fodda-mcp 1.38.0 → 1.46.97

package/dist/index.js

@@ -6,7 +6,6 @@
  */
 import express from 'express';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import { SSEServerTransport } from '@modelcontextprotocol/sdk/server/sse.js';
 import crypto from 'crypto';
 import axios from 'axios';
 import { initCatalogCache } from './catalogCache.js';
@@ -32,41 +31,183 @@ process.on('uncaughtException', (err) => {
 });
 const API_BASE_URL = process.env.FODDA_API_URL || 'https://api.fodda.ai';
 const WEBSITE_BASE_URL = process.env.WEBSITE_BASE_URL || 'https://www.fodda.ai';
-const app = express();
+export const app = express();
 app.use(express.json({ limit: '512kb' }));
+// Strip api_key from request logging globally before anything hits Cloud Run logs
+app.use((req, _res, next) => {
+    if (req.url && req.url.includes('api_key=')) {
+        req.url = req.url.replace(/api_key=[^&]+/g, 'api_key=REDACTED');
+    }
+    next();
+});
 // CORS — minimal, matching test server
 app.use((req, res, next) => {
     res.setHeader('Access-Control-Allow-Origin', '*');
     res.setHeader('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS');
-    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-API-Key, X-User-Id, X-Stripe-SPT, Mcp-Session-Id, Accept');
+    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-API-Key, X-User-Id, X-User-Email, X-Internal-Key, X-Fodda-Signature, X-Fodda-Timestamp, X-Stripe-SPT, Mcp-Session-Id, Accept, X-Fodda-Session-Kind, X-Fodda-Source, X-Fodda-Client');
     res.setHeader('Access-Control-Expose-Headers', 'Mcp-Session-Id');
     if (req.method === 'OPTIONS')
         return res.status(204).end();
     next();
 });
-// OAuth discovery endpoints — Clerk-backed OAuth for the MCP Connectors Directory.
-// The authorization server is Clerk (configured as CLERK_ISSUER_URL).
-// These endpoints follow RFC 8414 / draft-ietf-oauth-security-topics so MCP clients
-// can auto-discover the auth server and initiate PKCE flows.
-const CLERK_ISSUER = process.env.CLERK_ISSUER_URL || 'https://clerk.fodda.ai';
-app.get('/.well-known/oauth-protected-resource', (_req, res) => {
-    res.status(200).json({
-        resource: 'https://mcp.fodda.ai',
-        authorization_servers: [CLERK_ISSUER],
+// Helper to verify incoming HMAC signature from internal services
+export function isIncomingHmacValid(req) {
+    const secret = process.env.FODDA_MCP_SECRET;
+    if (!secret)
+        return false;
+    const signature = req.headers['x-fodda-signature'] || '';
+    if (!signature)
+        return false;
+    const timestamp = req.headers['x-fodda-timestamp'] || '';
+    // If timestamp is supplied, enforce a 5-minute replay window (300,000 ms)
+    if (timestamp) {
+        const ts = parseInt(timestamp, 10);
+        if (isNaN(ts) || Math.abs(Date.now() - ts) > 300000) {
+            return false;
+        }
+    }
+    // Try payload with timestamp: `${timestamp}.${JSON.stringify(body)}` or `${timestamp}.${path}`
+    const payloadWithTs = (req.method === 'POST' || req.method === 'PATCH')
+        ? (timestamp ? `${timestamp}.${JSON.stringify(req.body ?? {})}` : JSON.stringify(req.body ?? {}))
+        : (timestamp ? `${timestamp}.${req.originalUrl || req.url}` : (req.originalUrl || req.url));
+    const expectedWithTs = crypto.createHmac('sha256', secret).update(payloadWithTs).digest('hex');
+    if (signature.length === expectedWithTs.length) {
+        try {
+            if (crypto.timingSafeEqual(Buffer.from(signature, 'hex'), Buffer.from(expectedWithTs, 'hex'))) {
+                return true;
+            }
+        }
+        catch { /* ignore */ }
+    }
+    // Also support payload without timestamp fallback
+    if (timestamp) {
+        const fallbackPayload = (req.method === 'POST' || req.method === 'PATCH')
+            ? JSON.stringify(req.body ?? {})
+            : (req.originalUrl || req.url);
+        const fallbackExpected = crypto.createHmac('sha256', secret).update(fallbackPayload).digest('hex');
+        if (signature.length === fallbackExpected.length) {
+            try {
+                if (crypto.timingSafeEqual(Buffer.from(signature, 'hex'), Buffer.from(fallbackExpected, 'hex'))) {
+                    return true;
+                }
+            }
+            catch { /* ignore */ }
+        }
+    }
+    return false;
+}
+// ---------------------------------------------------------------------------
+// Service URL & RFC 9728 401 Helper
+// ---------------------------------------------------------------------------
+function getServiceUrl() {
+    if (process.env.FODDA_SERVICE_URL)
+        return process.env.FODDA_SERVICE_URL;
+    if (process.env.NODE_ENV === 'production' || process.env.K_SERVICE) {
+        return 'https://mcp.fodda.ai';
+    }
+    return `http://localhost:${process.env.PORT || 8080}`;
+}
+export function sendAuth401(res, options) {
+    const rawSlug = options.offeringSlug;
+    const metadataSlug = (!rawSlug || rawSlug === 'c') ? 'mcp' : rawSlug;
+    const resourceMetadata = `${getServiceUrl()}/.well-known/oauth-protected-resource/${metadataSlug}`;
+    if (options.invalidToken) {
+        res.setHeader('WWW-Authenticate', `Bearer resource_metadata="${resourceMetadata}", error="invalid_token"`);
+    }
+    else {
+        res.setHeader('WWW-Authenticate', `Bearer resource_metadata="${resourceMetadata}"`);
+    }
+    const errorPayload = {
+        code: -32000,
+        message: options.message,
+    };
+    if (options.invalidToken) {
+        errorPayload.error = 'invalid_token';
+        errorPayload.data = { error: 'invalid_token', ...(options.data || {}) };
+    }
+    else if (options.data) {
+        errorPayload.data = options.data;
+    }
+    return res.status(401).json({
+        jsonrpc: '2.0',
+        error: errorPayload,
+        id: options.id ?? null,
+    });
+}
+// ---------------------------------------------------------------------------
+// Retired SSE transport (v1.46.85) — explicitly return 410 Gone
+// ---------------------------------------------------------------------------
+app.all(['/sse', '/messages'], (_req, res) => {
+    res.status(410).json({
+        error: 'sse_retired',
+        message: 'Use Streamable HTTP at https://mcp.fodda.ai/mcp',
+        source: 'fodda-mcp'
     });
 });
-app.get('/.well-known/oauth-protected-resource/mcp', (_req, res) => {
+// Deprecation middleware for legacy URL parameters (?api_key=... / ?user_id=...)
