data-compliance-mcp 1.0.3 → 1.0.5

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.0.5] - 2026-04-28
+
+### Changed
+- Payment links updated to prepaid bundle URLs: 500 calls for $24 -- calls never expire
+- Free tier limit errors now direct agents to prepaid bundle purchase link directly
+
+## [1.0.4] - 2026-04-27
+
+### Added
+- `token_count` field on all tool responses — lets orchestrator budget ledgers track token cost per call
+- `/ready` endpoint — returns 200 when `ANTHROPIC_API_KEY` is present, 503 otherwise
+- Phase 4 enhanced error objects: `category`, `retryable`, `retry_after_ms`, `fallback_tool`, `trace_id` on all 7 error paths
+- `validate_data_safety_lite` tool — pattern-detection only with no AI call, for budget-constrained orchestrators
+
 ## [1.0.3] - 2026-04-26
 
 ### Improved

package/LICENSE

@@ -1,7 +1,21 @@
-UNLICENSED
+MIT License
 
 Copyright (c) 2026 Kord Agencies Pte Ltd
 
-All rights reserved. This software is proprietary and confidential.
-Unauthorized copying, modification, distribution, or use of this software,
-via any medium, is strictly prohibited.
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "data-compliance-mcp",
   "mcpName": "io.github.OjasKord/data-compliance-mcp",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "description": "Classify data safety before your agent stores or shares it. GDPR, HIPAA, PCI-DSS, CCPA. AI-powered.",
   "main": "src/server.js",
   "scripts": {
@@ -29,7 +29,7 @@
     "eu-ai-act"
   ],
   "author": "Kord Agencies Pte Ltd <ojas@kordagencies.com>",
-  "license": "UNLICENSED",
+  "license": "MIT",
   "homepage": "https://kordagencies.com",
   "repository": {
     "type": "git",

package/server.json

@@ -3,7 +3,7 @@
   "name": "io.github.OjasKord/data-compliance-mcp",
   "title": "Data Compliance Classifier MCP",
   "description": "Classify data safety before storing or sharing. GDPR, HIPAA, PCI-DSS, CCPA. AI-powered.",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "websiteUrl": "https://kordagencies.com",
   "repository": {
     "url": "https://github.com/OjasKord/data-compliance-mcp",
@@ -13,7 +13,7 @@
     {
       "registryType": "npm",
       "identifier": "data-compliance-mcp",
-      "version": "1.0.3",
+      "version": "1.0.4",
       "transport": { "type": "stdio" },
       "environmentVariables": [
         { "name": "ANTHROPIC_API_KEY", "description": "Anthropic API key for AI classification", "isRequired": true, "isSecret": true },

package/src/server.js

@@ -3,7 +3,7 @@ const https = require('https');
 const crypto = require('crypto');
 const fs = require('fs');
 
-const VERSION = '1.0.3';
+const VERSION = '1.0.5';
 const PERSIST_FILE = '/tmp/datacompliance_stats.json';
 const ANTHROPIC_API_KEY = process.env.ANTHROPIC_API_KEY || '';
 const ABUSEIPDB_API_KEY = process.env.ABUSEIPDB_API_KEY || '';
@@ -17,7 +17,8 @@ const FREE_TIER_LIMIT = 20;
 const FREE_TIER_WARNING = 16;
 const apiKeys = new Map();
 const PLAN_LIMITS = { pro: 5000, enterprise: Infinity };
-const STRIPE_PRO_URL = 'https://buy.stripe.com/8x24gy9Ah3iZ8W04xiebu0c';
+const STRIPE_PRO_URL = 'https://buy.stripe.com/cNidR87s9dXD0pue7Sebu0r';
+const ENTERPRISE_UPGRADE_URL = 'https://buy.stripe.com/9B6bJ0aElbPv7RW9RCebu0s';
 const STRIPE_ENTERPRISE_URL = 'https://buy.stripe.com/cNi7sKeUB8Dj7RW7Juebu0d';
 
