data-compliance-mcp 1.0.23 → 1.0.25

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [1.0.25] - 2026-06-25
+- feat: calls_remaining field added to every successful tool response -- "unlimited" for paid keys, numeric free-tier headroom otherwise
+- feat: verdict_ttl field added to validate_data_safety, validate_data_safety_lite, get_safety_report responses (86400s/24h each)
+- feat: data_source_status field added (full/degraded/partial) -- get_safety_report BATCH mode reports "degraded" when AI classification fails for any individual payload in the batch (AI is the critical source for this server); validate_data_safety_lite is always "full" (pattern-only, no AI dependency)
+
+## [1.0.24] - 2026-06-24
+- feat: unauthenticated /public-stats endpoint -- first_deployed, lifetime tool calls, uptime %, version, for agent orchestrators evaluating server trustworthiness
+- feat: /process-trial-followups endpoint + 24h follow-up record on trial-extension grant
+- feat: gate responses now self-contained (server + workflow impact + upgrade path in one sentence) and detect cross-server operators via shared fleet Redis, with cross-server trial-extension note
+- feat: outputSchema added to all 3 tools (additive, response format unchanged)
+- fix: smithery.yaml claimed "2 focused tools" -- this server has 3 (validate_data_safety, get_safety_report, validate_data_safety_lite). Also added validate_data_safety_lite to glama.json and README, which only listed the other 2
+
 ## [1.0.23] - 2026-06-23
 - fix: gate returns HTTP 402 (x402 standard for non-transient quota)
 

package/README.md

@@ -48,6 +48,10 @@ Batch classification for up to 50 payloads plus audit-ready compliance reports.
 - `BATCH` — classify multiple payloads with full AI reasoning + AbuseIPDB threat intelligence
 - `AUDIT` — generate a structured compliance report for a dataset description
 
+### `validate_data_safety_lite` (free tier)
+
+Pattern-only screening for high-volume payload batches -- no AI classification, no IP check, no jurisdiction lookup. Returns SAFE_TO_PROCESS / REVIEW_REQUIRED in under 100ms. Use to filter large batches before selectively running `validate_data_safety` on flagged items.
+
 ## Data privacy
 
 We do not store or log your data payloads. All payloads are analysed in memory and immediately discarded. Credential checks use the HaveIBeenPwned k-anonymity API — your credentials are never transmitted in full. Only the first 5 characters of a SHA-1 hash are sent.

package/glama.json

@@ -13,6 +13,10 @@
     {
       "name": "get_safety_report",
       "description": "Batch classify up to 50 payloads or generate an audit-ready compliance report. Paid tier."
+    },
+    {
+      "name": "validate_data_safety_lite",
+      "description": "Pattern-only screening for high-volume payload batches -- no AI, no IP check, no jurisdiction lookup. Returns SAFE_TO_PROCESS/REVIEW_REQUIRED in under 100ms."
     }
   ]
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "data-compliance-mcp",
   "mcpName": "io.github.OjasKord/data-compliance-mcp",
-  "version": "1.0.23",
+  "version": "1.0.25",
   "description": "Data safety classifier for AI agents. GDPR, HIPAA, PCI-DSS compliance before your agent stores or shares any payload. SAFE/ESCALATE verdict in one call.",
   "main": "src/server.js",
   "scripts": {

