tariffmonitor-mcp 1.0.0 → 1.2.1

package/README.md

@@ -11,26 +11,36 @@ Two tools:
 | Tool | What it does |
 |---|---|
 | `lookup_hts_code` | Search 19,856 HTS codes by description or numeric prefix |
-| `calculate_tariff` | Returns stacked rate (base + Section 301 + IEEPA + reciprocal) + Nov 10 cliff projection. Optional: annual import volume → dollar impact |
+| `calculate_tariff` | Returns an estimated stacked rate (MFN base + Section 301 + Section 232) and flags the Nov 10, 2026 Section 301 exclusion expiry. Optional: annual import volume → dollar impact |
+
+Example exchange — a real capture from the live API on 2026-09-11, not a mock-up:
 
-Example exchange:
 ```
-You: What's the tariff on athletic footwear from China, and how does the cliff change my costs if I import $800k/year?
+You: What's the tariff on athletic footwear from China, and what does it cost me at $800k/year?
+
+Claude: [calls lookup_hts_code query="athletic footwear", then calculate_tariff
+         hts_code="6404110000", origin_country="CN", annual_import_value_usd=800000]
+
+Note: 6404110000 is not in the schedule. This rate is for heading 640411, resolved to 6404112030.
+
+HTS 6404112030 - For men
+Origin: CN
 
-Claude: [uses calculate_tariff with hts_code="6404.11", origin_country="CN", annual_import_value_usd=800000]
-HTS 6404110000 — Footwear with outer soles of rubber/plastics...
 Rate stack:
-  Base rate (MFN): +20.00%
-  Section 301 (List 4A): +7.50%
-  IEEPA emergency tariff: +145.00%
-Total current rate: 172.50%
-Nov 10, 2026 cliff: 195.00% (+22.50pp jump)
+  MFN base rate: +0.00%
+  Section 301 (China trade enforcement): +7.50%
+Total current rate: 7.50%
+
+No cliff change projected for this code/country combination.
 
 Dollar impact at $800,000/yr import value:
-  Current annual duties: $1,380,000
-  Additional after Nov 10 cliff: $180,000/yr
+  Current annual duties: $60,000
 ```
 
+Rates change, and a rate is per HTS code and origin country - treat the numbers above as the shape
+of the answer, not as a quote for your shipment. The tool never invents a rate: if the upstream is
+unreachable or the code is not in the schedule, it says so instead of estimating.
+
 ## Install (Claude Desktop)
 
 Add to your `claude_desktop_config.json`:
@@ -70,11 +80,6 @@ The tool calls the free public API at adcreator-ai.com. No signup, no rate limit
 ## Related
 
 - [Free tariff calculator](https://adcreator-ai.com/tariffs/calculator) — browser version
-- [Free sample pack](https://scholar.0xpi.com/get/tariffmonitor) — 5 HTS codes with full cliff math PDF
-- [Tariff Survival Kit ($39)](https://weaverdale5.gumroad.com/l/wmpath) — 67 HTS codes pre-computed + sourcing alternatives + Nov 10 action checklist
-
-## Affiliate program
-
-Earn 35% on every sale. [Sign up here](https://app.gumroad.com/affiliates/products/wmpath).
+- [Official US Harmonized Tariff Schedule](https://hts.usitc.gov/) — the authoritative rates
 
 Built by [Dale Weaver / 0xpi](https://0xpi.com).

package/package.json

@@ -1,14 +1,15 @@
 {
   "name": "tariffmonitor-mcp",
-  "version": "1.0.0",
-  "description": "Tariff Exposure Monitor — live US import tariff calculator MCP server. Looks up any HTS code, returns stacked rate (Section 301 + IEEPA + reciprocal), and projects the November 10, 2026 cliff jump. 19,856 HTS codes. Free, no signup.",
+  "version": "1.2.1",
+  "description": "Tariff Exposure Monitor \u2014 live US import tariff calculator MCP server. Looks up any HTS code, returns an estimated stacked rate (MFN + Section 301 + Section 232) and flags the November 10, 2026 Section 301 exclusion expiry. 19,856 HTS codes. Free, no signup.",
   "type": "module",
   "bin": {
     "tariffmonitor-mcp": "src/index.js"
   },
   "main": "src/index.js",
   "scripts": {
-    "start": "node src/index.js"
+    "start": "node src/index.js",
+    "start:http": "node src/http.js"
   },
   "keywords": [
     "mcp",
@@ -18,7 +19,7 @@
     "import-duty",
     "trade",
     "section-301",
-    "ieepa",
+    "section-232",
     "customs",
     "ecommerce",
     "shopify",