 const LEGAL_DISCLAIMER = 'Classification is AI-powered and for informational purposes only. Does not constitute legal advice and does not guarantee regulatory compliance. We do not store or log your data payload — it is analysed in memory and immediately discarded. Jurisdiction detection uses IPinfo (ipinfo.io). Credential checks use the Pwned Passwords k-anonymity API (haveibeenpwned.com) — your credentials are never transmitted in full. Threat checks use AbuseIPDB (abuseipdb.com). Provider maximum liability is limited to subscription fees paid in the preceding 3 months. Full terms: kordagencies.com/terms.html';
@@ -280,6 +281,18 @@ const tools = [
       },
       required: ['mode']
     }
+  },
+  {
+    name: 'validate_data_safety_lite',
+    description: 'CALL THIS TOOL when your orchestrator is budget-constrained and cannot afford the full AI classification. validate_data_safety_lite runs pattern detection only -- no Claude API call, no IP check, no credential lookup. Returns verdict and detected_categories in under 100ms at roughly 70% lower token cost than validate_data_safety. Use when: (1) your budget ledger has less than 300 tokens remaining for this call, (2) you need a fast pre-screen before committing to a full AI classification, or (3) you are processing high-volume data where AI classification is applied selectively. Returns SAFE_TO_PROCESS if no sensitive patterns found, REVIEW_REQUIRED if patterns detected. If REVIEW_REQUIRED, follow up with validate_data_safety for full AI verdict with regulatory framework mapping. LEGAL NOTICE: Pattern detection only -- not a substitute for AI-powered classification in regulated environments. Full terms: kordagencies.com/terms.html. Free tier: 20 calls/month.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        payload: { type: 'string', description: 'The data payload to screen for sensitive patterns.' },
+        context: { type: 'string', description: 'Optional: what your agent plans to do with this data.' }
+      },
+      required: ['payload']
+    }
   }
 ];
 
@@ -291,7 +304,7 @@ async function executeTool(name, args, tier) {
   // ── validate_data_safety ──────────────────────────────────────────────────
   if (name === 'validate_data_safety') {
     const { payload, context, data_origin_ip, jurisdiction } = args;
-    if (!payload) return { error: 'payload is required', agent_action: 'PROVIDE_REQUIRED_FIELD', _disclaimer: LEGAL_DISCLAIMER };
+    if (!payload) return { error: 'payload is required', agent_action: 'PROVIDE_REQUIRED_FIELD', category: 'invalid_input', retryable: false, retry_after_ms: null, fallback_tool: 'validate_data_safety_lite', trace_id: Math.random().toString(36).slice(2, 10), _disclaimer: LEGAL_DISCLAIMER };
 
     // Step 1: Pattern detection (fast, no API call)
     const patterns = detectPatterns(payload);
@@ -401,7 +414,7 @@ async function executeTool(name, args, tier) {
 
     // Gate reasoning on free tier
     if (tier === 'free') {
-      result._reasoning_gated = '[Upgrade to Pro for full AI reasoning behind this verdict — required for compliance audit documentation. kordagencies.com]';
+      result._reasoning_gated = '[Get 500 calls for $24 at ' + STRIPE_PRO_URL + ' for full AI reasoning behind this verdict -- required for compliance audit documentation]';
       result._upgrade = {
         batch_classification: 'Pro plan classifies up to 50 payloads per call — bulk data workflows',
         audit_report: 'Pro plan generates structured audit-ready compliance reports',
@@ -414,20 +427,21 @@ async function executeTool(name, args, tier) {
       result.redaction_targets = classification.redaction_targets;
     }
 
+    result.token_count = Math.ceil(JSON.stringify(result).length / 4);
     return result;
   }
 
   // ── get_safety_report ─────────────────────────────────────────────────────
   if (name === 'get_safety_report') {
     const { mode, payloads, dataset_description, context } = args;
-    if (!mode) return { error: 'mode is required: BATCH or AUDIT', agent_action: 'PROVIDE_REQUIRED_FIELD', _disclaimer: LEGAL_DISCLAIMER };
+    if (!mode) return { error: 'mode is required: BATCH or AUDIT', agent_action: 'PROVIDE_REQUIRED_FIELD', category: 'invalid_input', retryable: false, retry_after_ms: null, fallback_tool: 'get_safety_report', trace_id: Math.random().toString(36).slice(2, 10), _disclaimer: LEGAL_DISCLAIMER };
 
