opedd-mcp 0.12.14 → 0.12.16

package/README.md

@@ -35,7 +35,7 @@ Then add it to your MCP host (see [Claude Desktop / Cursor / Windsurf setup](#cl
 
 ## Hosted endpoint — no install (mcp.opedd.com)
 
-Prefer zero-install? The same 20 tools are served hosted at **`https://mcp.opedd.com/mcp`** (Streamable HTTP). Auth is an `Authorization: Bearer` header with any Opedd key — public discovery tools need no auth at all.
+Prefer zero-install? The same 19 tools are served hosted at **`https://mcp.opedd.com/mcp`** (Streamable HTTP). Auth is an `Authorization: Bearer` header with any Opedd key — public discovery tools need no auth at all.
 
 **Claude Messages API** (production agents):
 
@@ -82,7 +82,7 @@ Key routing: `opedd_sk_*` (legacy `opedd_pub_*`) → publisher tools · `opedd_b
 
 ## What it does
 
-Exposes up to 20 tools to any AI assistant (some are conditional on env vars):
+Exposes up to 19 tools to any AI assistant (some are conditional on env vars):
 
 Every tool carries a `title` and MCP annotations (`readOnlyHint`, `destructiveHint`, `idempotentHint`, `openWorldHint`) so an assistant can tell which tools only read and which spend money or write (v0.12.0).
 
@@ -114,7 +114,7 @@ Every tool carries a `title` and MCP annotations (`readOnlyHint`, `destructiveHi
 | `list_feed` | List the articles a licence order covers, with `since` delta-feed support. AI training and Full catalogue orders carry full `content_body` (`content_access: "included"`); monthly orders are discovery-only (`content_access: "retrieval_per_article"`, fetch text via `get_content`); per-request orders are `"search_only"`. With a buyer key, pass `order_id` (optional when the account holds one active order) |
 | `stream_feed_ndjson` | Bulk-export up to 1000 articles per call via NDJSON wire format. Same content contract and credentials as `list_feed` |
 
-**Requires `OPEDD_BUYER_JWT` (Supabase JWT) — buyer account + audit + compliance + attestation surfaces**
+**Requires `OPEDD_BUYER_JWT` (Supabase JWT) — buyer account + audit + compliance surfaces**
 
 | Tool | Description |
 |------|-------------|
@@ -122,7 +122,6 @@ Every tool carries a `title` and MCP annotations (`readOnlyHint`, `destructiveHi
 | `list_licence_orders` | The buyer's licence orders and lines; with `order_id`, each line's Schedule document and its SHA-256 (the fingerprint recorded on Tempo). Also works with an audit-scoped `OPEDD_BUYER_TOKEN` |
 | `get_audit_events` | Per-event audit ledger with public-record (Tempo) inclusion proofs inline (Phase 9.x + 10 M5) |
 | `get_compliance_dossier` | Procurement-defense compliance dossier mapping retrievals to license terms (Phase 11 M4) |
-| `article_53_attestation` | Signed compliance attestation (JWT) for a license — the artifact a buyer hands to legal/procurement (Phase 12 W1.4) |
 
 **Requires `OPEDD_PUB_BEARER` (opedd_sk_*; legacy opedd_pub_* still works) — publisher-side**
 
@@ -136,10 +135,7 @@ Every tool carries a `title` and MCP annotations (`readOnlyHint`, `destructiveHi
 Per Opedd's platform invariants (W1.6 amendment):
 
 - **`rsl_get(publisher_id, jsonld=true)`** → publisher-side **CDSM Article 4(3)** opt-out declaration (signed JSON-LD receipt over the reservation state).
-- **`article_53_attestation(license_id)`** → buyer-side **signed compliance attestation** (HS256 JWT scoped to one license).
-- **`get_compliance_dossier(from, to)`** → comprehensive procurement-defense dossier covering BOTH sides (publisher CDSM reservation honored + buyer attestation evidence chain).
-
-These serve different audit-defensibility modes and never share wire format. Tool descriptions cite the W1.6 invariant inline.
+- **`get_compliance_dossier(from, to)`** → procurement-defense dossier: every licensed retrieval in a window, with its licence terms, the publisher's CDSM reservation status and public-record proof.
 