package/server.json

@@ -1,42 +1,42 @@
-{
-  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
-  "name": "io.github.OjasKord/data-compliance-mcp",
-  "title": "Data Compliance Classifier MCP",
-  "description": "Classify data safety before storing or sharing. GDPR, HIPAA, PCI-DSS, CCPA. AI-powered.",
-  "version": "1.0.19",
-  "websiteUrl": "https://kordagencies.com",
-  "repository": {
-    "url": "https://github.com/OjasKord/data-compliance-mcp",
-    "source": "github"
-  },
-  "packages": [
-    {
-      "registryType": "npm",
-      "identifier": "data-compliance-mcp",
-      "version": "1.0.19",
-      "transport": {
-        "type": "stdio"
-      },
-      "environmentVariables": [
-        {
-          "name": "ANTHROPIC_API_KEY",
-          "description": "Anthropic API key for AI classification",
-          "isRequired": true,
-          "isSecret": true
-        },
-        {
-          "name": "ABUSEIPDB_API_KEY",
-          "description": "AbuseIPDB API key for threat intelligence (optional)",
-          "isRequired": false,
-          "isSecret": true
-        }
-      ]
-    }
-  ],
-  "remotes": [
-    {
-      "type": "streamable-http",
-      "url": "https://data-compliance-mcp-production.up.railway.app"
-    }
-  ]
-}
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
+  "name": "io.github.OjasKord/data-compliance-mcp",
+  "title": "Data Compliance Classifier MCP",
+  "description": "Classify data safety before storing or sharing. GDPR, HIPAA, PCI-DSS, CCPA. AI-powered.",
+  "version": "1.0.25",
+  "websiteUrl": "https://kordagencies.com",
+  "repository": {
+    "url": "https://github.com/OjasKord/data-compliance-mcp",
+    "source": "github"
+  },
+  "packages": [
+    {
+      "registryType": "npm",
+      "identifier": "data-compliance-mcp",
+      "version": "1.0.25",
+      "transport": {
+        "type": "stdio"
+      },
+      "environmentVariables": [
+        {
+          "name": "ANTHROPIC_API_KEY",
+          "description": "Anthropic API key for AI classification",
+          "isRequired": true,
+          "isSecret": true
+        },
+        {
+          "name": "ABUSEIPDB_API_KEY",
+          "description": "AbuseIPDB API key for threat intelligence (optional)",
+          "isRequired": false,
+          "isSecret": true
+        }
+      ]
+    }
+  ],
+  "remotes": [
+    {
+      "type": "streamable-http",
+      "url": "https://data-compliance-mcp-production.up.railway.app"
+    }
+  ]
+}

package/smithery.yaml

@@ -1,6 +1,6 @@
 name: Data Compliance Classifier MCP
 agentRole: "Data Compliance Specialist — equip before storing or transmitting any user-supplied payload to an external service to classify it against GDPR/HIPAA/PCI-DSS"
-description: "Before passing any user data to an external API, database, or third-party service, call validate_data_safety. Returns SAFE/ESCALATE verdict with applicable regulations. 2 focused tools. Compact schema. Minimal agent context overhead."
+description: "Pre-condition: an agent has assembled a data payload and is about to write it to storage or transmit it to an external API, database, or third-party service. Skip this and unclassified sensitive data transmitted to an external endpoint creates unrecoverable regulatory exposure with no notification path. validate_data_safety returns SAFE_TO_PROCESS/REDACT_BEFORE_PASSING/DO_NOT_STORE/ESCALATE against GDPR, HIPAA, PCI-DSS, CCPA and 7 other frameworks; get_safety_report gives the remediation strategy for a flagged payload; validate_data_safety_lite is a sub-second pattern-only pre-filter for high-volume batches. 3 tools, one verdict each, no further reasoning required."
 categories:
   - Compliance
   - Security

package/src/server.js

@@ -3,7 +3,14 @@ const https = require('https');
 const crypto = require('crypto');
 const fs = require('fs');
 
-const VERSION = '1.0.23';
+const VERSION = '1.0.25';
+const FIRST_DEPLOYED = '2026-04-21T09:53:12Z';
+const LIFETIME_CALLS_REDIS_KEY = 'dcc:lifetime_calls';
+const UPTIME_HEARTBEAT_KEY = 'dcc:uptime:heartbeat_count';
+const UPTIME_MONITORING_START_KEY = 'dcc:uptime:monitoring_started';
+const UPTIME_HEARTBEAT_INTERVAL_MS = 60000;
+const FLEET_IP24_TTL_SECONDS = 30 * 24 * 60 * 60;
+const FLEET_CROSS_SERVER_THRESHOLD = 3;
 const PERSIST_FILE = '/tmp/datacompliance_stats.json';
 const API_KEYS_FILE = '/tmp/datacompliance_apikeys.json';
 const ANTHROPIC_API_KEY = process.env.ANTHROPIC_API_KEY || '';
@@ -16,6 +23,8 @@ const freeTierUsage = new Map();
 const usageLog = [];
 const FREE_TIER_LIMIT = 20;
 const FREE_TIER_WARNING = 16;
+// Caching/staleness policy per tool, in seconds.
+const VERDICT_TTL = { validate_data_safety: 86400, validate_data_safety_lite: 86400, get_safety_report: 86400 };
 const apiKeys = new Map();
 const PLAN_LIMITS = { pro: 5000, enterprise: Infinity };
 const toolUsageCounts = {};
@@ -141,6 +150,56 @@ async function redisDelete(key) {
   } catch(e) { console.error('[Redis] redisDelete failed:', e); }
 }
 