     // Free tier preview — run count analysis without full classification
     if (tier === 'free') {
       if (mode === 'BATCH' && payloads && Array.isArray(payloads)) {
         const previewPatterns = payloads.slice(0, 5).map(p => detectPatterns(p));
         const flaggedCount = previewPatterns.filter(p => p.length > 0).length;
-        return {
+        const _rBatchPreview = {
           mode: 'BATCH',
           status: 'PREVIEW — paid plan required for full classification',
           payloads_submitted: payloads.length,
@@ -447,21 +461,25 @@ async function executeTool(name, args, tier) {
           checked_at: checkedAt,
           _disclaimer: LEGAL_DISCLAIMER
         };
+        _rBatchPreview.token_count = Math.ceil(JSON.stringify(_rBatchPreview).length / 4);
+        return _rBatchPreview;
       }
-      return {
+      const _rPreview = {
         mode: mode,
         status: 'PREVIEW — paid plan required',
-        message: 'Pro plan required for ' + mode + ' reports. Upgrade at kordagencies.com.',
+        message: 'Pro plan required for ' + mode + ' reports. Get 500 calls for $24 at ' + STRIPE_PRO_URL + ' -- calls never expire.',
         upgrade_url: STRIPE_PRO_URL,
         checked_at: checkedAt,
         _disclaimer: LEGAL_DISCLAIMER
       };
+      _rPreview.token_count = Math.ceil(JSON.stringify(_rPreview).length / 4);
+      return _rPreview;
     }
 
     // ── PAID: BATCH mode ──
     if (mode === 'BATCH') {
       if (!payloads || !Array.isArray(payloads) || payloads.length === 0) {
-        return { error: 'payloads array is required for BATCH mode', agent_action: 'PROVIDE_REQUIRED_FIELD', _disclaimer: LEGAL_DISCLAIMER };
+        return { error: 'payloads array is required for BATCH mode', agent_action: 'PROVIDE_REQUIRED_FIELD', category: 'invalid_input', retryable: false, retry_after_ms: null, fallback_tool: 'get_safety_report', trace_id: Math.random().toString(36).slice(2, 10), _disclaimer: LEGAL_DISCLAIMER };
       }
       const batch = payloads.slice(0, 50);
       const results = [];
@@ -518,7 +536,7 @@ async function executeTool(name, args, tier) {
       results.forEach(r => { verdictCounts[r.verdict] = (verdictCounts[r.verdict] || 0) + 1; });
       const highestRisk = results.filter(r => r.verdict === 'ESCALATE' || r.verdict === 'DO_NOT_STORE');
 
-      return {
+      const _rBatch = {
         mode: 'BATCH',
         total_payloads: batch.length,
         classified: results.length,
@@ -533,12 +551,14 @@ async function executeTool(name, args, tier) {
         checked_at: checkedAt,
         _disclaimer: LEGAL_DISCLAIMER
       };
+      _rBatch.token_count = Math.ceil(JSON.stringify(_rBatch).length / 4);
+      return _rBatch;
     }
 
     // ── PAID: AUDIT mode ──
     if (mode === 'AUDIT') {
       if (!dataset_description) {
-        return { error: 'dataset_description is required for AUDIT mode', agent_action: 'PROVIDE_REQUIRED_FIELD', _disclaimer: LEGAL_DISCLAIMER };
+        return { error: 'dataset_description is required for AUDIT mode', agent_action: 'PROVIDE_REQUIRED_FIELD', category: 'invalid_input', retryable: false, retry_after_ms: null, fallback_tool: 'get_safety_report', trace_id: Math.random().toString(36).slice(2, 10), _disclaimer: LEGAL_DISCLAIMER };
       }
 
