lowdown-proxy 0.1.18 → 0.1.19

package/README.md

@@ -55,12 +55,12 @@ The same package ships an MCP server (stdio) that lets an agent query Lowdown di
 
 | Tool | What it returns |
 |---|---|
-| `get_lowdown` | Interactions reported for a target and, for MCP Registry servers, the Scanner observations (see [Scanner observations](#scanner-observations)) |
+| `get_lowdown` | Recorded facts about an MCP server before you install or connect to it: Registry declaration, npm status of declared packages, Scanner observations (see [Scanner observations](#scanner-observations)), and reported interactions. Accepts `mcp:` names, short names and `npm:` package names |
 | `compare_tools` | 2 to 5 targets side by side, ordered by reported success rate; Scanner data is not used for the ordering |
 | `record_interaction` | Records the outcome of using a tool or service |
 | `get_node_stats` | Contribution stats of your node |
 
-The same data is available over HTTP without installing anything: see [Public API](#public-api), the [OpenAPI document](https://lowdown-proxy.vercel.app/openapi.json), and [`llms.txt`](https://lowdown-proxy.vercel.app/llms.txt). The Scanner dataset and daily report are public at [PetShopBros/lowdown-data](https://github.com/PetShopBros/lowdown-data) (CC BY 4.0).
+The same data is available over HTTP without installing anything: see [Public API](#public-api), the [OpenAPI document](https://lowdown-proxy.vercel.app/openapi.json), and [`llms.txt`](https://lowdown-proxy.vercel.app/llms.txt). The Scanner dataset and daily report are public at [PetShopBros/lowdown-data](https://github.com/PetShopBros/lowdown-data) (CC BY 4.0), with a daily copy on [Hugging Face](https://huggingface.co/datasets/art2meta/lowdown-mcp-observations). A [daily record page](https://petshopbros.github.io/lowdown-data/) (with [RSS](https://petshopbros.github.io/lowdown-data/feed.xml) and [JSON Feed](https://petshopbros.github.io/lowdown-data/feed.json)) lists each UTC day's Registry declaration changes, observation counts, tool definition change counts, and values first observed. It has no scores or rankings.
 
 ## App logs in tool results
 
@@ -142,6 +142,9 @@ curl https://lowdown-proxy.vercel.app/api/reputation/mcp:ai.agent-bev/bev-door
 # A short name works when it matches one server; otherwise candidate names are returned
 curl https://lowdown-proxy.vercel.app/api/reputation/bev-door
 