+const LEGACY_DEPRECATION_PATHS = [
+    '/mcp', '/copilot', '/chatgpt',
+    '/brand-intelligence', '/topic-research', '/deep-research',
+    '/earnings-intelligence', '/expert-consult',
+    '/grok-brand-context', '/c/:token', '/c'
+];
+app.use(LEGACY_DEPRECATION_PATHS, (req, res, next) => {
+    if (req.query.api_key !== undefined || req.query.user_id !== undefined) {
+        const authHeader = (req.headers['authorization'] || '').toString().trim();
+        const rawBearer = authHeader.replace(/^Bearer\s+/i, '').trim();
+        const internalKey = process.env.FODDA_INTERNAL_API_KEY || '';
+        const internalKeyHeader = req.headers['x-internal-key'] || '';
+        const apiKeyHeader = req.headers['x-api-key'] || '';
+        // Check if request carries modern credentials or internal service authorization
+        const hasBearerAuth = rawBearer.length > 0;
+        const hasInternalKey = !!(internalKey && (internalKeyHeader === internalKey ||
+            rawBearer === internalKey ||
+            apiKeyHeader === internalKey ||
+            req.query.api_key === internalKey));
+        const hasValidHmac = isIncomingHmacValid(req);
+        const hasHeaderApiKey = apiKeyHeader.startsWith('sk_live_') || apiKeyHeader.startsWith('sk_trial_');
+        // Service-to-service calls or requests supplying valid header credentials bypass deprecation
+        if (hasBearerAuth || hasInternalKey || hasValidHmac || hasHeaderApiKey) {
+            return next();
+        }
+        const message = 'Fodda: this connection URL is outdated. Get your new MCP URL at https://app.fodda.ai (Connections) and update your connector.';
+        const accept = req.headers['accept'] || '';
+        const contentType = req.headers['content-type'] || '';
+        const isJson = accept.includes('application/json') || contentType.includes('application/json') || (req.method === 'POST' && req.body && typeof req.body === 'object');
+        res.setHeader('WWW-Authenticate', `Bearer resource_metadata="${getServiceUrl()}/.well-known/oauth-protected-resource/mcp"`);
+        if (isJson && req.method === 'POST') {
+            const bodyId = (req.body && typeof req.body === 'object' && 'id' in req.body) ? req.body.id : null;
+            return res.status(401).json({
+                jsonrpc: '2.0',
+                error: {
+                    code: -32001,
+                    message,
+                    data: { docs: 'https://www.fodda.ai/connect' }
+                },
+                id: bodyId,
+            });
+        }
+        res.setHeader('Content-Type', 'text/plain; charset=utf-8');
+        return res.status(401).send(`${message}\n`);
+    }
+    next();
+});
+// OAuth discovery endpoints — Clerk-backed OAuth for the MCP Connectors Directory.
+// Advertises Clerk (CLERK_ISSUER) as the authorization server for RFC 9728 discovery,
+// ensuring RFC 8414 issuer matching and RFC 9207 callback iss validation succeed end-to-end.