 ## Install
 
@@ -161,7 +157,7 @@ Set environment variables to pre-configure the server:
 |----------|----------|-------------|
 | `OPEDD_BUYER_TOKEN` | Optional | Buyer API key (`opedd_buyer_live_*`; `opedd_buyer_test_*` for sandbox) — enables `search_passages` (with the `search` scope), `get_content`, `list_feed` + `stream_feed_ndjson` (with `order_id`) |
 | `OPEDD_ACCESS_KEY` | Optional | An order's enterprise access key (`ent_*`) — alternative credential for `list_feed` + `stream_feed_ndjson` |
-| `OPEDD_BUYER_JWT` | Optional | Supabase session JWT from the buyer portal — enables `place_licence_order` + `list_licence_orders` + `get_buyer_account` + `get_audit_events` + `get_compliance_dossier` + `article_53_attestation` |
+| `OPEDD_BUYER_JWT` | Optional | Supabase session JWT from the buyer portal — enables `place_licence_order` + `list_licence_orders` + `get_buyer_account` + `get_audit_events` + `get_compliance_dossier` |
 | `OPEDD_PUB_BEARER` | Optional | Publisher API key (`opedd_sk_<32-hex>`, canonical since 2026-08-27; older `opedd_pub_<32-hex>` keys keep working) — from the Opedd dashboard, Settings → Developers. Enables `list_publisher_content` (+ `include_body`) and `push_content`. |
 | `OPEDD_API_KEY` | Deprecated | Legacy Publisher API key (`op_...`) — fallback during the transition window; will stop working when opedd-backend Phase C deploys. Migrate to `OPEDD_PUB_BEARER`. |
 | `OPEDD_API_URL` | Optional | Override the API base URL (default: Opedd production) |
@@ -238,8 +234,6 @@ Once configured, you can ask your AI assistant:
 
 > "Get me a CDSM Article 4(3) signed receipt for that publisher's reservation state — set `jsonld: true`." — uses `rsl_get` with content negotiation
 
-> "Generate a signed compliance attestation for our license `11111111-...` covering the last 90 days. I need the artifact for our procurement audit committee." — uses `article_53_attestation` (requires `OPEDD_BUYER_JWT`)
-
 > "This publisher just signed up: `https://noahpinion.substack.com`. Which onboarding workflow should we use?" — uses `detect_platform`
 
 > "Browse the finance category in the Opedd catalog — show me publishers with at least 50 articles." — uses `publisher_directory`
@@ -273,7 +267,7 @@ npm run build # compiles to dist/
 | **Content quality** | Curated publisher content (niche B2B newsletters, expert analysis) | Whatever's on the open web |
 | **Rights** | Verifiable licence for every use, publisher-authorized | No rights clearance |
 | **Proof** | Public record (Tempo) — independently verifiable | None |
-| **Compliance** | Signed attestation + full provenance chain | No provenance |
+| **Compliance** | Audit log, compliance dossier and full provenance chain | No provenance |
 | **Pricing** | Publisher sets their own prices | Platform decides |
 | **Delivery modes** | Article API, bulk feed (JSON firehose), buyer webhooks (push) | Query-response only |
 | **Protocol** | REST + MCP native | REST only |

package/dist/index.d.ts

@@ -10,7 +10,7 @@ export interface Credentials {
     buyerToken?: string;
     /** enterprise access key (ent_*) — /enterprise-license GET feed */
     accessKey?: string;
-    /** Supabase JWT — buyer-audit + compliance + attestation surfaces */
+    /** Supabase JWT — buyer-audit + compliance surfaces */
     buyerJwt?: string;
 }
 export declare function envCredentials(): Credentials;

