opedd-mcp 0.6.6 → 0.6.8

package/README.md

@@ -18,7 +18,7 @@
 <p align="center">
   <a href="cursor://anysphere.cursor-deeplink/mcp/install?name=opedd&config=eyJjb21tYW5kIjoibnB4IC15IG9wZWRkLW1jcCJ9"><img src="https://img.shields.io/badge/Add%20to-Cursor-000?logo=cursor" alt="Add to Cursor"></a>
   <a href="https://insiders.vscode.dev/redirect/mcp/install?name=opedd&config=%7B%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22opedd-mcp%22%5D%7D"><img src="https://img.shields.io/badge/Install%20in-VS%20Code-007ACC?logo=visualstudiocode" alt="Install in VS Code"></a>
-  <a href="https://opedd.com/for-ai-agents"><img src="https://img.shields.io/badge/Docs-opedd.com-111" alt="Docs"></a>
+  <a href="https://opedd.com/for-ai-agents?utm_source=github&utm_medium=readme&utm_campaign=mcp"><img src="https://img.shields.io/badge/Docs-opedd.com-111" alt="Docs"></a>
 </p>
 
 Lets AI assistants (Claude Desktop, Cursor, Windsurf, or any MCP-compatible host) discover, purchase, and verify content licenses autonomously — mid-conversation, without opening a browser. Every license is registered on-chain (Tempo blockchain) with cryptographic proof.
@@ -31,7 +31,7 @@ Lets AI assistants (Claude Desktop, Cursor, Windsurf, or any MCP-compatible host
 npx opedd-mcp
 ```
 
-Then add it to your MCP host (see [Claude Desktop / Cursor / Windsurf setup](#claude-desktop-setup) below). Discovery + verification tools work with no configuration; purchasing and content retrieval use optional API keys from [opedd.com](https://opedd.com).
+Then add it to your MCP host (see [Claude Desktop / Cursor / Windsurf setup](#claude-desktop-setup) below). Discovery + verification tools work with no configuration; purchasing and content retrieval use optional API keys from [opedd.com](https://opedd.com?utm_source=github&utm_medium=readme&utm_campaign=mcp).
 
 ## Hosted endpoint — no install (mcp.opedd.com)
 
@@ -279,9 +279,9 @@ Opedd is the **licensed content delivery layer** for AI — not just a licensing
 
 ## Learn more
 
-- [Opedd for AI Agents](https://opedd.com/for-ai-agents) — full documentation, code examples, endpoint reference
+- [Opedd for AI Agents](https://opedd.com/for-ai-agents?utm_source=github&utm_medium=readme&utm_campaign=mcp) — full documentation, code examples, endpoint reference
 - [API Docs](https://docs.opedd.com) — OpenAPI spec with agent endpoints
-- [Opedd Registry](https://opedd.com/registry) — browse on-chain license proofs
+- [Opedd Registry](https://opedd.com/registry?utm_source=github&utm_medium=readme&utm_campaign=mcp) — browse on-chain license proofs
 
 ## License
 

package/dist/index.js

@@ -640,7 +640,10 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     // dispatchTool) keeps unit tests, which call dispatchTool directly, silent.
     const start = Date.now();
     const result = await dispatchTool(request.params.name, (request.params.arguments ?? {}));
-    captureToolCall(request.params.name, Date.now() - start, result.isError !== true);
+    // channel:"stdio" lets the channel report separate local (npx) usage from
+    // hosted-gateway usage (channel:"gateway"); the Phase-2 hosted trigger
+    // counts only the latter.
+    captureToolCall(request.params.name, Date.now() - start, result.isError !== true, { channel: "stdio" });
     return result;
 });
 // ─── Tool dispatcher (exported for unit tests) ────────────────────────────────

package/dist/telemetry.d.ts

@@ -5,7 +5,7 @@ export declare function isTelemetryEnabled(): boolean;
  * PII, keys, or content by construction. Pure; exported so a test can assert
  * the privacy invariant directly.
  */
-export declare function toolCallProperties(tool: string, durationMs: number, ok: boolean): Record<string, string | number | boolean>;
+export declare function toolCallProperties(tool: string, durationMs: number, ok: boolean, extra?: Record<string, string | number | boolean>): Record<string, string | number | boolean>;
 export declare function initTelemetry(): void;
-export declare function captureToolCall(tool: string, durationMs: number, ok: boolean): void;
+export declare function captureToolCall(tool: string, durationMs: number, ok: boolean, extra?: Record<string, string | number | boolean>): void;
 export declare function shutdownTelemetry(): Promise<void>;

package/dist/telemetry.js

@@ -36,8 +36,14 @@ export function isTelemetryEnabled() {
  * PII, keys, or content by construction. Pure; exported so a test can assert
  * the privacy invariant directly.
  */
-export function toolCallProperties(tool, durationMs, ok) {
+export function toolCallProperties(tool, durationMs, ok, extra) {
+    // Spread `extra` FIRST so it can never overwrite the privacy-critical /
+    // integrity fields below. Otherwise a future caller passing e.g.
+    // { tool: ... } or { ok: ... } could silently forge metrics or shadow the
+    // canonical fields — the "nothing sensitive by construction" guarantee
+    // must hold even against a coding mistake in a caller.
     return {
+        ...extra,
         tool,
         duration_ms: Math.round(durationMs),
         ok,
@@ -63,14 +69,18 @@ export function initTelemetry() {
         client = null;
     }
 }
-export function captureToolCall(tool, durationMs, ok) {
+export function captureToolCall(tool, durationMs, ok, 
+// Extra event properties (still no params/PII/keys by construction).
+// The hosted gateway uses this to tag internal probes ({ internal: true })
+// so channel metrics can be filtered to genuinely external callers.
+extra) {
     if (!client)
         return;
     try {
         client.capture({
             distinctId: sessionId,
             event: "mcp_tool_call",
-            properties: toolCallProperties(tool, durationMs, ok),
+            properties: toolCallProperties(tool, durationMs, ok, extra),
         });
     }
     catch {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "opedd-mcp",
-  "version": "0.6.6",
-  "description": "Licensed, rights-cleared content for AI agents — verifiable license keys, on-chain proof, and EU AI Act attestation. The MCP alternative to unlicensed scraping for RAG and AI search.",
+  "version": "0.6.8",
+  "description": "Licensed, rights-cleared content for AI agents \u2014 verifiable license keys, on-chain proof, and EU AI Act attestation. The MCP alternative to unlicensed scraping for RAG and AI search.",
   "type": "module",
   "main": "dist/index.js",
   "mcpName": "com.opedd/opedd-mcp",
@@ -56,5 +56,8 @@
   "files": [
     "dist"
   ],
-  "types": "dist/index.d.ts"
+  "types": "dist/index.d.ts",
+  "overrides": {
+    "esbuild": "^0.28.1"
+  }
 }