+const CLERK_ISSUER = process.env.CLERK_ISSUER_URL || 'https://clerk.fodda.ai';
+app.get(['/.well-known/oauth-protected-resource', '/.well-known/oauth-protected-resource/:slug'], (req, res) => {
+    const slug = req.params.slug;
+    const resourceUrl = slug ? `${getServiceUrl()}/${slug}` : getServiceUrl();
     res.status(200).json({
-        resource: 'https://mcp.fodda.ai/mcp',
+        resource: resourceUrl,
         authorization_servers: [CLERK_ISSUER],
     });
 });
-app.get('/.well-known/oauth-authorization-server', (_req, res) => {
-    res.redirect(302, `${CLERK_ISSUER}/.well-known/oauth-authorization-server`);
-});
-app.post('/register', (_req, res) => {
-    // DCR not handled here — managed by Clerk dashboard
-    res.status(501).json({ error: 'Dynamic client registration is managed via the Clerk dashboard.' });
+app.get('/.well-known/openai-apps-challenge', (_req, res) => {
+    const challenge = process.env.OPENAI_APPS_CHALLENGE || '';
+    res.setHeader('Content-Type', 'text/plain; charset=utf-8');
+    res.status(200).send(challenge);
 });
 // ---------------------------------------------------------------------------
 // .well-known MCP Server Discovery Card & Pricing Metadata Tier
@@ -137,7 +278,11 @@ export const OFFERING_SCOPED_TOOLS = {
     ],
     'expert-consult': [
         'get_capabilities',
+        'find_expert',
+        'request_expert_intro',
         'consult_analyst',
+        'consult_human_agent',
+        'verify_claim',
         'list_analysts',
         'request_deliverable',
         'check_deliverable_status',
@@ -150,6 +295,64 @@ export const OFFERING_SCOPED_TOOLS = {
         'get_my_account',
         'generate_visual',
     ],
+    'copilot': [
+        'get_capabilities',
+        'search_graph',
+        'search_statistics',
+        'search_insights',
+        'get_validated_trends',
+        'brand_tracker',
+        'get_company_earnings',
+        'deep_research_topic',
+        'check_research_status',
+        'find_expert',
+        'request_expert_intro',
+        'consult_analyst',
+        'consult_human_agent',
+        'list_analysts',
+        'get_evidence',
+        'list_graphs',
+        'get_my_account',
+        'read_url',
+        'get_supplemental_context',
+        'check_supplemental_status',
+    ],
+    'chatgpt': [
+        'get_capabilities',
+        'search_graph',
+        'search_statistics',
+        'search_insights',
+        'get_validated_trends',
+        'brand_tracker',
+        'get_company_earnings',
+        'get_earnings_intelligence',
+        'get_earnings_divergence',
+        'deep_research_topic',
+        'check_research_status',
+        'consult_analyst',
+        'consult_human_agent',
+        'list_analysts',
+        'get_evidence',
+        'get_node',
+        'get_neighbors',
+        'get_label_values',
+        'list_graphs',
+        'get_my_account',
+        'read_url',
+        'get_supplemental_context',
+        'check_supplemental_status',
+        'generate_visual',
+    ],
+    'grok-brand-context': [
+        'get_capabilities',
+        'get_domain_intelligence',
+        'brand_tracker',
+        'discover_adjacent_trends',
+        'get_earnings_intelligence',
+        'get_evidence',
+        'find_expert',
+        'verify_claim',
+    ],
 };
 const OFFERING_CARD_METADATA = {
     'brand-intelligence': {
@@ -177,6 +380,21 @@ const OFFERING_CARD_METADATA = {
         title: 'Fodda Synthetic Expert Consult',
         description: 'Consult synthetic industry experts grounded in PSFK trend graphs with citable analyst perspectives.',
     },
+    'copilot': {
+        name: 'ai.fodda/copilot',
+        title: 'Fodda Copilot Market Intelligence',
+        description: 'Curated market intelligence, trend insights & expert evidence for Microsoft Copilot Studio agents.',
+    },
+    'chatgpt': {
+        name: 'ai.fodda/chatgpt',
+        title: 'Fodda Market Intelligence for ChatGPT',
+        description: 'Expert-curated knowledge, brand, research & earnings intelligence across PSFK expert graphs.',
+    },
+    'grok-brand-context': {
+        name: 'ai.fodda/grok-brand-context',
+        title: 'Fodda Brand & Market Context',
+        description: 'Verified brand, market & earnings context across PSFK expert graphs with citable evidence, not web summaries.',
+    },
 };
 app.get([
     '/.well-known/mcp-server.json', '/.well-known/mcp',
@@ -185,6 +403,9 @@ app.get([
     '/.well-known/deep-research', '/.well-known/deep-research.json',
     '/.well-known/earnings-intelligence', '/.well-known/earnings-intelligence.json',
     '/.well-known/expert-consult', '/.well-known/expert-consult.json',
+    '/.well-known/copilot', '/.well-known/copilot.json',
+    '/.well-known/chatgpt', '/.well-known/chatgpt.json',
+    '/.well-known/grok-brand-context', '/.well-known/grok-brand-context.json',
 ], (req, res) => {
     res.setHeader('Content-Type', 'application/json');
     const matchedOffering = Object.keys(OFFERING_CARD_METADATA).find(slug => req.path.includes(slug));
@@ -205,7 +426,7 @@ app.get([
             pricingTier: {
                 structure: 'free',
                 substance: 'metered',
-                tokenModel: 'Canonical token costs defined in API metering.ts ($0.50 via SPT / API credits)',
+                tokenModel: 'Metered per API call — see https://fodda.ai/pricing',
             },
             resourceSchemes: [
                 'fodda://expert/{slug}/insight/{id}',
@@ -213,7 +434,6 @@ app.get([
             ],
             endpoints: {
                 mcpStreamableHttp: `${getServiceUrl()}/${matchedOffering}`,
-                mcpSse: `${getServiceUrl()}/sse`,
                 telemetry: `${getServiceUrl()}/telemetry`,
                 feedback: `${getServiceUrl()}/v1/feedback`,
             },
@@ -234,7 +454,7 @@ app.get([
         pricingTier: {
             structure: 'free',
             substance: 'metered',
-            tokenModel: 'Canonical token costs defined in API metering.ts ($0.50 via SPT / API credits)',
+            tokenModel: 'Metered per API call — see https://fodda.ai/pricing',
         },
         resourceSchemes: [
             'fodda://expert/{slug}/insight/{id}',
@@ -242,7 +462,6 @@ app.get([
         ],
         endpoints: {
             mcpStreamableHttp: `${getServiceUrl()}/mcp`,
-            mcpSse: `${getServiceUrl()}/sse`,
             telemetry: `${getServiceUrl()}/telemetry`,
             feedback: `${getServiceUrl()}/v1/feedback`,
         },
@@ -292,12 +511,56 @@ const transports = new Map();
 const sessionApiKeys = new Map();
 const sessionUserIds = new Map();
 const sessionSources = new Map();
+export const sessionClients = new Map();
 // SPT-paying anonymous sessions (no API key). Holds the token + the connect-time
 // validate result (cap + price map) so per-task coverage can be checked locally.