+# An npm package: answers with the Registry entries that declare it (several are all returned as candidates)
+curl https://lowdown-proxy.vercel.app/api/reputation/npm:maplith-bridge
+
 # With node identity: adds task_breakdown and recent_trends for reported interactions
 curl https://lowdown-proxy.vercel.app/api/reputation/mcp:ai.agent-bev/bev-door \
   -H "x-lowdown-node-id: ld_your_node_id"
@@ -196,6 +199,9 @@ Response for that server on 2026-10-20 (trimmed: the full response has 14 daily
 ```
 
 - `registry`: what the official MCP Registry declares for the server, as recorded by Lowdown since 2026-10-19, with changes in the last 30 days. It answers for any Registry entry, observed or not.
+- `packages`: the packages the Registry entry declares. For npm packages, recorded daily from npm's public metadata: `latest`, `latest_deprecated` (the version npm tags as latest only, not other versions), `declared_is_latest`, `checked_at`, and recent changes. `not_found` is recorded only when npm answers HTTP 404; `not_found_since` gives the day a package that had been available started answering 404, or `first_check` when it has answered 404 since Lowdown's first check. A deprecated latest version or a 404 is stated in the first sentence of `message`. Other package types are listed and marked as not checked.
+- `scanner.definition_changes`: changes in the server's tool definitions across Lowdown's daily observations of the last 30 days. Each day is compared with the previous observation from the same remote URL using hashes of tool schemas, descriptions and names: `pattern` (`no_change_observed`, `changed`, `changes_on_most_days`, or `not_enough_observations`), `last_change`, `stable_days_before_last_change`, and up to 5 recent `events`. Use it to notice that a server which had been stable has just changed its tools, before relying on them. Description text is never returned, and a change is a recorded fact, not a judgment.
+- `source` (last field): dataset, license (CC BY 4.0 for the `registry` and `scanner` blocks), retrieval time and a citation line. Keep it with any record you republish.
 - `scanner`: what Lowdown Scanner observed when it connected (`initialize` and `tools/list` only; it never calls a tool): one entry per day for the last 30 days, days without an observation and the recorded reason, the tool names returned by `tools/list`, and declared values next to observed ones. HTTP statuses are reported as observed: a `401` is a `401`, not "dead". A server outside the observed sample returns `observed: false`, which says nothing about its status.
 - Interaction fields: `interactions` is every reported record for the target; `rated_interactions` is the denominator of `success_rate`, and `confidence` is based on it. Scanner observations are never counted in `success_rate`.
 
@@ -242,7 +248,8 @@ Just run the proxy and share what your agents experience.
 
 ## Status
 
-Running continuously since September 2026. Since October 6, 2026 the Scanner has observed a fixed sample of MCP Registry entries every day: 2,000 entries through October 18, and from October 19 a 5,000-entry sample that keeps all of the first 2,000. The daily report and raw data are public at [PetShopBros/lowdown-data](https://github.com/PetShopBros/lowdown-data).
+Running continuously since September 2026. Since October 6, 2026 the Scanner has observed a fixed sample of MCP Registry entries every day: 2,000 entries through October 18, and from October 19 a 5,000-entry sample that keeps all of the first 2,000. The daily report and raw data are public at [PetShopBros/lowdown-data](https://github.com/PetShopBros/lowdown-data), with a daily copy on [Hugging Face](https://huggingface.co/datasets/art2meta/lowdown-mcp-observations).
+Since October 21, 2026 the Scanner also keeps the full tool definitions it receives, privately and once per distinct definition, so that changes can be traced over time. Public data and API responses contain hashes only; the definitions themselves are not published.
 See [DESIGN.md](./DESIGN.md) for what's in scope and what's been ruled out.
 
 ## License
@@ -275,7 +282,11 @@ MCP 서버를 감싸는 stdio 프록시가 첫 번째 진입점입니다.
 
 ### Scanner 관찰 데이터
 
-공식 MCP Registry에 등록된 원격 MCP 서버는 응답에 `scanner` 블록이 함께 옵니다. Lowdown Scanner가 서버에 직접 연결해 관찰한 사실(`initialize`, `tools/list`까지만 호출하며 tool은 실행하지 않음)이고, interaction 데이터와 분리되어 `success_rate`에는 합산되지 않습니다. HTTP 상태는 해석 없이 관찰된 값 그대로 보여줍니다.
+Registry 항목이 npm 패키지를 선언했으면 응답에 `packages` 블록이 옵니다. npm 공개 메타데이터에서 매일 기록한 최신 버전, 최신 버전의 deprecated 여부(다른 버전은 뜻하지 않음), 404 여부를 보여 주고, deprecated나 404는 `message` 첫 문장에 적습니다. 404는 npm이 실제로 404를 답했을 때만 기록합니다. `npm:패키지명`으로도 조회할 수 있고, 여러 항목이 같은 패키지를 선언하면 고르지 않고 후보를 모두 돌려줍니다.