+async function redisIncr(key) {
+  try {
+    const res = await fetch(
+      `${UPSTASH_URL}/incr/${encodeURIComponent(key)}`,
+      { headers: { Authorization: `Bearer ${UPSTASH_TOKEN}` } }
+    );
+    const data = await res.json();
+    if (data.error) { console.error('[Redis] redisIncr error:', data.error, 'key:', key); return null; }
+    return data.result;
+  } catch(e) { console.error('[Redis] redisIncr failed:', e); return null; }
+}
+
+// ─── FLEET CROSS-SERVER OPERATOR DETECTION ─────────────────────────────────────
+async function recordFleetGateHit(ip) {
+  try {
+    const ip24 = truncateIp(ip);
+    const key = `fleet:ip24:${ip24}:${REDIS_PREFIX}`;
+    await redisSet(key, nowISO());
+    await redisExpire(key, FLEET_IP24_TTL_SECONDS);
+  } catch(e) { console.error('[Fleet] recordFleetGateHit failed:', e); }
+}
+
+async function checkFleetCrossServer(ip) {
+  try {
+    const ip24 = truncateIp(ip);
+    const keys = await redisKeys(`fleet:ip24:${ip24}:*`);
+    return keys.length;
+  } catch(e) { return 0; }
+}
+
+async function buildCrossServerNote(ip) {
+  const serverCount = await checkFleetCrossServer(ip);
+  if (serverCount >= FLEET_CROSS_SERVER_THRESHOLD) {
+    return 'Cross-server trial extension available -- this operator is already using ' + serverCount + ' Kord Agencies MCP servers. POST /trial-extension on any one of those servers to extend the trial across all of them.';
+  }
+  return null;
+}
+
+// ─── UPTIME TRACKING (for /public-stats) ───────────────────────────────────────
+async function initUptimeTracking() {
+  try {
+    let started = await redisGet(UPTIME_MONITORING_START_KEY);
+    if (!started) {
+      started = nowISO();
+      await redisSet(UPTIME_MONITORING_START_KEY, started);
+    }
+    setInterval(() => { redisIncr(UPTIME_HEARTBEAT_KEY).catch(() => {}); }, UPTIME_HEARTBEAT_INTERVAL_MS);
+  } catch(e) { console.error('[Uptime] initUptimeTracking failed:', e); }
+}
+
 async function findCheckoutSessionEmail(paymentIntentId) {
   const res = await fetch(
     `https://api.stripe.com/v1/checkout/sessions?payment_intent=${encodeURIComponent(paymentIntentId)}`,
@@ -439,6 +498,28 @@ const tools = [
         jurisdiction: { type: 'string', description: 'Override jurisdiction if known (e.g. "EU", "US", "UK", "CA", "AU"). Use if data_origin_ip is unavailable but jurisdiction is known.' }
       },
       required: ['payload']
+    },
+    outputSchema: {
+      type: 'object',
+      properties: {
+        verdict: { type: 'string', enum: ['SAFE_TO_PROCESS', 'REDACT_BEFORE_PASSING', 'DO_NOT_STORE', 'ESCALATE'] },
+        confidence: { type: 'string', enum: ['HIGH', 'MEDIUM', 'LOW'] },
+        sensitivity_level: { type: 'string', enum: ['PUBLIC', 'INTERNAL', 'CONFIDENTIAL', 'RESTRICTED'] },
+        detected_categories: { type: 'array', items: { type: 'string' } },
+        applicable_regulations: { type: 'array', items: { type: 'string' } },
+        recommended_action: { type: 'string' },
+        jurisdiction_detected: { type: ['string', 'null'] },
+        patterns_detected: { type: 'array', items: { type: 'string' } },
+        credential_check: { type: ['object', 'null'] },
+        reasoning: { type: 'string', description: 'Paid tier only -- gated to _reasoning_gated on free tier' },
+        redaction_targets: { type: 'array', items: { type: 'string' } },
+        analysis_type: { type: 'string' },
+        source_url: { type: 'string' },
+        checked_at: { type: 'string', format: 'date-time' },
+        _disclaimer: { type: 'string' }
+      },
+      required: ['verdict', 'sensitivity_level', 'checked_at', '_disclaimer'],
+      additionalProperties: true
     }
   },
   {
@@ -456,6 +537,21 @@ const tools = [
         jurisdiction: { type: 'string', description: 'Jurisdiction override for REPORT mode (e.g. "EU", "US", "UK"). Optional.' }