 const sessionSpts = new Map();
 // Track session creation time in our own Map (transport._createdAt is a private
 // field that is never set by the SDK — reading it always yields undefined).
 const sessionCreatedAt = new Map();
+/**
+ * Normalize clientInfo from MCP initialize handshake to a short, canonical slug.
+ * E.g. Claude Desktop -> claude-desktop, Cursor -> cursor, VS Code -> vscode.
+ */
+export function normalizeClientSlug(name, version) {
+    if (!name || typeof name !== 'string')
+        return '';
+    const lower = name.toLowerCase().trim();
+    if (lower.includes('claude desktop') || lower.includes('claude-desktop') || lower.includes('claude for desktop')) {
+        return 'claude-desktop';
+    }
+    if (lower.includes('claude code') || lower.includes('claude-code')) {
+        return 'claude-code';
+    }
+    if (lower === 'claude' || lower.includes('claude.ai') || lower.startsWith('claude')) {
+        return 'claude';
+    }
+    if (lower.includes('cursor')) {
+        return 'cursor';
+    }
+    if (lower.includes('visual studio code') || lower.includes('vscode')) {
+        return 'vscode';
+    }
+    if (lower.includes('windsurf')) {
+        return 'windsurf';
+    }
+    if (lower.includes('chatgpt') || lower.includes('openai')) {
+        return 'chatgpt';
+    }
+    if (lower.includes('zed')) {
+        return 'zed';
+    }
+    if (lower.includes('librechat')) {
+        return 'librechat';
+    }
+    if (lower.includes('roo-code') || lower.includes('roo code') || lower.includes('roocode')) {
+        return 'roo-code';
+    }
+    if (lower.includes('cline')) {
+        return 'cline';
+    }
+    return lower.replace(/[^a-z0-9_-]+/g, '-').replace(/^-+|-+$/g, '');
+}
 // ---------------------------------------------------------------------------
 // Periodic cleanup — prevent unbounded memory growth
 // ---------------------------------------------------------------------------
@@ -318,44 +581,40 @@ setInterval(() => {
             sessionApiKeys.delete(sid);
             sessionUserIds.delete(sid);
             sessionSources.delete(sid);
+            sessionClients.delete(sid);
             sessionSpts.delete(sid);
             sessionCreatedAt.delete(sid);
         }
     }
 }, CLEANUP_INTERVAL_MS).unref();
 // ---------------------------------------------------------------------------
-// Service URL helper
-// ---------------------------------------------------------------------------
-// M2: FODDA_SERVICE_URL must be set in Cloud Run env vars.
-// Fallback to localhost for local dev only. The hardcoded project hash
-// was removed — if it was being used, the URL was silently wrong.
-function getServiceUrl() {
-    if (process.env.FODDA_SERVICE_URL)
-        return process.env.FODDA_SERVICE_URL;
-    if (process.env.NODE_ENV === 'production' || process.env.K_SERVICE) {
-        return 'https://mcp.fodda.ai';
-    }
-    return `http://localhost:${process.env.PORT || 8080}`;
-}
-// ---------------------------------------------------------------------------
 // Authenticated API caller — checks query cache first
 // ---------------------------------------------------------------------------
 /**
  * Make an authenticated request to the Fodda API.
  * Checks the query cache first; stores responses on cache miss.
  */
-async function foddaRequest(method, path, apiKey, userId, body, requestId, source, spt) {
+const PLACEHOLDER_USER_IDS = new Set(['', 'anonymous', 'undefined', 'null', 'oauth_user']);
+export function isPlaceholderUserId(id) {
+    if (!id)
+        return true;
+    return PLACEHOLDER_USER_IDS.has(id.trim().toLowerCase());
+}
+export async function foddaRequest(method, path, apiKey, userId, body, requestId, source, spt, client) {
     // ── Cache check ──
     const cached = cacheGet(method, path, body);
     if (cached !== null)
         return cached;
     const timestamp = Date.now().toString();
     const headers = {
-        'X-User-Id': userId,
         'X-Fodda-Timestamp': timestamp,
         'X-Fodda-Billing': 'mcp-orchestrated', // Tells API to skip per-call billing — MCP charges lump sum via meter
         'Content-Type': 'application/json',
     };
+    // Never send placeholder user IDs upstream — let the API's account-label fallback apply
+    if (userId && !isPlaceholderUserId(userId)) {
+        headers['X-User-Id'] = userId;
+    }
     // SPT settlement: the Shared Payment Token is the payer (Authorization Bearer), no X-API-Key.