package/src/http.js

@@ -0,0 +1,156 @@
+#!/usr/bin/env node
+// Tariff Exposure Monitor — stateless HTTPS endpoint for Voidnet.
+//
+// Written to Voidnet's publisher contract (docs.openvoidnet.com/docs/publisher-guide/mcp,
+// read 2026-08-21), which is NOT the same protocol the stdio server speaks:
+//   - MCP 2026-07-28, STATELESS. No initialize handshake, no sessions, no GET/DELETE.
+//   - One endpoint, /mcp, handling every method.
+//   - server/discover replaces initialize.
+//   - Authorization: Bearer <publisher key> validated on EVERY request; 401 otherwise.
+//   - MCP-Protocol-Version header must match _meta.protocolVersion in the body (-32020 if not).
+//   - Unsupported protocol version -> 400 / -32022.
+// TLS is terminated by nginx in front of this process, so it listens on plain HTTP on localhost.
+//
+// The tools themselves come from src/tools.js — the same code the stdio server runs, so the two
+// transports cannot drift apart.
+import http from 'node:http';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { TOOLS, callTool, SERVER_INFO } from './tools.js';
+
+// Read .env ourselves. systemd would do this via EnvironmentFile, but this runs under pm2, which
+// does not — and the first deploy silently kept reporting key_configured:false because of it.
+// Deliberately does NOT override anything already in the environment.
+(() => {
+  try {
+    const envPath = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', '.env');
+    for (const line of fs.readFileSync(envPath, 'utf8').split('\n')) {
+      const m = line.match(/^\s*([A-Z_][A-Z0-9_]*)\s*=\s*(.*)\s*$/);
+      if (m && !process.env[m[1]]) process.env[m[1]] = m[2].replace(/^["']|["']$/g, '');
+    }
+  } catch { /* no .env is a normal state: the server then fails closed, which is intended */ }
+})();
+
+const PORT = Number(process.env.PORT || 8791);
+const HOST = process.env.HOST || '127.0.0.1';
+const PROTOCOL_VERSION = '2026-07-28';
+// Generated by Voidnet Console when the app is published, and shown once. Until it is set this
+// server FAILS CLOSED: an endpoint that accepts unauthenticated calls is worse than one that is
+// not published yet. VOIDNET_ALLOW_UNAUTH=1 exists only for local smoke tests.
+const PUBLISHER_KEY = process.env.VOIDNET_PUBLISHER_KEY || '';
+const ALLOW_UNAUTH = process.env.VOIDNET_ALLOW_UNAUTH === '1';
+
+const json = (res, status, body, extra = {}) => {
+  const s = JSON.stringify(body);
+  res.writeHead(status, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(s), ...extra });
+  res.end(s);
+};
+const rpcError = (res, status, id, code, message, data) =>
+  json(res, status, { jsonrpc: '2.0', id: id ?? null, error: { code, message, ...(data ? { data } : {}) } });
+
+function readBody(req, limit = 1_000_000) {
+  return new Promise((resolve, reject) => {
+    let n = 0; const chunks = [];
+    req.on('data', (c) => { n += c.length; if (n > limit) { reject(new Error('body too large')); req.destroy(); } else chunks.push(c); });
+    req.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+    req.on('error', reject);
+  });
+}
+
+const server = http.createServer(async (req, res) => {
+  // Liveness, for our own monitoring only — not part of the Voidnet contract.
+  if (req.method === 'GET' && (req.url === '/health' || req.url === '/mcp/health')) {
+    return json(res, 200, { ok: true, server: SERVER_INFO, protocol: PROTOCOL_VERSION,
+                            tools: TOOLS.map((t) => t.name), key_configured: !!PUBLISHER_KEY });
+  }
+  // "No GET/DELETE endpoints" — say so explicitly rather than 404, which reads like a wrong URL.
+  if (req.method !== 'POST') {
+    return rpcError(res, 405, null, -32600, 'Method Not Allowed',
+      'This is a stateless MCP 2026-07-28 endpoint; use POST /mcp.');
+  }
+  if ((req.url || '').split('?')[0] !== '/mcp') {
+    return rpcError(res, 404, null, -32601, 'Not Found', 'The MCP endpoint is POST /mcp.');
+  }
+
+  // 1. AUTH FIRST — before parsing, before anything. "If the key is invalid, return 401
+  //    immediately — do not process the MCP request."