package/dist/index.js

@@ -180,7 +180,7 @@ function feedCredential(creds, args) {
 }
 const HOW_ACCESS_KEY = "Enterprise access keys (ent_*) are delivered when an enterprise licence is issued — start at https://opedd.com/enterprise " +
     "or place a licence order with the place_licence_order tool.";
-const HOW_PUB_BEARER = "Publisher keys (opedd_sk_*, legacy opedd_pub_* still valid) come from the publisher dashboard: sign up free at https://opedd.com, then Settings → API keys.";
+const HOW_PUB_BEARER = "Publisher keys (opedd_sk_*, legacy opedd_pub_* still valid) come from the publisher dashboard: sign up free at https://opedd.com, then Settings → For developers.";
 // ─── Tool definitions ─────────────────────────────────────────────────────────
 function buildTools(has) {
     const TOOLS = [
@@ -200,7 +200,7 @@ function buildTools(has) {
         },
         {
             name: "request_publication",
-            description: "Asks Opedd to tell you when a publication it does not carry yet becomes available to license. Use it after lookup_content says an article is not on Opedd. Records the request against the email given; nothing is bought. If the publication is already on Opedd, returns its licensing page instead. Free; no key needed.",
+            description: "Asks Opedd to tell you when a publication it does not carry yet becomes available to license. For an article that lookup_content reports is not on Opedd. Records the request against the email given; nothing is bought. If the publication is already on Opedd, returns its licensing page instead. Free; no key needed.",
             inputSchema: {
                 type: "object",
                 required: ["url", "email"],
@@ -326,8 +326,7 @@ function buildTools(has) {
                 "CDSM Article 4(3) reservation state + `tdm:reservationSignedAt` timestamp — regulators can post-hoc " +
                 "verify the reservation was the claimed value at the claimed time. Default `jsonld: false` returns " +
                 "the raw RSL Standard JSON manifest. " +
-                "This is the publisher's own declaration. It is not a compliance attestation for a buyer " +
-                "(use article_53_attestation for that).",
+                "This is the publisher's own declaration, not a record of a buyer's use (get_compliance_dossier records that).",
             inputSchema: {
                 type: "object",
                 required: ["publisher_id"],
@@ -432,7 +431,7 @@ function buildTools(has) {
                 "The publisher must have content delivery enabled and must have pushed content for the article. " +
                 "The response includes author, language, word_count, content_hash, image_urls, canonical_url and tags. " +
                 "On pre-2026-05-14 historical articles, optional fields (author/language/image_urls/canonical_url/tags) may be NULL. " +
-                "NULL means 'data unavailable for this article', NOT 'explicitly empty' — treat as data-missing when filtering; do not interpret as anti-match.",
+                "NULL means the data is unavailable for this article, not that it is empty.",
             inputSchema: {
                 type: "object",
                 required: ["article_id"],
@@ -465,7 +464,7 @@ function buildTools(has) {
                 "Credentials: the order's enterprise access key (OPEDD_ACCESS_KEY, ent_*) OR your buyer API key " +
                 "(OPEDD_BUYER_TOKEN) with order_id — if your account holds exactly one active order, order_id may be omitted; " +
                 "with several, the error lists them. " +
-                "For larger bulk corpus pulls, use stream_feed_ndjson (up to 1000 articles per call vs 200 here).",
+                "stream_feed_ndjson returns up to 1000 articles per call (200 here).",
             inputSchema: {
                 type: "object",
                 properties: {
@@ -493,11 +492,11 @@ function buildTools(has) {
             description: "Bulk-export the articles in a licence order you hold. " +
                 "Returns up to 1000 articles per call (collected from line-delimited JSON wire format). " +
                 "Same content contract as list_feed: full text for AI training orders only; every other order exports " +
-                "metadata (content_body null) — use get_content for article text. " +
+                "metadata (content_body null); get_content returns article text. " +
                 "Each exported article is recorded for analytics; a bulk export is not billed per article. " +
-                "Use `since` (ISO 8601) for delta-feed. Use `cursor` to paginate beyond 1000. " +