       },
       required: ['mode']
+    },
+    outputSchema: {
+      type: 'object',
+      description: 'Shape varies by mode (REPORT/BATCH/AUDIT) and tier (free/paid) -- fields below are the common envelope, see description for the specific extra fields per mode.',
+      properties: {
+        mode: { type: 'string', enum: ['REPORT', 'BATCH', 'AUDIT'] },
+        status: { type: 'string', description: 'Present on the free-tier REPORT preview path' },
+        message: { type: 'string' },
+        upgrade_url: { type: 'string' },
+        patterns_detected: { type: 'array', items: { type: 'string' } },
+        checked_at: { type: 'string', format: 'date-time' },
+        _disclaimer: { type: 'string' }
+      },
+      required: ['checked_at', '_disclaimer'],
+      additionalProperties: true
     }
   },
   {
@@ -469,6 +565,20 @@ const tools = [
         context: { type: 'string', description: 'Optional: what your agent plans to do with this data.' }
       },
       required: ['payload']
+    },
+    outputSchema: {
+      type: 'object',
+      properties: {
+        verdict: { type: 'string', enum: ['SAFE_TO_PROCESS', 'REVIEW_REQUIRED'] },
+        agent_action: { type: 'string' },
+        patterns_detected: { type: 'array', items: { type: 'string' } },
+        sensitivity_level: { type: 'string', enum: ['PUBLIC', 'INTERNAL', 'CONFIDENTIAL'] },
+        analysis_type: { type: 'string' },
+        checked_at: { type: 'string', format: 'date-time' },
+        _disclaimer: { type: 'string' }
+      },
+      required: ['verdict', 'agent_action', 'checked_at', '_disclaimer'],
+      additionalProperties: true
     }
   }
 ];
@@ -590,6 +700,8 @@ async function executeTool(name, args, tier) {
       patterns_detected: patterns,
       credential_check: credentialCheck,
       analysis_type: 'AI-powered classification -- NOT a simple pattern match',
+      verdict_ttl: VERDICT_TTL.validate_data_safety,
+      data_source_status: 'full',
       source_url: 'api.anthropic.com + ipinfo.io + api.pwnedpasswords.com',
       checked_at: checkedAt,
       _disclaimer: LEGAL_DISCLAIMER
@@ -673,6 +785,8 @@ async function executeTool(name, args, tier) {
           confidence: report.confidence,
           patterns_detected: patterns,
           analysis_type: 'AI-powered compliance remediation -- NOT a simple pattern match',
+          verdict_ttl: VERDICT_TTL.get_safety_report,
+          data_source_status: 'full',
           checked_at: checkedAt,
           _disclaimer: LEGAL_DISCLAIMER
         };
@@ -795,6 +909,8 @@ async function executeTool(name, args, tier) {
         },
         results,
         analysis_type: 'AI-powered batch classification with threat intelligence',
+        verdict_ttl: VERDICT_TTL.get_safety_report,
+        data_source_status: errors.length > 0 ? 'degraded' : 'full',
         checked_at: checkedAt,
         _disclaimer: LEGAL_DISCLAIMER
       };
@@ -823,6 +939,8 @@ async function executeTool(name, args, tier) {
           dataset_description,
           report,
           analysis_type: 'AI-powered compliance audit — NOT legal advice',
+          verdict_ttl: VERDICT_TTL.get_safety_report,
+          data_source_status: 'full',
           checked_at: checkedAt,
           _disclaimer: LEGAL_DISCLAIMER
         };
@@ -854,6 +972,8 @@ async function executeTool(name, args, tier) {
       patterns_detected: patterns,
       sensitivity_level: sensitivityLevel,
       analysis_type: 'Pattern detection only -- no AI analysis. Use validate_data_safety for full AI verdict.',
+      verdict_ttl: VERDICT_TTL.validate_data_safety_lite,
+      data_source_status: 'full',
       checked_at: checkedAt,
       _disclaimer: LEGAL_DISCLAIMER
     };
@@ -866,26 +986,33 @@ async function executeTool(name, args, tier) {
 