+  const auth = req.headers['authorization'] || '';
+  const presented = auth.startsWith('Bearer ') ? auth.slice(7).trim() : '';
+  if (!ALLOW_UNAUTH) {
+    if (!PUBLISHER_KEY) {
+      console.error('[mcp-http] no VOIDNET_PUBLISHER_KEY configured — refusing every request');
+      return rpcError(res, 401, null, -32001, 'Unauthorized', 'Server is not configured with a publisher key');
+    }
+    if (!presented || presented !== PUBLISHER_KEY) {
+      return rpcError(res, 401, null, -32001, 'Unauthorized', 'Invalid or missing publisher API key');
+    }
+  }
+
+  let body;
+  try { body = JSON.parse(await readBody(req)); }
+  catch (e) { return rpcError(res, 400, null, -32700, 'Parse error', e.message); }
+
+  const id = body?.id ?? null;
+  const method = body?.method;
+
+  // 2. Protocol version: the HEADER must be supported, and must MATCH the body's _meta.
+  const headerVersion = req.headers['mcp-protocol-version'];
+  if (headerVersion && headerVersion !== PROTOCOL_VERSION) {
+    return rpcError(res, 400, id, -32022, 'Unsupported protocol version',
+      `This server speaks ${PROTOCOL_VERSION}; received ${headerVersion}`);
+  }
+  const bodyVersion = body?._meta?.protocolVersion;
+  if (headerVersion && bodyVersion && headerVersion !== bodyVersion) {
+    return rpcError(res, 400, id, -32020, 'HeaderMismatch',
+      `MCP-Protocol-Version (${headerVersion}) does not match _meta.protocolVersion (${bodyVersion})`);
+  }
+  if (bodyVersion && bodyVersion !== PROTOCOL_VERSION) {
+    return rpcError(res, 400, id, -32022, 'Unsupported protocol version',
+      `This server speaks ${PROTOCOL_VERSION}; body requested ${bodyVersion}`);
+  }
+
+  try {
+    if (method === 'server/discover') {
+      return json(res, 200, { jsonrpc: '2.0', id, result: {
+        supportedVersions: [PROTOCOL_VERSION],
+        capabilities: { tools: { listChanged: false } },
+        serverInfo: SERVER_INFO,
+        instructions: 'US import tariff data. Call lookup_hts_code first when you only have a '
+          + 'product description, then calculate_tariff with the HTS code and an ISO-2 origin '
+          + 'country to get the full stacked rate and the Nov 10 2026 cliff projection.',
+      } });
+    }
+    if (method === 'tools/list') {
+      return json(res, 200, { jsonrpc: '2.0', id, result: { tools: TOOLS } });
+    }
+    if (method === 'tools/call') {
+      const name = body?.params?.name;
+      if (!name) return rpcError(res, 400, id, -32602, 'Invalid params', 'params.name is required');
+      if (!TOOLS.some((t) => t.name === name)) {
+        return rpcError(res, 404, id, -32601, 'Unknown tool', `No tool named "${name}"`);
+      }
+      const result = await callTool(name, body?.params?.arguments || {});
+      return json(res, 200, { jsonrpc: '2.0', id, result });
+    }
+    if (method === 'ping') return json(res, 200, { jsonrpc: '2.0', id, result: {} });
+    // Declared unsupported rather than silently empty: a buyer must be able to tell
+    // "this server has no resources" from "this server ignored me".
+    if (method === 'resources/list') return json(res, 200, { jsonrpc: '2.0', id, result: { resources: [] } });
+    if (method === 'prompts/list') return json(res, 200, { jsonrpc: '2.0', id, result: { prompts: [] } });
+    if (method === 'initialize') {
+      return rpcError(res, 400, id, -32022, 'Unsupported protocol version',
+        'This endpoint is stateless MCP 2026-07-28; use server/discover instead of initialize.');
+    }
+    return rpcError(res, 404, id, -32601, 'Method not found', String(method));
+  } catch (e) {
+    console.error('[mcp-http] handler error:', e.message);
+    return rpcError(res, 500, id, -32603, 'Internal error', e.message);
+  }
+});
+
+server.listen(PORT, HOST, () => {
+  console.log(`[mcp-http] tariffmonitor on http://${HOST}:${PORT}/mcp · protocol ${PROTOCOL_VERSION}`
+    + ` · tools: ${TOOLS.map((t) => t.name).join(', ')}`
+    + ` · publisher key ${PUBLISHER_KEY ? 'configured' : 'NOT SET (all requests will 401)'}`);
+});