+
+공식 MCP Registry에 등록된 원격 MCP 서버는 응답에 `scanner` 블록이 함께 옵니다. `scanner.definition_changes`는 최근 30일 동안 매일 관찰한 도구 정의(스키마·설명·이름의 해시)가 같은 원격 주소의 직전 관찰과 비교해 언제 바뀌었는지, 얼마나 자주 바뀌는지를 사실로만 보여 줍니다. 오래 안정적이던 서버가 막 바뀐 것을 도구에 의존하기 전에 알아챌 수 있습니다. 설명문 원문은 돌려주지 않습니다. Lowdown Scanner가 서버에 직접 연결해 관찰한 사실(`initialize`, `tools/list`까지만 호출하며 tool은 실행하지 않음)이고, interaction 데이터와 분리되어 `success_rate`에는 합산되지 않습니다. HTTP 상태는 해석 없이 관찰된 값 그대로 보여줍니다.
+
+공개 데이터에는 도구 스키마·설명문의 해시만 있습니다. 2026-10-21부터 Scanner는 받은 도구 정의 원문을 변경 추적용으로 비공개 보관합니다(서로 다른 정의마다 1번). 원문은 공개하지 않고 API로도 돌려주지 않습니다. 날짜별 [일일 기록 페이지](https://petshopbros.github.io/lowdown-data/)(RSS·JSON Feed 포함)에는 Registry 선언 변경, 관찰 수, 도구 정의 변경 수, 처음 관찰된 값이 점수·순위 없이 실립니다.
 
 ### 앱 로그를 도구 결과에 붙이기
 

package/dist/mcp-server.js

@@ -19,13 +19,14 @@ const server = new McpServer({
     version: PKG_VERSION,
 });
 // ── 1. get_lowdown ──────────────────────────────────────────────
-server.tool("get_lowdown", "Look up what Lowdown has recorded about an MCP server, agent, tool, or service before choosing or connecting to it. " +
-    "For MCP Registry servers it returns, in order: a `registry` block (what the official MCP Registry declares, and changes in the last 30 days); " +
-    "a `scanner` block (daily Lowdown Scanner observations of initialize and tools/list over the last 30 days, one entry per day, days without an observation and why, " +
-    "the tool names observed, and declared versus observed version and hosts); and interactions reported by agents (count, outcomes, success rate). " +
-    "The success rate counts organic tool calls and agent reports only; protocol requests, rejected requests, and seeded or synthetic records are counted separately. " +
-    "These are recorded facts, not scores. A server outside the observed sample returns `observed: false` in `scanner`, which says nothing about its status.", {
-    target: z.string().describe("MCP Registry name with the mcp: prefix (e.g. 'mcp:io.github.user/server'), a short name, or an id such as 'agent:some-agent-id'"),
+server.tool("get_lowdown", "Look up recorded facts about an MCP server before installing or connecting to it. " +
+    "Accepts an MCP Registry name ('mcp:io.github.user/server'), a short name, or an npm package ('npm:@scope/name'). " +
+    "Returns, in order: `registry` (what the official MCP Registry declares, and changes in the last 30 days); " +
+    "`packages` (for each declared npm package: npm's latest version, whether that latest version is marked deprecated, and whether npm answers 404, checked daily); " +
+    "`scanner` (daily initialize and tools/list observations over 30 days, including when tool definitions last changed); and interactions reported by agents. " +
+    "When a declared npm package is deprecated or answers 404, the first sentence of `message` says so. " +
+    "These are recorded facts with dates and sources, not scores. Absence of data says nothing about a server's status.", {
+    target: z.string().describe("MCP Registry name with the mcp: prefix (e.g. 'mcp:io.github.user/server'), a short name, an npm package with the npm: prefix (e.g. 'npm:@scope/name'), or an id such as 'agent:some-agent-id'"),
 }, async ({ target }) => {
     const res = await fetch(`${BASE_URL}/api/reputation/${encodeURIComponent(target)}`, { headers: { "x-lowdown-source": "organic", "x-lowdown-node-id": NODE_ID } });
     const data = await res.json();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lowdown-proxy",
-  "version": "0.1.18",
+  "version": "0.1.19",
   "mcpName": "io.github.PetShopBros/lowdown-proxy",
   "description": "Record and query AI agent/tool/service interactions. Shared interaction history for the multi-agent ecosystem.",
   "type": "module",
@@ -16,7 +16,7 @@
     "build": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && tsc",
     "dev": "tsx src/cli.ts",
     "scanner:typecheck": "tsc -p scanner",
-    "scanner:test": "node --test scanner/lib.test.ts scanner/registry-diff.test.ts scanner/first-seen.test.ts scanner/archive.test.ts scanner/reputation.test.ts scanner/report.test.ts",
+    "scanner:test": "node --test scanner/lib.test.ts scanner/registry-diff.test.ts scanner/first-seen.test.ts scanner/archive.test.ts scanner/reputation.test.ts scanner/report.test.ts scanner/tool-defs.test.ts scanner/market.test.ts scanner/private-archive.test.ts scanner/npm.test.ts",
     "scanner:dry": "node scanner/scan.ts --dry-run --limit=30",
     "test": "npm run build && node --test test/p0.test.ts"
   },