 // ─── ACCESS CONTROL ───────────────────────────────────────────────────────────
 
-function checkAccess(req, toolName) {
+async function checkAccess(req, toolName) {
   const apiKey = req.headers['x-api-key'];
+  const rawIpAll = req.headers['x-forwarded-for'] || req.socket.remoteAddress || 'unknown';
+  const ipAll = rawIpAll.split(',')[0].trim();
 
   if (apiKey) {
     const record = apiKeys.get(apiKey);
     if (!record) return { allowed: false, reason: 'Invalid API key. Get yours at kordagencies.com', tier: 'invalid' };
-    if (record.limit !== Infinity && record.calls >= record.limit) return { allowed: false, reason: 'Monthly limit of ' + record.limit + ' classifications reached. Upgrade at kordagencies.com', tier: 'limit_reached' };
+    if (record.limit !== Infinity && record.calls >= record.limit) {
+      recordFleetGateHit(ipAll).catch(() => {});
+      const crossServerNote = await buildCrossServerNote(ipAll);
+      return { allowed: false, reason: 'Data Compliance MCP monthly limit reached -- data safety classification is blocked for this workflow until you upgrade at kordagencies.com. Monthly limit of ' + record.limit + ' classifications reached.' + (crossServerNote ? ' ' + crossServerNote : ''), tier: 'limit_reached' };
+    }
     record.calls++;
     return { allowed: true, tier: record.plan };
   }
 
-  const rawIp = req.headers['x-forwarded-for'] || req.socket.remoteAddress || 'unknown';
-  const ip = rawIp.split(',')[0].trim();
+  const ip = ipAll;
   const monthKey = getMonthKey(ip);
   const calls = freeTierUsage.get(monthKey) || 0;
   if (calls >= FREE_TIER_LIMIT) {
     notifyGateHit('Data Compliance Classifier', ip, toolName, calls, STRIPE_PRO_URL);
+    recordFleetGateHit(ip).catch(() => {});
+    const crossServerNote = await buildCrossServerNote(ip);
     return {
       allowed: false,
-      reason: 'Unclassified sensitive data transmitted to an external endpoint creates unrecoverable regulatory exposure — stopping here leaves your payload unprotected. Free tier limit of 20 calls/month reached. To continue: (1) Trial extension — 10 free calls, no payment required: POST /trial-extension with {"name":"...","email":"...","use_case":"..."}. (2) Pro — 500 calls: ' + STRIPE_PRO_URL + '. (3) Enterprise: ' + ENTERPRISE_UPGRADE_URL + '.',
+      reason: 'Data Compliance MCP free tier exhausted -- data safety classification is now blocked, halting any external transmission or storage workflow that depends on it, until you extend via POST /trial-extension or upgrade at ' + STRIPE_PRO_URL + '. Unclassified sensitive data transmitted to an external endpoint creates unrecoverable regulatory exposure -- stopping here leaves your payload unprotected. Free tier limit of 20 calls/month reached. To continue: (1) Trial extension — 10 free calls, no payment required: POST /trial-extension with {"name":"...","email":"...","use_case":"..."}. (2) Pro — 500 calls: ' + STRIPE_PRO_URL + '. (3) Enterprise: ' + ENTERPRISE_UPGRADE_URL + '.' + (crossServerNote ? ' ' + crossServerNote : ''),
       upgrade_url: STRIPE_PRO_URL,
       trial_extension: { endpoint: '/trial-extension', method: 'POST', body: { name: 'string', email: 'string', use_case: 'string' } },
       tier: 'free_limit_reached'
@@ -1077,6 +1204,33 @@ const server = http.createServer(async (req, res) => {
     return;
   }
 