package/src/index.js

@@ -1,168 +1,19 @@
 #!/usr/bin/env node
-// Tariff Exposure Monitor MCP server
+// Tariff Exposure Monitor MCP server — stdio transport (Claude Desktop, Cursor).
 //
-// Exposes two tools:
-//   lookup_hts_code    — search 19,856 HTS codes by description or prefix
-//   calculate_tariff   — stacked rate (base + Section 301 + IEEPA + reciprocal)
-//                        plus the November 10, 2026 cliff projection
-//
-// Data is served from adcreator-ai.com — free, no API key required.
+// The tools themselves live in src/tools.js so that src/http.js can serve exactly the same
+// behaviour over HTTPS. This file is now only the stdio wiring.
 
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import {
-  ListToolsRequestSchema,
-  CallToolRequestSchema,
-} from '@modelcontextprotocol/sdk/types.js';
-
-const API_BASE = 'https://adcreator-ai.com/api/tem';
-const PACK_URL = 'https://scholar.0xpi.com/get/tariffmonitor';
-const BUY_URL  = 'https://weaverdale5.gumroad.com/l/wmpath';
-
-const server = new Server(
-  { name: 'tariffmonitor', version: '1.0.0' },
-  { capabilities: { tools: {} } }
-);
-
-async function apiFetch(path) {
-  const res = await fetch(`${API_BASE}${path}`, {
-    headers: { 'User-Agent': 'tariffmonitor-mcp/1.0.0' },
-  });
-  if (!res.ok) throw new Error(`API error ${res.status}`);
-  return res.json();
-}
-
-server.setRequestHandler(ListToolsRequestSchema, async () => ({
-  tools: [
-    {
-      name: 'lookup_hts_code',
-      description: 'Search for HTS (Harmonized Tariff Schedule) codes by description or numeric prefix. Returns up to 12 matching codes with descriptions. Use this before calculate_tariff when you only have a product description.',
-      inputSchema: {
-        type: 'object',
-        properties: {
-          query: {
-            type: 'string',
-            description: 'Product description (e.g. "athletic footwear") or HTS code prefix (e.g. "6404"). Min 2 characters.',
-          },
-        },
-        required: ['query'],
-      },
-    },
-    {
-      name: 'calculate_tariff',
-      description: 'Calculate the full stacked US import tariff rate for an HTS code from a specific origin country. Returns: base rate, each additional layer (Section 301, IEEPA, reciprocal), total current rate, and the projected rate after the November 10, 2026 cliff. Optionally computes dollar impact from annual import volume.',
-      inputSchema: {
-        type: 'object',
-        properties: {
-          hts_code: {
-            type: 'string',
-            description: 'HTS code — at least 6 digits, up to 10 (e.g. "6404.11" or "6404110000"). Dots and spaces are ignored.',
-          },
-          origin_country: {
-            type: 'string',
-            description: 'ISO-2 origin country code (e.g. "CN" for China, "VN" for Vietnam, "MX" for Mexico). Default: CN.',
-            default: 'CN',
-          },
-          annual_import_value_usd: {
-            type: 'number',
-            description: 'Optional. Your annual import value in USD. If provided, the response includes the dollar cost of current duties and the additional cost from the Nov 10 cliff.',
-          },
-        },
-        required: ['hts_code'],
-      },
-    },
-  ],
-}));
-
-server.setRequestHandler(CallToolRequestSchema, async (req) => {
-  const { name, arguments: args } = req.params;
-
-  if (name === 'lookup_hts_code') {
-    const query = String(args.query || '').trim();