+                "`since` (ISO 8601) returns a delta feed; `cursor` pages beyond 1000. " +
                 "Backend supports 5000 articles per call; the MCP cap is 1000 for transport reasonability. " +
-                "Real bulk-ingest pipelines should use the Python SDK (pip install opedd) directly — not via MCP. " +
+                "For bulk-ingest pipelines, the Python SDK (pip install opedd) reads the same feed without the MCP cap. " +
                 "Credentials as list_feed: OPEDD_ACCESS_KEY (ent_*) OR your buyer API key + order_id.",
             inputSchema: {
                 type: "object",
@@ -584,42 +583,9 @@ function buildTools(has) {
                 properties: {},
             },
         });
-        TOOLS.push({
-            name: "article_53_attestation",
-            description: "Issue a signed compliance attestation (a JWT) for a licence you hold. " +
-                "Returns a freshly-signed HS256 JWT regulators can verify offline against the canonical signing key. " +
-                "Embeds: license context, usage-count over the attestation window, the most-recent Tempo Merkle root, " +
-                "and canonical claims (iss/sub/iat/exp/jti/aud). " +
-                "**The artifact a buyer hands to legal/procurement as evidence of where its content came from.** " +
-                "It attests how your licence was used; the publisher's own licensing declaration is rsl_get. " +
-                "Optional `content_id` scopes the attestation to one article; default is license-wide. " +
-                "Window cap: 365 days. Auth: an audit-scoped buyer API key (OPEDD_BUYER_TOKEN) or OPEDD_BUYER_JWT.",
-            inputSchema: {
-                type: "object",
-                required: ["license_id"],
-                properties: {
-                    license_id: {
-                        type: "string",
-                        description: "UUID of the enterprise_license OR legacy individual license to attest. Buyer must own it.",
-                    },
-                    content_id: {
-                        type: "string",
-                        description: "Optional UUID of a specific article to scope the attestation. Default: license-wide.",
-                    },
-                    window_start: {
-                        type: "string",
-                        description: "ISO 8601 lower bound of the attestation window. Default: now - 90 days.",
-                    },
-                    window_end: {
-                        type: "string",
-                        description: "ISO 8601 upper bound. Default: now. Window may not exceed 365 days (hard cap).",
-                    },
-                },
-            },
-        });
         TOOLS.push({
             name: "get_compliance_dossier",
-            description: "Returns the account's compliance dossier for a period: one row per licensed article, with article metadata, licence terms, public-record attestation and compliance flags (the signed attestation, CDSM Article 4(3) and text-and-data-mining reservations). At most 90 days per call; longer periods are paginated with _meta.next_cursor. Each call is recorded in the account's audit log. Requires a buyer API key with the 'audit' scope, a buyer session, or the Opedd connector sign-in.",
+            description: "Returns the account's compliance dossier for a period: one row per licensed article, with article metadata, licence terms, public-record attestation and compliance flags (CDSM Article 4(3) and text-and-data-mining reservations). At most 90 days per call; longer periods are paginated with _meta.next_cursor. Each call is recorded in the account's audit log. Requires a buyer API key with the 'audit' scope, a buyer session, or the Opedd connector sign-in.",
             inputSchema: {
                 type: "object",
                 required: ["from", "to"],
@@ -680,7 +646,7 @@ function buildTools(has) {
             name: "push_content",
             description: "Push your published articles to Opedd so they can be licensed to AI buyers (requires OPEDD_PUB_BEARER — your opedd_sk_ publisher key). " +
                 "Send 1–100 articles per call; batch larger back-catalogues into multiple calls. Each article needs title, url, and html_body — everything else is optional (published_at defaults to now). " +
-                "This is the supply-side companion to list_publisher_content: use it to onboard your archive or push new content with no code, straight from your AI assistant.",
+                "This is the supply-side companion to list_publisher_content: it sends a back catalogue or new articles with no code, from an AI assistant.",