       const prompt = 'You are a data compliance auditor. Generate a structured compliance audit report for the following dataset.\n\n' +
@@ -551,7 +571,7 @@ async function executeTool(name, args, tier) {
         const response = await callClaude(prompt);
         const clean = response.replace(/```json|```/g, '').trim();
         const report = JSON.parse(clean);
-        return {
+        const _rAudit = {
           mode: 'AUDIT',
           dataset_description,
           report,
@@ -559,15 +579,42 @@ async function executeTool(name, args, tier) {
           checked_at: checkedAt,
           _disclaimer: LEGAL_DISCLAIMER
         };
+        _rAudit.token_count = Math.ceil(JSON.stringify(_rAudit).length / 4);
+        return _rAudit;
       } catch(e) {
-        return { error: 'Audit report generation failed. Please retry.', agent_action: 'RETRY_IN_2_MIN', checked_at: checkedAt, _disclaimer: LEGAL_DISCLAIMER };
+        return { error: 'Audit report generation failed. Please retry.', agent_action: 'RETRY_IN_2_MIN', category: 'upstream_unavailable', retryable: true, retry_after_ms: 120000, fallback_tool: 'get_safety_report', trace_id: Math.random().toString(36).slice(2, 10), checked_at: checkedAt, _disclaimer: LEGAL_DISCLAIMER };
       }
     }
 
-    return { error: 'Invalid mode. Use BATCH or AUDIT.', agent_action: 'PROVIDE_REQUIRED_FIELD', _disclaimer: LEGAL_DISCLAIMER };
+    return { error: 'Invalid mode. Use BATCH or AUDIT.', agent_action: 'PROVIDE_REQUIRED_FIELD', category: 'invalid_input', retryable: false, retry_after_ms: null, fallback_tool: 'get_safety_report', trace_id: Math.random().toString(36).slice(2, 10), _disclaimer: LEGAL_DISCLAIMER };
   }
 
-  return { error: 'Unknown tool: ' + name, agent_action: 'RETRY_IN_2_MIN' };
+  // ── validate_data_safety_lite ─────────────────────────────────────────────
+  // Pattern detection only. No AI call, no IP check, no credential check.
+  if (name === 'validate_data_safety_lite') {
+    const { payload, context } = args;
+    if (!payload) return { error: 'payload is required', agent_action: 'PROVIDE_REQUIRED_FIELD', category: 'invalid_input', retryable: false, retry_after_ms: null, fallback_tool: 'validate_data_safety_lite', trace_id: Math.random().toString(36).slice(2, 10), _disclaimer: LEGAL_DISCLAIMER };
+    const patterns = detectPatterns(payload);
+    const hasSensitive = patterns.length > 0;
+    const sensitivityLevel = patterns.some(p => ['SPECIAL_CATEGORY', 'CREDENTIAL', 'FINANCIAL'].includes(p))
+      ? 'CONFIDENTIAL'
+      : hasSensitive ? 'INTERNAL' : 'PUBLIC';
+    const _rLite = {
+      verdict: hasSensitive ? 'REVIEW_REQUIRED' : 'SAFE_TO_PROCESS',
+      agent_action: hasSensitive
+        ? 'Run validate_data_safety for full AI classification before storing or transmitting this payload.'
+        : 'No sensitive patterns detected. Proceed with caution -- pattern detection does not replace AI classification.',
+      patterns_detected: patterns,
+      sensitivity_level: sensitivityLevel,
+      analysis_type: 'Pattern detection only -- no AI analysis. Use validate_data_safety for full AI verdict.',
+      checked_at: checkedAt,
+      _disclaimer: LEGAL_DISCLAIMER
+    };
+    _rLite.token_count = Math.ceil(JSON.stringify(_rLite).length / 4);
+    return _rLite;
+  }
+
+  return { error: 'Unknown tool: ' + name, agent_action: 'RETRY_IN_2_MIN', category: 'unknown_tool', retryable: false, retry_after_ms: null, fallback_tool: null, trace_id: Math.random().toString(36).slice(2, 10) };
 }
 
 // ─── ACCESS CONTROL ───────────────────────────────────────────────────────────
@@ -588,7 +635,7 @@ function checkAccess(req, toolName) {
   if (calls >= FREE_TIER_LIMIT) {
     return {
       allowed: false,
-      reason: 'Free tier limit of ' + FREE_TIER_LIMIT + ' classifications/month reached. You have seen it work — upgrade to Pro ($49/month) at kordagencies.com for 5,000 classifications/month.',
+      reason: 'Free tier limit reached. Get 500 calls for $24 at ' + STRIPE_PRO_URL + ' -- calls never expire.',
       upgrade_url: STRIPE_PRO_URL,
       tier: 'free_limit_reached'
     };
@@ -598,7 +645,7 @@ function checkAccess(req, toolName) {
   const remaining = FREE_TIER_LIMIT - calls - 1;
   return {
     allowed: true, tier: 'free', remaining,
-    warning: remaining <= 4 ? remaining + ' free classification' + (remaining === 1 ? '' : 's') + ' remaining this month. Upgrade at kordagencies.com.' : null
+    warning: remaining <= 4 ? remaining + ' free classification' + (remaining === 1 ? '' : 's') + ' remaining this month. Get 500 calls for $24 at ' + STRIPE_PRO_URL + ' -- calls never expire.' : null
   };
 }
 
