-month quantity change. The INVERSE of get_mutual_fund_holdings (which funds own a stock). schemeName must match the stored holdings name exactly, as returned by list_mutual_fund_portfolios \u2014 it is the scheme-NAME string, NOT the AMFI scheme_code. month is 'YYYY-MM' (latest if omitted). An unknown scheme name returns an empty portfolio, not an error.",
       inputSchema: {
-        schemeName: z2.string().describe("Holdings scheme name, exactly as returned by list_mutual_fund_portfolios."),
-        month: z2.string().optional().describe("Portfolio month YYYY-MM. Latest if omitted."),
-        page: z2.number().int().positive().optional(),
-        pageSize: z2.number().int().positive().max(100).optional()
+        schemeName: z.string().describe("Holdings scheme name, exactly as returned by list_mutual_fund_portfolios."),
+        month: z.string().optional().describe("Portfolio month YYYY-MM. Latest if omitted."),
+        page: z.number().int().positive().optional(),
+        pageSize: z.number().int().positive().max(100).optional()
       }
     },
     async ({ schemeName, month, page, pageSize }) => run(() => client.mutualFunds.getPortfolioHoldings(schemeName, { month, page, pageSize }))
@@ -580,10 +473,6 @@ function buildServer(options = {}) {
     },
     async () => run(() => client.status())
   );
-  if (adminSecret) {
-    const baseUrl = sdkOptions.baseUrl ?? "https://bharatstockapi.com";
-    registerOperatorTools(server, { baseUrl, adminSecret, fetchImpl: operatorFetchImpl });
-  }
   return server;
 }
 

package/dist/http.js

@@ -2,7 +2,7 @@
 import {
   buildServer,
   checkAuthorization
-} from "./chunk-NXHQTUBJ.js";
+} from "./chunk-PWPXQCNU.js";
 
 // src/http.ts
 import { randomUUID } from "crypto";

package/dist/index.d.ts

@@ -1,34 +1,6 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { BharatStockOptions } from 'bharatstock';
 
-/**
- * OPERATOR mode for the BharatStock MCP server.
- *
- * These tools are for the operator ONLY — they manage support tickets and are
- * NOT part of the consumer surface. They are registered only when a
- * `BHARATSTOCK_ADMIN_SECRET` is configured (see index.ts), and they do NOT go
- * through the consumer `bharatstock` SDK (which is X-API-Key scoped and knows
- * nothing about tickets). Instead each tool makes a JSON-RPC `tools/call` to
- * the hosted MCP endpoint `POST {baseUrl}/v1/mcp` with an `X-Admin-Secret`
- * header — the server exposes the operator tool catalogue only to a request
- * that carries a valid admin secret (see app/api/v1/mcp.py).
- *
- * So the wall is end-to-end: a normal (API-key) MCP session never sees these
- * tools (they aren't registered), and even if a tool name were guessed, the
- * hosted server rejects an operator tool without the admin secret.
- */
-
-type FetchLike = (input: string, init?: {
-    method?: string;
-    headers?: Record<string, string>;
-    body?: string;
-}) => Promise<{
-    ok: boolean;
-    status: number;
-    text: () => Promise<string>;
-    json: () => Promise<unknown>;
-}>;
-
 /**
  * Builds the BharatStock MCP server: a thin layer that exposes the
  * BharatStock REST API's consumer-facing (X-API-Key gated) endpoints as
@@ -42,25 +14,14 @@ type FetchLike = (input: string, init?: {
  */
 
 declare const SERVER_NAME = "bharatstock";
-declare const SERVER_VERSION = "0.2.0";
-/** Extra, non-consumer options for buildServer. When `adminSecret` is set the
- * OPERATOR ticket tools are additionally registered (see operator.ts); they
- * are absent otherwise, so a normal consumer session never sees them. */
-interface BuildServerExtras {
-    /** Operator admin secret. When present, register the support-ticket tools. */
-    adminSecret?: string;
-    /** Injectable fetch for the operator tools' JSON-RPC calls (tests). Named
-     * distinctly from the SDK's own `fetchImpl` so the two don't collide when
-     * the options objects are intersected. */
-    operatorFetchImpl?: FetchLike;
-}
+declare const SERVER_VERSION = "0.2.2";
 /**
  * Construct the MCP server and register all tools against a BharatStock
  * client. Exposed separately from the stdio wiring so tests can build a
  * server with an injected `fetchImpl` and drive it over an in-memory
  * transport (no network, no real key).
  */
-declare function buildServer(options?: BharatStockOptions & BuildServerExtras): McpServer;
+declare function buildServer(options?: BharatStockOptions): McpServer;
 
 /**
  * Shared plan-gate check for both the stdio and HTTP transports.

package/dist/index.js

@@ -4,7 +4,7 @@ import {
   SERVER_VERSION,
   buildServer,
   checkAuthorization
-} from "./chunk-NXHQTUBJ.js";
+} from "./chunk-PWPXQCNU.js";
 
 // src/index.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -25,11 +25,7 @@ async function main() {
 `);
     process.exit(1);
   }
-  const adminSecret = process.env.BHARATSTOCK_ADMIN_SECRET || void 0;
-  if (adminSecret) {
-    process.stderr.write("bharatstock-mcp: operator mode ON (support-ticket tools registered).\n");
-  }
-  const server = buildServer({ apiKey, baseUrl, adminSecret });
+  const server = buildServer({ apiKey, baseUrl });
   const transport = new StdioServerTransport();
   await server.connect(transport);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bharatstock-mcp",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "mcpName": "com.bharatstockapi/bharatstock-mcp",
   "description": "Official Model Context Protocol (MCP) server for the BharatStock API - Indian stock market data (NSE/BSE) as AI-agent tools: real-time quotes, EOD prices, financial statements, ratios, shareholding patterns (FII/DII/promoter), corporate actions, NIFTY/SENSEX indices, mutual fund holdings and NAVs, FII/DII activity, bulk/block deals, insider trades, and a fundamentals stock screener for Indian equities.",
   "license": "MIT",
@@ -54,13 +54,13 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.12.0",
+    "@modelcontextprotocol/sdk": "^1.32.2",
     "bharatstock": "^0.1.12",
-    "zod": "^3.23.8"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
-    "tsup": "^8.0.2",
+    "tsup": "^9.0.0",
     "typescript": "^5.5.4",
     "vitest": "^5.0.0"
   }