             inputSchema: {
                 type: "object",
                 required: ["articles"],
@@ -737,7 +703,6 @@ export const TOOL_ANNOTATIONS = {
     list_licence_orders: read("List your licence orders"),
     get_audit_events: read("Read your audit log"),
     get_buyer_account: read("Read your buyer account"),
-    article_53_attestation: read("Get a signed compliance attestation"),
     get_compliance_dossier: read("Get your compliance dossier"),
     list_publisher_content: read("List your published articles"),
     // Upserts the publisher's own articles; an upsert can overwrite.
@@ -770,14 +735,14 @@ export const ALL_TOOLS = buildTools({
 // at initialize — it was empty until 2026-08-26 while the pitch lived only in
 // registry metadata agents never see at runtime. Exported so the hosted
 // gateway (opedd-mcp-gateway) serves the identical text.
-export const SERVER_INSTRUCTIONS = "Opedd is content licensing for the AI era, between expert publishers and AI products: discover, purchase, verify and " +
+export const SERVER_INSTRUCTIONS = "Opedd is content licensing for the AI era, between expert publishers and AI products: discover, license, verify and " +
     "retrieve rights-cleared expert content — a verifiable licence for every use, a public record on " +
-    "Tempo, and compliance artifacts (audit ledger, dossiers and signed attestations). Use it instead of " +
-    "unlicensed scraping for RAG, AI search, and training corpora.\n\n" +
+    "Tempo, and compliance artifacts (audit ledger and dossiers). A licensed alternative to " +
+    "unlicensed scraping for RAG, AI search and training corpora.\n\n" +
     `No credentials needed: ${NO_AUTH_TOOLS}.\n` +
-    "Buyer tools (purchase, account, audit/compliance): free buyer signup at https://opedd.com/buyer/signup " +
+    "Buyer tools (licence orders, account, audit/compliance): free buyer signup at https://opedd.com/buyer/signup " +
     "(~2 min; an API key is issued instantly). Publisher tools (content push): free publisher signup at " +
-    "https://opedd.com, key under Settings → API keys.\n" +
+    "https://opedd.com, key under Settings → For developers.\n" +
     "Supply credentials as env vars (local/stdio) or an Authorization: Bearer header (hosted gateway, " +
     "https://mcp.opedd.com/mcp).\n" +
     "EU CDSM Art. 4(3) / TDM-reservation queries: rsl_get. Compliance evidence: get_compliance_dossier. " +
@@ -1119,29 +1084,6 @@ export async function dispatchTool(name, args, creds = ENV_CREDS) {
                 });
                 return ok(data);
             }
-            // ── article_53_attestation (Phase 12 Wave 1 W1.4) ──────────────────────
-            case "article_53_attestation": {
-                if (!auditCred(creds)) {
-                    return credErr("Buyer credentials are required for this tool", "OPEDD_BUYER_TOKEN (audit-scoped key) or OPEDD_BUYER_JWT", HOW_AUDIT_CRED);
-                }
-                const { license_id, content_id, window_start, window_end } = args;
-                if (!license_id)
-                    return err("license_id is required");
-                const params = new URLSearchParams({ license_id });
-                if (content_id)
-                    params.set("content_id", content_id);
-                if (window_start)
-                    params.set("window_start", window_start);
-                if (window_end)
-                    params.set("window_end", window_end);
-                // Function name is DASH-separated end to end: the api.opedd.com proxy
-                // rewrites /:path* verbatim into /functions/v1/:path*, so the prior
-                // slashed "/eu-ai-act/article-53-attestation" resolved to a
-                // nonexistent function named "eu-ai-act" and 404'd — this tool had
-                // NEVER worked in production until the 2026-07-10 fix (live-probed).
-                const data = await opeddFetch(creds, `/eu-ai-act-article-53-attestation?${params.toString()}`, { headers: { Authorization: `Bearer ${auditCred(creds)}` } });
-                return ok(data);
-            }
             // ── get_compliance_dossier (Phase 11 M4) ───────────────────────────────
             case "get_compliance_dossier": {
                 if (!auditCred(creds)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opedd-mcp",
-  "version": "0.12.14",
+  "version": "0.12.16",
   "description": "Content licensing for the AI era. Licensed, rights-cleared content for AI agents, with a verifiable license key for every article. The MCP alternative to unlicensed scraping for RAG and AI search.",
   "type": "module",
   "main": "dist/index.js",