@@ -672,9 +719,17 @@ const server = http.createServer(async (req, res) => {
     return;
   }
 
+  if (req.url === '/ready' && (req.method === 'GET' || req.method === 'HEAD')) {
+    const checks = { anthropic: !!ANTHROPIC_API_KEY };
+    const ready = checks.anthropic;
+    res.writeHead(ready ? 200 : 503, { ...cors, 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ status: ready ? 'ready' : 'not_ready', version: VERSION, checks }));
+    return;
+  }
+
   if (req.url === '/.well-known/mcp/server-card.json') {
     res.writeHead(200, { ...cors, 'Content-Type': 'application/json' });
-    res.end(JSON.stringify({ name: 'data-compliance-mcp', version: VERSION, description: 'Classify data safety before your agent stores or shares it. GDPR, HIPAA, PCI-DSS. Free tier: 20/month.', tools: tools.map(t => ({ name: t.name, description: t.description.slice(0, 100) })), transport: 'stdio', homepage: 'https://kordagencies.com', author: 'ojas1' }));
+    res.end(JSON.stringify({ name: 'data-compliance-mcp', version: VERSION, description: 'Classify data safety before your agent stores or shares it. GDPR, HIPAA, PCI-DSS. Free tier: 20/month.', tools: tools.map(t => ({ name: t.name, description: t.description.slice(0, 100) })), transport: 'streamable-http', homepage: 'https://kordagencies.com', author: 'ojas1', token_footprint_min: 238, token_footprint_max: 2000, token_footprint_avg: 709, idempotent_tools: ['validate_data_safety', 'get_safety_report', 'validate_data_safety_lite'], circuit_breaker: false, health_endpoint: '/health', ready_endpoint: '/ready' }));
     return;
   }
 
@@ -744,7 +799,7 @@ const server = http.createServer(async (req, res) => {
 
           if (!access.allowed) {
             res.writeHead(200, { ...cors, 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ jsonrpc: '2.0', id: request.id, result: { content: [{ type: 'text', text: JSON.stringify({ error: access.reason, agent_action: 'Inform user free tier quota is exhausted. Upgrade required at kordagencies.com', upgrade_url: STRIPE_PRO_URL, _disclaimer: LEGAL_DISCLAIMER }) }] } }));
+            res.end(JSON.stringify({ jsonrpc: '2.0', id: request.id, result: { content: [{ type: 'text', text: JSON.stringify({ error: access.reason, agent_action: 'Inform user free tier quota is exhausted. Get 500 calls for $24 at ' + STRIPE_PRO_URL + ' -- calls never expire.', upgrade_url: STRIPE_PRO_URL, _disclaimer: LEGAL_DISCLAIMER }) }] } }));
             return;
           }
 
@@ -773,7 +828,7 @@ const server = http.createServer(async (req, res) => {
 
   if (req.method === 'GET' && req.url === '/') {
     res.writeHead(200, { ...cors, 'Content-Type': 'application/json' });
-    res.end(JSON.stringify({ name: 'data-compliance-mcp', version: VERSION, status: 'ok', tools: 2, free_tier: '20 classifications/month, no API key required', description: 'Classify data safety before your agent stores or shares it. GDPR, HIPAA, PCI-DSS, CCPA.', upgrade: 'https://kordagencies.com' }));
+    res.end(JSON.stringify({ name: 'data-compliance-mcp', version: VERSION, status: 'ok', tools: 2, free_tier: '20 classifications/month, no API key required', description: 'Classify data safety before your agent stores or shares it. GDPR, HIPAA, PCI-DSS, CCPA.', upgrade: STRIPE_PRO_URL }));
     return;
   }