-    if (query.length < 2) {
-      return { content: [{ type: 'text', text: 'Query must be at least 2 characters.' }] };
-    }
-    let data;
-    try {
-      data = await apiFetch('/hts/search?q=' + encodeURIComponent(query));
-    } catch (e) {
-      return { content: [{ type: 'text', text: 'Could not reach Tariff Monitor API: ' + e.message }] };
-    }
-    if (!data.ok || !data.results?.length) {
-      return { content: [{ type: 'text', text: 'No HTS codes found matching "' + query + '". Try a broader description or check the code prefix.' }] };
-    }
-    const rows = data.results.map(r => `${r.hts10}  ${r.description}`).join('\n');
-    return {
-      content: [{
-        type: 'text',
-        text: `HTS codes matching "${query}":\n\n${rows}\n\nUse calculate_tariff with the most relevant code.`,
-      }],
-    };
-  }
-
-  if (name === 'calculate_tariff') {
-    const hts = String(args.hts_code || '').replace(/[^0-9]/g, '');
-    const country = String(args.origin_country || 'CN').toUpperCase().slice(0, 2);
-    const vol = Number(args.annual_import_value_usd) || 0;
-
-    if (hts.length < 6) {
-      return { content: [{ type: 'text', text: 'hts_code must be at least 6 digits. Use lookup_hts_code to find the right code.' }] };
-    }
-    if (!/^[A-Z]{2}$/.test(country)) {
-      return { content: [{ type: 'text', text: 'origin_country must be an ISO-2 code (e.g. CN, VN, MX, IN, KR, TW, DE, JP).' }] };
-    }
-
-    let d;
-    try {
-      d = await apiFetch(`/rate?hts=${encodeURIComponent(hts)}&country=${country}&explain=1${vol > 0 ? '&unit_cost=0' : ''}&utm_source=tariffmonitor-mcp`);
-    } catch (e) {
-      return { content: [{ type: 'text', text: 'Could not reach Tariff Monitor API: ' + e.message }] };
-    }
-
-    if (!d.ok) {
-      return { content: [{ type: 'text', text: `HTS code ${hts} not found in the current US schedule. Use lookup_hts_code to find the right code.` }] };
-    }
-
-    const layers = (d.layers || []).map(l =>
-      `  ${l.label}: +${Number(l.rate).toFixed(2)}%`
-    ).join('\n');
-
-    const cliffDelta = (d.cliff_total_rate - d.total_rate).toFixed(2);
-    const cliffLine = Number(cliffDelta) > 0
-      ? `\nNov 10, 2026 cliff: ${d.cliff_total_rate.toFixed(2)}% (+${cliffDelta}pp jump)`
-      : '\nNo cliff change projected for this code/country combination.';
-
-    let dollarLines = '';
-    if (vol > 0) {
-      const currentDuty = Math.round(d.total_rate / 100 * vol);
-      const cliffExtra = Number(cliffDelta) > 0 ? Math.round(Number(cliffDelta) / 100 * vol) : 0;
-      dollarLines = `\n\nDollar impact at $${vol.toLocaleString()}/yr import value:`
-        + `\n  Current annual duties: $${currentDuty.toLocaleString()}`
-        + (cliffExtra > 0 ? `\n  Additional after Nov 10 cliff: $${cliffExtra.toLocaleString()}/yr` : '');
-    }
-
-    const explainBlock = d.explanation ? `\n\nExplanation: ${d.explanation}` : '';
-
-    const text = [
-      `HTS ${d.hts10} — ${d.description}`,
-      `Origin: ${country}`,
-      '',
-      'Rate stack:',
-      layers,
-      `Total current rate: ${d.total_rate.toFixed(2)}%`,
-      cliffLine,
-      dollarLines,
-      explainBlock,
-      '',
-      `Data source: ${PACK_URL}`,
-      `Full 67-code Survival Kit (pre-computed cliff math): ${BUY_URL}`,
-    ].join('\n').replace(/\n{3,}/g, '\n\n').trim();
+import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+import { TOOLS, callTool, SERVER_INFO } from './tools.js';
 