     if (spt) {
         headers['Authorization'] = `Bearer ${spt}`;
@@ -367,6 +626,8 @@ async function foddaRequest(method, path, apiKey, userId, body, requestId, sourc
         headers['X-Request-Id'] = requestId;
     if (source)
         headers['X-Fodda-Source'] = source;
+    if (client)
+        headers['X-Fodda-Client'] = client;
     // HMAC sign the request
     const secret = process.env.FODDA_MCP_SECRET;
     if (secret) {
@@ -376,12 +637,12 @@ async function foddaRequest(method, path, apiKey, userId, body, requestId, sourc
         const signature = crypto.createHmac('sha256', secret).update(payload).digest('hex');
         headers['X-Fodda-Signature'] = signature;
     }
-    const baseUrl = path.startsWith('/api/') ? WEBSITE_BASE_URL : API_BASE_URL;
+    const baseUrl = path.startsWith('/api/') ? (process.env.WEBSITE_BASE_URL || WEBSITE_BASE_URL) : (process.env.FODDA_API_URL || API_BASE_URL);
     const url = `${baseUrl}${path}`;
     // Base timeout: 30s aligns with MCP client expectations.
-    // Extended to 60s for analyst consult, and 35s for supplemental.
-    const AXIOS_TIMEOUT_MS = /\/analysts\/consult/.test(path)
-        ? 60000
+    // Extended to 90s for analyst and human agent consults, verify/claim, and intelligence routes, and 35s for supplemental.
+    const AXIOS_TIMEOUT_MS = /(\/analysts\/consult|\/human-agents\/consult|\/verify\/|\/intelligence\/)/.test(path)
+        ? 90000
         : /\/supplemental\//.test(path)
             ? 35000
             : 30000;
@@ -406,6 +667,12 @@ async function foddaRequest(method, path, apiKey, userId, body, requestId, sourc
         const overageTokens = response.headers['x-usage-overage-tokens'];
         if (overageTokens)
             response.data._upstream_usage.overage_tokens = parseInt(overageTokens, 10);
+        const dailyRemaining = response.headers['x-usage-daily-remaining'];
+        if (dailyRemaining)
+            response.data._upstream_usage.daily_remaining = parseInt(dailyRemaining, 10);
+        const dailyCalls = response.headers['x-usage-daily-calls'];
+        if (dailyCalls)
+            response.data._upstream_usage.daily_calls = parseInt(dailyCalls, 10);
     }
     // ── Billing-mode trust check (Option C) ──
     // Every MCP request claims mcp-orchestrated; the API echoes the EFFECTIVE mode.
@@ -548,7 +815,7 @@ async function waverunnerRequest(interactionType, tokenCost, userApiKey, userId,
 // ---------------------------------------------------------------------------
 // Browser Landing Page — catch humans who paste the MCP URL into a browser
 // ---------------------------------------------------------------------------
-app.get(['/mcp', '/brand-intelligence', '/topic-research', '/deep-research', '/earnings-intelligence', '/expert-consult'], (req, res, next) => {
+app.get(['/mcp', '/brand-intelligence', '/topic-research', '/deep-research', '/earnings-intelligence', '/expert-consult', '/copilot'], (req, res, next) => {
     // Only intercept browser requests (Accept: text/html).
     // MCP SDK clients send application/json or text/event-stream, so they
     // fall through to the app.all('/mcp') transport handler below.
@@ -842,7 +1109,7 @@ export async function resolveMcpToken(token, websiteBaseUrl) {
 // ---------------------------------------------------------------------------
 // MCP Transport Handler
 // ---------------------------------------------------------------------------
-app.all(['/mcp', '/brand-intelligence', '/topic-research', '/deep-research', '/earnings-intelligence', '/expert-consult', '/c/:token'], async (req, res) => {
+app.all(['/mcp', '/brand-intelligence', '/topic-research', '/deep-research', '/earnings-intelligence', '/expert-consult', '/copilot', '/chatgpt', '/grok-brand-context', '/c/:token'], async (req, res) => {
     try {
         const sessionId = req.headers['mcp-session-id'];
         let transport;
@@ -859,9 +1126,17 @@ app.all(['/mcp', '/brand-intelligence', '/topic-research', '/deep-research', '/e
             || '';
         const isSpt = !!spt;
         const rawBearer = !isSpt ? rawAuth.replace(/^Bearer\s+/i, '').trim() : '';
+        // Internal service auth detection
+        const internalKey = process.env.FODDA_INTERNAL_API_KEY || '';
+        const internalKeyHeader = req.headers['x-internal-key'] || '';
+        const hasValidHmac = isIncomingHmacValid(req);
+        const isInternalAuth = hasValidHmac || !!(internalKey && (internalKeyHeader === internalKey ||
+            rawBearer === internalKey ||
+            req.headers['x-api-key'] === internalKey ||
+            req.query.api_key === internalKey));
         // Clerk OAuth tokens may be JWTs (eyJ...), opaque tokens (oat_...), session tokens (sess_...), or custom OAuth tokens.