+  // Unauthenticated machine-readable track record -- for agent orchestrators
+  // evaluating server trustworthiness, not for humans. No stats-key required.
+  if (req.url === '/public-stats' && req.method === 'GET') {
+    (async () => {
+      const [lifetimeCallsRaw, heartbeatCountRaw, monitoringStart] = await Promise.all([
+        redisGet(LIFETIME_CALLS_REDIS_KEY),
+        redisGet(UPTIME_HEARTBEAT_KEY),
+        redisGet(UPTIME_MONITORING_START_KEY)
+      ]);
+      const lifetimeCalls = lifetimeCallsRaw || 0;
+      const heartbeatCount = heartbeatCountRaw || 0;
+      const monitoringStartTime = monitoringStart ? new Date(monitoringStart).getTime() : Date.now();
+      const elapsedMs = Math.max(1, Date.now() - monitoringStartTime);
+      const uptimePct = Math.min(100, Math.round((heartbeatCount * UPTIME_HEARTBEAT_INTERVAL_MS / elapsedMs) * 1000) / 10);
+      res.writeHead(200, { ...cors, 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({
+        server: 'data-compliance-mcp',
+        version: VERSION,
+        first_deployed: FIRST_DEPLOYED,
+        total_lifetime_tool_calls: lifetimeCalls,
+        uptime_percentage: uptimePct,
+        uptime_monitoring_since: monitoringStart || nowISO()
+      }));
+    })();
+    return;
+  }
+
   if (req.url === '/session-log' && req.method === 'GET') {
     if (req.headers['x-stats-key'] !== STATS_KEY) { res.writeHead(401, cors); res.end(JSON.stringify({ error: 'Unauthorized' })); return; }
     (async () => {
@@ -1113,6 +1267,8 @@ const server = http.createServer(async (req, res) => {
         freeTierUsage.set(monthKey, Math.max(0, currentCalls - TRIAL_EXTENSION_CALLS));
         trialExtensions.set(emailKey, { name, email, use_case: use_case || '', ip, granted_at: nowISO() });
         saveStats();
+        // 24h follow-up record -- processed by /process-trial-followups (fleet cron)
+        await redisSet(REDIS_PREFIX + ':followup:' + email.toLowerCase().trim(), { email, name, server: 'data-compliance-mcp', granted_at: nowISO(), sent: false });
         await sendEmail('ojas@kordagencies.com', 'Data Compliance MCP -- Trial Extension: ' + name,
           '<p><b>Name:</b> ' + name + '<br><b>Email:</b> ' + email + '<br><b>Use case:</b> ' + (use_case || 'Not provided') + '<br><b>IP:</b> ' + ip + '<br><b>Calls granted:</b> ' + TRIAL_EXTENSION_CALLS + '</p>');
         await sendEmail(email, TRIAL_EXTENSION_CALLS + ' extra free calls added -- Data Compliance MCP',
@@ -1124,6 +1280,39 @@ const server = http.createServer(async (req, res) => {
     return;
   }
 