-    return { content: [{ type: 'text', text }] };
-  }
+const server = new Server(SERVER_INFO, { capabilities: { tools: {} } });
 
-  return { content: [{ type: 'text', text: `Unknown tool: ${name}` }] };
-});
+server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: TOOLS }));
+server.setRequestHandler(CallToolRequestSchema, async (req) =>
+  callTool(req.params.name, req.params.arguments || {}));
 
 const transport = new StdioServerTransport();
 await server.connect(transport);

package/src/tools.js

@@ -0,0 +1,205 @@
+// Tool definitions and the logic behind them, with NO transport attached.
+//
+// Split out 2026-08-21 so the same code can serve two very different callers:
+//   src/index.js  — the original stdio server, for Claude Desktop / Cursor. Behaviour unchanged.
+//   src/http.js   — a stateless HTTPS endpoint, which is the only thing Voidnet accepts.
+// Duplicating the tool bodies for the second transport would have guaranteed they drifted apart.
+//
+// 2026-09-11: measured against the live API, BOTH of the examples this file documented returned
+// nothing, because the upstream matches a search query as ONE substring of a code description and
+// resolves a rate by exact-or-prefix code:
+//   /hts/search?q=athletic%20footwear -> ok:true, results: []  while "footwear" alone returns 30+
+//   /rate?hts=6404110000              -> ok:false, not found   while "640411" resolves to 6404112030
+// An agent that followed our own documentation got "no codes found" and stopped. The upstream runs
+// on another host and is not ours to change for this, so both fallbacks below are client-side —
+// and each one STATES what it did. A silent substitution would be answering a different question.
+
+const API_BASE = 'https://adcreator-ai.com/api/tem';
+const PACK_URL = 'https://scholar.0xpi.com/get/tariffmonitor';
+const CALC_URL = 'https://adcreator-ai.com/tariffs/calculator';
+
+export const SERVER_INFO = { name: 'tariffmonitor', version: '1.2.1' };
+
+async function apiFetch(path) {
+  const res = await fetch(`${API_BASE}${path}`, {
+    headers: { 'User-Agent': 'tariffmonitor-mcp/1.2.0' },
+  });
+  if (!res.ok) throw new Error(`API error ${res.status}`);
+  return res.json();
+}
+
+// A multi-word description finds nothing upstream, so retry the individual words, longest first —
+// the longest token is usually the most specific noun. Reports what was actually searched.
+async function searchHts(query) {
+  const first = await apiFetch('/hts/search?q=' + encodeURIComponent(query));
+  if (first.ok && first.results?.length) return { data: first, searched: query, fellBackFrom: null };
+  // In an HTS description the head noun is usually the LAST word - athletic footwear is a kind
+  // of footwear - so try that first, then the remaining words longest-first.
+  const tokens = query.split(/\s+/).filter((w) => w.length >= 3);
+  const words = tokens.length > 1
+    ? [tokens[tokens.length - 1]].concat(tokens.slice(0, -1).sort((a, b) => b.length - a.length))
+    : tokens;
+  if (words.length > 1) {
+    for (const w of words) {
+      const next = await apiFetch('/hts/search?q=' + encodeURIComponent(w));
+      if (next.ok && next.results?.length) return { data: next, searched: w, fellBackFrom: query };
+    }
+  }
+  return { data: first, searched: query, fellBackFrom: null };
+}
+
+// The schedule holds 10-digit statistical suffixes, not zero-padded headings: 6404110000 does not
+// exist while 640411 does. Walk a not-found code back to its 8- then 6-digit heading rather than
+// telling an importer their product is absent from the US tariff schedule when it is not.