-        // If it's not a standard sk_live_ / sk_trial_ key, send it to clerk-resolve.
-        const isClerkJwt = !isSpt && rawBearer.length > 0 && !rawBearer.startsWith('sk_live_') && !rawBearer.startsWith('sk_trial_');
+        // If it's not a standard sk_live_ / sk_trial_ key and not internal auth, send it to clerk-resolve.
+        const isClerkJwt = !isSpt && !isInternalAuth && rawBearer.length > 0 && !rawBearer.startsWith('sk_live_') && !rawBearer.startsWith('sk_trial_');
         if (isClerkJwt) {
             // Attempt Clerk JWT → Fodda API key resolution
             try {
@@ -875,9 +1150,10 @@ app.all(['/mcp', '/brand-intelligence', '/topic-research', '/deep-research', '/e
                     req.__resolvedUserId = resolveResp.data.user_id || 'oauth_user';
                 }
                 else {
-                    return res.status(401).json({
-                        jsonrpc: '2.0',
-                        error: { code: -32000, message: 'OAuth token could not be resolved to a Fodda account. Visit https://app.fodda.ai to reconnect.' },
+                    return sendAuth401(res, {
+                        offeringSlug,
+                        message: 'OAuth token could not be resolved to a Fodda account. Visit https://app.fodda.ai to reconnect.',
+                        invalidToken: true,
                         id: (req.body && typeof req.body === 'object' && 'id' in req.body) ? req.body.id : null,
                     });
                 }
@@ -891,9 +1167,10 @@ app.all(['/mcp', '/brand-intelligence', '/topic-research', '/deep-research', '/e
                         id: (req.body && typeof req.body === 'object' && 'id' in req.body) ? req.body.id : null,
                     });
                 }
-                return res.status(401).json({
-                    jsonrpc: '2.0',
-                    error: { code: -32000, message: 'OAuth token validation failed. Please reconnect at https://app.fodda.ai.' },
+                return sendAuth401(res, {
+                    offeringSlug,
+                    message: 'OAuth token validation failed. Please reconnect at https://app.fodda.ai.',
+                    invalidToken: true,
                     id: (req.body && typeof req.body === 'object' && 'id' in req.body) ? req.body.id : null,
                 });
             }
@@ -911,45 +1188,61 @@ app.all(['/mcp', '/brand-intelligence', '/topic-research', '/deep-research', '/e
             }
             catch (err) {
                 console.error(`[token-resolver] Failed to resolve connection token:`, err.message);
-                return res.status(401).json({ error: 'Invalid or expired connection token' });
+                return sendAuth401(res, {
+                    offeringSlug,
+                    message: 'Invalid or expired connection token. Visit https://app.fodda.ai to reconnect.',
+                    invalidToken: true,
+                    id: (req.body && typeof req.body === 'object' && 'id' in req.body) ? req.body.id : null,
+                });
             }
         }
         // Extract API key, userId, and entry ID from URL or headers.
-        // Priority: resolved OAuth key → X-API-Key header → Authorization Bearer (if non-Clerk) → resolved token key → query string (fallback).
+        // Priority: resolved OAuth key → X-API-Key header → Authorization Bearer (if non-Clerk sk_live_/sk_trial_) → internal service key → resolved token key → query string (fallback).
         const resolvedOAuthKey = req.__resolvedApiKey || '';
         const resolvedOAuthUser = req.__resolvedUserId || '';
         const apiKey = isSpt ? '' : (resolvedOAuthKey
             || req.headers['x-api-key']
-            || (!isClerkJwt ? (req.headers['authorization']?.toString().replace(/^Bearer\s+/i, '')) : '')
+            || (!isClerkJwt ? rawBearer : '')
+            || (isInternalAuth ? (internalKey || 'sk_internal_service') : '')
             || resolvedApiKey
             || req.query.api_key
             || '');
         const entryId = resolvedEntryId || req.query.id || '';
         // If id looks like an email and no explicit user_id, use it as userId for tracking + signup
         const isEmailId = entryId.includes('@') && entryId.includes('.');
-        // Priority for userId: resolved OAuth user → resolved token email → query user_id → header X-User-Id → query id / anonymous
+        const headerUserId = req.headers['x-user-id'] || req.headers['x-user-email'] || '';
+        // Priority for userId: resolved OAuth user → resolved token email → header X-User-Id / X-User-Email → query user_id → query id / anonymous
         const userId = isSpt ? 'spt_agent' : (resolvedOAuthUser
             || resolvedEmail
+            || headerUserId
             || req.query.user_id
-            || req.headers['x-user-id']
             || (isEmailId ? entryId : 'anonymous'));
-        const defaultSource = (offeringSlug !== 'mcp' && allowedTools !== undefined) ? offeringSlug : (isSpt ? 'spt' : '');
-        const source = req.query.source || defaultSource;
+        const defaultSessionKind = isInternalAuth ? 'internal-test' : 'customer';
+        const sessionKind = req.headers['x-fodda-session-kind'] || req.query.session_kind || defaultSessionKind;
+        const isInternalTest = sessionKind === 'internal-test';
+        const defaultSource = isInternalTest ? 'mcp-internal-test' : ((offeringSlug !== 'mcp' && allowedTools !== undefined) ? offeringSlug : (isSpt ? 'spt' : ''));
+        const rawSource = req.headers['x-fodda-source'] || req.query.source || '';
+        const userAgent = (req.headers['user-agent'] || '').toString().toLowerCase();
+        const isChatGptUa = userAgent.includes('chatgpt') || userAgent.includes('chatgpt-user') || userAgent.includes('openai');
+        const source = isInternalTest ? 'mcp-internal-test' : (rawSource || (isChatGptUa ? 'chatgpt' : defaultSource));
         if (sessionId && transports.has(sessionId)) {
             transport = transports.get(sessionId);
         }
         else if (!sessionId && req.method === 'POST') {
             const body = req.body;
+            const clientInfo = body?.params?.clientInfo;
+            const declaredClientSlug = normalizeClientSlug(clientInfo?.name, clientInfo?.version);
+            const clientSlug = declaredClientSlug || (isChatGptUa ? 'chatgpt' : '');
             if (body?.method === 'initialize') {
-                // Directory connector policy: /mcp requires authentication — Clerk OAuth,
+                // Directory connector policy: All offering routes require authentication — Clerk OAuth,
                 // an API key, or a /c/<token> connection URL. An anonymous handshake gets
                 // 401 + WWW-Authenticate (RFC 9728) so MCP clients auto-start the OAuth
                 // flow. Set MCP_ALLOW_ANONYMOUS=true to re-open the anonymous trial lane.