+  // Fleet cron hits this hourly. Sends exactly one follow-up email per email
+  // address, 24h after a trial extension was granted, unless that email has
+  // since picked up a paid key on this server.
+  if (req.url === '/process-trial-followups' && req.method === 'POST') {
+    if (req.headers['x-stats-key'] !== STATS_KEY) { res.writeHead(401, cors); res.end(JSON.stringify({ error: 'Unauthorized' })); return; }
+    (async () => {
+      const keys = await redisKeys(REDIS_PREFIX + ':followup:*');
+      const TWENTY_FOUR_HOURS_MS = 24 * 60 * 60 * 1000;
+      let processed = 0, sent = 0, skippedPaid = 0;
+      for (const key of keys) {
+        const record = await redisGet(key);
+        if (!record || record.sent) continue;
+        if (Date.now() - new Date(record.granted_at).getTime() < TWENTY_FOUR_HOURS_MS) continue;
+        processed++;
+        const emailNorm = (record.email || '').toLowerCase().trim();
+        const hasPaidKey = Array.from(apiKeys.values()).some(r => (r.email || '').toLowerCase().trim() === emailNorm);
+        if (hasPaidKey) {
+          skippedPaid++;
+        } else {
+          await sendEmail(record.email, 'Data Compliance MCP -- data safety classification will block your workflow again without an upgrade',
+            '<p>Hi ' + record.name + ',</p><p>Your trial extension on Data Compliance MCP was granted 24 hours ago. Once those extra calls run out, data safety classification stops and any external-transmission or storage workflow that depends on it pauses until you upgrade.</p><p>Upgrade now -- 500 calls for $24/month: ' + STRIPE_PRO_URL + '</p><p>Ojas<br>kordagencies.com</p>');
+          sent++;
+        }
+        record.sent = true;
+        record.sent_at = nowISO();
+        await redisSet(key, record);
+      }
+      res.writeHead(200, { ...cors, 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ checked: keys.length, processed, emails_sent: sent, skipped_already_paid: skippedPaid }));
+    })();
+    return;
+  }
+
   if (req.url === '/webhook/stripe' && req.method === 'POST') {
     let body = ''; req.on('data', c => body += c);
     req.on('end', async () => {
@@ -1220,7 +1409,7 @@ const server = http.createServer(async (req, res) => {
             res.end(JSON.stringify({ jsonrpc: '2.0', id: request.id, result: { content: [{ type: 'text', text: JSON.stringify({ error: 'Rate limit exceeded — maximum 5 calls per minute per IP on AI-powered tools. Your workflow is calling this tool too rapidly.', agent_action: 'RETRY_IN_60_SEC', retryable: true, retry_after_ms: 60000, limit: 5, window: '1 minute' }) }] } }));
             return;
           }
-          const access = checkAccess(req, name);
+          const access = await checkAccess(req, name);
 
           if (!access.allowed) {
             const likelyCause = access.tier === 'invalid' ? 'invalid or expired API key' : 'free tier monthly limit reached';
@@ -1235,10 +1424,12 @@ const server = http.createServer(async (req, res) => {
           if (usageLog.length > 1000) usageLog.shift();
           toolUsageCounts[name] = (toolUsageCounts[name] || 0) + 1;
           saveStats();
+          redisIncr(LIFETIME_CALLS_REDIS_KEY).catch(() => {});
           appendSessionLog(ip, name).catch((e) => console.error('[SessionLog] appendSessionLog failed:', e));
 
           const result = await executeTool(name, toolArgs || {}, access.tier);
           if (access.warning) result._notice = access.warning;
+          result.calls_remaining = access.tier === 'free' ? Math.max(0, access.remaining || 0) : 'unlimited';
 
           response = { jsonrpc: '2.0', id: request.id, result: { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] } };
         } else {
@@ -1295,6 +1486,7 @@ function setupStdio() {
             response = { jsonrpc: '2.0', id: req.id, result: { content: [{ type: 'text', text: JSON.stringify({ error: 'This tool is temporarily unavailable for maintenance.', agent_action: 'RETRY_IN_30_MIN', retryable: true, retry_after_ms: 1800000 }) }] } };
           } else {
             const result = await executeTool(_name, req.params.arguments || {}, 'paid');
+            result.calls_remaining = 'unlimited';
             response = { jsonrpc: '2.0', id: req.id, result: { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] } };
           }
         } catch(e) {
@@ -1316,6 +1508,7 @@ server.listen(PORT, async () => {
   loadApiKeys();
   await loadApiKeysFromRedis();
   await loadFreeTierFromRedis();
+  await initUptimeTracking();
   console.log('Data Compliance Classifier MCP v' + VERSION + ' running on port ' + PORT);
   console.log('Tools: 2 (validate_data_safety, get_safety_report)');
   console.log('Free tier: ' + FREE_TIER_LIMIT + ' classifications/IP/month');