+async function fetchRate(hts, country, vol) {
+  const candidates = [hts];
+  if (hts.length > 8) candidates.push(hts.slice(0, 8));
+  if (hts.length > 6) candidates.push(hts.slice(0, 6));
+  let last = null;
+  for (const code of candidates) {
+    const qs = `/rate?hts=${encodeURIComponent(code)}&country=${country}&explain=1`
+      + `${vol > 0 ? '&unit_cost=0' : ''}&utm_source=tariffmonitor-mcp`;
+    last = await apiFetch(qs);
+    if (last.ok) return { d: last, requested: hts, used: code };
+  }
+  return { d: last, requested: hts, used: null };
+}
+
+export const TOOLS = [
+  {
+    name: 'lookup_hts_code',
+    description: 'Search for HTS (Harmonized Tariff Schedule) codes by description or numeric prefix. Returns up to 12 matching codes. Use this before calculate_tariff when you only have a product description. Descriptions are matched as a single phrase, so one keyword ("footwear") matches far more than a phrase ("athletic footwear"); if a phrase matches nothing this tool retries the individual words and tells you which word it used.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        query: {
+          type: 'string',
+          description: 'Product keyword (e.g. "footwear") or HTS code prefix (e.g. "6404"). Minimum 2 characters. Single keywords match best.',
+        },
+      },
+      required: ['query'],
+    },
+  },
+  {
+    name: 'calculate_tariff',
+    description: 'Calculate the full stacked US import tariff rate for an HTS code from a specific origin country. Returns: base rate, each additional layer (Section 301, Section 232), total current rate, and the projected rate after the November 10, 2026 Section 301 exclusion expiry. Figures are estimates; IEEPA tariffs ended 20 Feb 2026 and are not included. Optionally computes dollar impact from annual import volume.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        hts_code: {
+          type: 'string',
+          description: 'HTS code — at least 6 digits, up to 10 (e.g. "6404.11" or "6404112030"). Dots and spaces are ignored. Zero-padded headings such as "6404110000" are not real schedule codes; if the exact code is not found, the 8- then 6-digit heading is tried and the answer states which code the rate is for.',
+        },
+        origin_country: {
+          type: 'string',
+          description: 'ISO-2 origin country code (e.g. "CN" for China, "VN" for Vietnam, "MX" for Mexico). Default: CN.',
+          default: 'CN',
+        },
+        annual_import_value_usd: {
+          type: 'number',
+          description: 'Optional. Your annual import value in USD. If provided, the response includes the dollar cost of current duties and the additional cost from the Nov 10 cliff.',
+        },
+      },
+      required: ['hts_code'],
+    },
+  },
+];
+
+// Returns the MCP content object for a tool call. Never throws for ordinary failures —
+// an unreachable upstream is reported to the caller as text, same as the stdio server always did.
+export async function callTool(name, args = {}) {
+
+  if (name === 'lookup_hts_code') {
+    const query = String(args.query || '').trim();
+    if (query.length < 2) {
+      return { content: [{ type: 'text', text: 'Query must be at least 2 characters.' }] };
+    }
+    let found;
+    try {
+      found = await searchHts(query);
+    } catch (e) {
+      return { content: [{ type: 'text', text: 'Could not reach Tariff Monitor API: ' + e.message }] };
+    }
+    const data = found.data;
+    if (!data.ok || !data.results?.length) {
+      return { content: [{ type: 'text', text: 'No HTS codes found matching "' + query + '"'