-                if (offeringSlug === 'mcp' && !isSpt && !apiKey && process.env.MCP_ALLOW_ANONYMOUS !== 'true') {
-                    res.setHeader('WWW-Authenticate', 'Bearer resource_metadata="https://mcp.fodda.ai/.well-known/oauth-protected-resource/mcp"');
-                    return res.status(401).json({
-                        jsonrpc: '2.0',
-                        error: { code: -32000, message: 'Authentication required. Connect via OAuth, or use your personal connection URL or API key from https://app.fodda.ai.' },
+                if (!isSpt && !apiKey && process.env.MCP_ALLOW_ANONYMOUS !== 'true') {
+                    return sendAuth401(res, {
+                        offeringSlug,
+                        message: 'Authentication required. Connect via OAuth, or use your personal connection URL or API key from https://app.fodda.ai.',
+                        invalidToken: false,
                         id: body?.id ?? null,
                     });
                 }
@@ -981,23 +1274,22 @@ app.all(['/mcp', '/brand-intelligence', '/topic-research', '/deep-research', '/e
                 // Wrap foddaRequest. SPT sessions authenticate the internal fan-out with the
                 // internal service key (the SPT is spent ONCE at settlement, never on fan-out);
                 // otherwise bake in source attribution.
-                const internalKey = process.env.FODDA_INTERNAL_API_KEY || '';
                 const boundFoddaRequest = isSpt
-                    ? ((m, p, _k, u, b, r, _s, sptArg) => foddaRequest(m, p, sptArg ? '' : internalKey, u, b, r, 'spt', sptArg))
-                    : (source
-                        ? ((m, p, k, u, b, r) => foddaRequest(m, p, k, u, b, r, source))
-                        : foddaRequest);
-                const server = await createServer(apiKey, userId, boundFoddaRequest, waverunnerRequest, storeWidget, getServiceUrl, entryId, sptInfo ?? undefined, allowedTools);
+                    ? ((m, p, _k, u, b, r, _s, sptArg) => foddaRequest(m, p, sptArg ? '' : internalKey, u, b, r, isInternalTest ? 'mcp-internal-test' : 'spt', sptArg, clientSlug || undefined))
+                    : ((m, p, k, u, b, r) => foddaRequest(m, p, k, u, b, r, source || undefined, undefined, clientSlug || undefined));
+                const server = await createServer(apiKey, userId, boundFoddaRequest, waverunnerRequest, storeWidget, getServiceUrl, entryId, sptInfo ?? undefined, allowedTools, source || undefined);
                 transport = new StreamableHTTPServerTransport({
                     sessionIdGenerator: () => crypto.randomUUID(),
                     onsessioninitialized: (sid) => {
-                        console.error(`Session created: ${sid}`);
+                        console.error(`Session created: ${sid} (source: ${source || 'none'}, client: ${clientSlug || 'unknown'})`);
                         transports.set(sid, transport);
                         sessionApiKeys.set(sid, apiKey);
                         sessionUserIds.set(sid, userId);
                         sessionCreatedAt.set(sid, Date.now()); // C2: track creation time
                         if (source)
                             sessionSources.set(sid, source);
+                        if (clientSlug)
+                            sessionClients.set(sid, clientSlug);
                         if (sptInfo)
                             sessionSpts.set(sid, sptInfo);
                     }
@@ -1009,6 +1301,7 @@ app.all(['/mcp', '/brand-intelligence', '/topic-research', '/deep-research', '/e
                         sessionApiKeys.delete(sid);
                         sessionUserIds.delete(sid);
                         sessionSources.delete(sid);
+                        sessionClients.delete(sid);
                         sessionSpts.delete(sid);
                         sessionCreatedAt.delete(sid); // C2: clean up creation time
                     }
@@ -1016,11 +1309,41 @@ app.all(['/mcp', '/brand-intelligence', '/topic-research', '/deep-research', '/e
                 await server.connect(transport);
             }
             else {
-                return res.status(400).json({
-                    jsonrpc: '2.0',
-                    error: { code: -32000, message: 'Bad Request: Session required' },
-                    id: null
-                });
+                // Non-initialize POST without an existing sessionId:
+                // Support stateless single-shot JSON-RPC execution (e.g. direct tools/list via curl or script)
+                if (!isSpt && !apiKey && process.env.MCP_ALLOW_ANONYMOUS !== 'true') {
+                    return sendAuth401(res, {
+                        offeringSlug,
+                        message: 'Authentication required. Connect via OAuth, or use your personal connection URL or API key from https://app.fodda.ai.',