+        + (query.includes(' ') ? ', and no single word in it matched either' : '')
+        + '. Try a broader single keyword, or a numeric HTS prefix such as 6404.' }] };
+    }
+    const rows = data.results.map((r) => `${r.hts10}  ${r.description}`).join('\n');
+    const note = found.fellBackFrom
+      ? `No code description contains the whole phrase "${found.fellBackFrom}", so this is a search for "${found.searched}".\n\n`
+      : '';
+    return {
+      content: [{
+        type: 'text',
+        text: `${note}HTS codes matching "${found.searched}":\n\n${rows}\n\nUse calculate_tariff with the most relevant code.`,
+      }],
+    };
+  }
+
+  if (name === 'calculate_tariff') {
+    const hts = String(args.hts_code || '').replace(/[^0-9]/g, '');
+    const country = String(args.origin_country || 'CN').toUpperCase().slice(0, 2);
+    const vol = Number(args.annual_import_value_usd) || 0;
+
+    if (hts.length < 6) {
+      return { content: [{ type: 'text', text: 'hts_code must be at least 6 digits. Use lookup_hts_code to find the right code.' }] };
+    }
+    if (!/^[A-Z]{2}$/.test(country)) {
+      return { content: [{ type: 'text', text: 'origin_country must be an ISO-2 code (e.g. CN, VN, MX, IN, KR, TW, DE, JP).' }] };
+    }
+
+    let r;
+    try {
+      r = await fetchRate(hts, country, vol);
+    } catch (e) {
+      return { content: [{ type: 'text', text: 'Could not reach Tariff Monitor API: ' + e.message }] };
+    }
+    const d = r.d;
+    if (!d || !d.ok) {
+      return { content: [{ type: 'text', text: `HTS code ${hts} is not in the current US schedule, and neither is its 8- or 6-digit heading. Use lookup_hts_code to find the right code.` }] };
+    }
+
+    const layers = (d.layers || []).map((l) => `  ${l.label}: +${Number(l.rate).toFixed(2)}%`).join('\n');
+    const cliffDelta = (d.cliff_total_rate - d.total_rate).toFixed(2);
+    const cliffLine = Number(cliffDelta) > 0
+      ? `\nNov 10, 2026 cliff: ${d.cliff_total_rate.toFixed(2)}% (+${cliffDelta}pp jump)`
+      : '\nNo cliff change projected for this code/country combination.';
+
+    let dollarLines = '';
+    if (vol > 0) {
+      const currentDuty = Math.round(d.total_rate / 100 * vol);
+      const cliffExtra = Number(cliffDelta) > 0 ? Math.round(Number(cliffDelta) / 100 * vol) : 0;
+      dollarLines = `\n\nDollar impact at $${vol.toLocaleString()}/yr import value:`
+        + `\n  Current annual duties: $${currentDuty.toLocaleString()}`
+        + (cliffExtra > 0 ? `\n  Additional after Nov 10 cliff: $${cliffExtra.toLocaleString()}/yr` : '');
+    }
+
+    const explainBlock = d.explanation ? `\n\nExplanation: ${d.explanation}` : '';
+    // Say it plainly when the answer is for a different code than the one asked for. The rate is
+    // right for the code named on the first line, and the caller must be able to see that.
+    const resolvedNote = (r.used && r.used !== r.requested)
+      ? `Note: ${r.requested} is not in the schedule. This rate is for heading ${r.used}, resolved to ${d.hts10}.\n\n`
+      : '';
+
+    const text = [
+      `${resolvedNote}HTS ${d.hts10} — ${d.description}`,
+      `Origin: ${country}`,
+      '',
+      'Rate stack:',
+      layers,
+      `Total current rate: ${d.total_rate.toFixed(2)}%`,
+      cliffLine,
+      dollarLines,
+      explainBlock,
+      '',
+      `Estimate only. Check the authoritative rate at https://hts.usitc.gov/ before relying on it.`,
+      `Free browser calculator: ${CALC_URL}`,
+    ].join('\n').replace(/\n{3,}/g, '\n\n').trim();
+
+    return { content: [{ type: 'text', text }] };
+  }
+
+  return { content: [{ type: 'text', text: `Unknown tool: ${name}` }] };
+}