+                        invalidToken: false,
+                        id: body?.id ?? null,
+                    });
+                }
+                let sptInfo = null;
+                if (isSpt) {
+                    if (process.env.ENABLE_SPT !== 'true') {
+                        return res.status(401).json({
+                            jsonrpc: '2.0',
+                            error: { code: -32000, message: 'SPT payment tokens are not accepted on this endpoint. Connect via OAuth at https://app.fodda.ai.' },
+                            id: body?.id ?? null,
+                        });
+                    }
+                    const v = await validateSpt(spt);
+                    if (!v.valid) {
+                        return res.status(402).json({
+                            jsonrpc: '2.0',
+                            error: { code: -32002, message: `SPT validation failed: ${v.error || 'invalid token'}` },
+                            id: body?.id ?? null,
+                        });
+                    }
+                    sptInfo = { token: spt, maxAmountCents: v.max_amount_cents, prices: v.prices };
+                }
+                const boundFoddaRequest = isSpt
+                    ? ((m, p, _k, u, b, r, _s, sptArg) => foddaRequest(m, p, sptArg ? '' : internalKey, u, b, r, isInternalTest ? 'mcp-internal-test' : 'spt', sptArg, clientSlug || undefined))
+                    : ((m, p, k, u, b, r) => foddaRequest(m, p, k, u, b, r, source || undefined, undefined, clientSlug || undefined));
+                const server = await createServer(apiKey, userId, boundFoddaRequest, waverunnerRequest, storeWidget, getServiceUrl, entryId, sptInfo ?? undefined, allowedTools, source || undefined);
+                transport = new StreamableHTTPServerTransport();
+                await server.connect(transport);
             }
         }
         else {
@@ -1030,10 +1353,15 @@ app.all(['/mcp', '/brand-intelligence', '/topic-research', '/deep-research', '/e
                 id: null
             });
         }
-        // Inject Accept: text/event-stream if missing (prevents SDK 406)
-        const accept = req.headers['accept'] || '';
-        if (!accept.includes('text/event-stream')) {
-            req.headers['accept'] = accept ? `${accept}, text/event-stream` : 'application/json, text/event-stream';
+        // Ensure Accept includes both application/json and text/event-stream (required by MCP SDK Streamable HTTP transport)
+        const currentAccept = (req.headers['accept'] || '').toString();
+        const needed = [];
+        if (!currentAccept.includes('application/json'))
+            needed.push('application/json');
+        if (!currentAccept.includes('text/event-stream'))
+            needed.push('text/event-stream');
+        if (needed.length > 0) {
+            req.headers['accept'] = currentAccept ? `${currentAccept}, ${needed.join(', ')}` : 'application/json, text/event-stream';
             const idx = req.rawHeaders?.findIndex((h) => h.toLowerCase() === 'accept');
             if (idx !== undefined && idx >= 0 && req.rawHeaders) {
                 req.rawHeaders[idx + 1] = req.headers['accept'];
@@ -1050,29 +1378,6 @@ app.all(['/mcp', '/brand-intelligence', '/topic-research', '/deep-research', '/e
             res.status(500).json({ error: 'Internal server error' });
     }
 });
-// Legacy SSE transport
-app.get('/sse', async (req, res) => {
-    const apiKey = req.query.api_key || '';
-    const entryId = req.query.id || '';
-    const isEmailId = entryId.includes('@') && entryId.includes('.');
-    const userId = req.query.user_id
-        || req.headers['x-user-id']
-        || (isEmailId ? entryId : 'anonymous');
-    const source = req.query.source || '';
-    const sessionId = crypto.randomUUID();
-    const transport = new SSEServerTransport('/messages', res);
-    // Bind source parameter to foddaRequest to forward it upstream as X-Fodda-Source
-    const boundFoddaRequest = source
-        ? ((m, p, k, u, b, r) => foddaRequest(m, p, k, u, b, r, source))
-        : foddaRequest;
-    const server = await createServer(apiKey, userId, boundFoddaRequest, waverunnerRequest, storeWidget, getServiceUrl);
-    await server.connect(transport);
-    console.error(`SSE session: ${sessionId}`);
-});
-app.post('/messages', async (req, res) => {
-    // SSE message handler would go here
-    res.status(404).json({ error: 'Use /mcp endpoint' });
-});
 // Favicon — required for Anthropic Connectors Directory (Google favicon API)
 const FAVICON_SVG = 'https://ucarecdn.com/e3ce77f2-661e-48a1-a294-c7c01039aed4/foddaminilogo.svg';
 const FAVICON_PNG = 'https://ucarecdn.com/6e7893d7-6b14-426b-83bc-574a3f72d6bc/foddafavicon.png';