url-safety-validator-mcp 1.2.25 → 1.2.27

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 All notable changes to URL Safety Validator MCP are documented here.
 
+## [1.2.27] — 2026-06-25
+- fix: .npmignore was missing a .claude/ exclusion -- .claude/settings.local.json shipped in the v1.2.26 npm tarball. Added token.tmp, *.tmp, .claude/, CLAUDE.md, SYSTEM_PROMPT.md, MCP-Build-Playbook* to .npmignore.
+
+## [1.2.26] — 2026-06-25
+- feat: calls_remaining field added to check_url responses -- "unlimited" for paid keys, numeric free-tier headroom otherwise
+- feat: verdict_ttl field added (3600s/1hr -- threat landscape changes fast)
+- feat: data_source_status field added (full/degraded/partial) -- "degraded" when Google Web Risk (critical source) is unavailable, "partial" when only AI trust scoring is unavailable, "full" when both respond
+- Task 1 (purpose verb + required fields) audited -- already correct on check_url from a prior pass, no changes needed
+
 ## [1.2.25] — 2026-06-24
 - feat: unauthenticated /public-stats endpoint -- first_deployed, lifetime tool calls, uptime %, version, for agent orchestrators evaluating server trustworthiness
 - feat: /process-trial-followups endpoint + 24h follow-up record on trial-extension grant

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "url-safety-validator-mcp",
   "mcpName": "io.github.OjasKord/url-safety-validator-mcp",
-  "version": "1.2.25",
+  "version": "1.2.27",
   "description": "URL safety checker for AI agents. Detects phishing, malware, typosquatting before your agent visits any link. BLOCK/ALLOW verdict in one call.",
   "main": "src/server.js",
   "scripts": {

package/server.json

@@ -1,48 +1,48 @@
-{
-  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
-  "name": "io.github.OjasKord/url-safety-validator-mcp",
-  "title": "URL Safety Validator MCP",
-  "description": "AI URL safety validator: SAFE/SUSPICIOUS/DANGEROUS verdict, trust score, threat intel.",
-  "version": "1.2.20",
-  "websiteUrl": "https://kordagencies.com",
-  "repository": {
-    "url": "https://github.com/OjasKord/url-safety-validator-mcp",
-    "source": "github"
-  },
-  "packages": [
-    {
-      "registryType": "npm",
-      "identifier": "url-safety-validator-mcp",
-      "version": "1.2.19",
-      "transport": {
-        "type": "stdio"
-      },
-      "environmentVariables": [
-        {
-          "name": "ANTHROPIC_API_KEY",
-          "description": "Anthropic API key for AI trust scoring",
-          "isRequired": true,
-          "isSecret": true
-        },
-        {
-          "name": "GOOGLE_WEB_RISK_API_KEY",
-          "description": "Google Web Risk API key (commercial). Degrades gracefully without it.",
-          "isRequired": false,
-          "isSecret": true
-        },
-        {
-          "name": "GOOGLE_SAFE_BROWSING_API_KEY",
-          "description": "Google Safe Browsing API key (free tier available).",
-          "isRequired": false,
-          "isSecret": true
-        }
-      ]
-    }
-  ],
-  "remotes": [
-    {
-      "type": "streamable-http",
-      "url": "https://url-safety-validator-mcp-production.up.railway.app"
-    }
-  ]
-}
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
+  "name": "io.github.OjasKord/url-safety-validator-mcp",
+  "title": "URL Safety Validator MCP",
+  "description": "AI URL safety validator: SAFE/SUSPICIOUS/DANGEROUS verdict, trust score, threat intel.",
+  "version": "1.2.27",
+  "websiteUrl": "https://kordagencies.com",
+  "repository": {
+    "url": "https://github.com/OjasKord/url-safety-validator-mcp",
+    "source": "github"
+  },
+  "packages": [
+    {
+      "registryType": "npm",
+      "identifier": "url-safety-validator-mcp",
+      "version": "1.2.27",
+      "transport": {
+        "type": "stdio"
+      },
+      "environmentVariables": [
+        {
+          "name": "ANTHROPIC_API_KEY",
+          "description": "Anthropic API key for AI trust scoring",
+          "isRequired": true,
+          "isSecret": true
+        },
+        {
+          "name": "GOOGLE_WEB_RISK_API_KEY",
+          "description": "Google Web Risk API key (commercial). Degrades gracefully without it.",
+          "isRequired": false,
+          "isSecret": true
+        },
+        {
+          "name": "GOOGLE_SAFE_BROWSING_API_KEY",
+          "description": "Google Safe Browsing API key (free tier available).",
+          "isRequired": false,
+          "isSecret": true
+        }
+      ]
+    }
+  ],
+  "remotes": [
+    {
+      "type": "streamable-http",
+      "url": "https://url-safety-validator-mcp-production.up.railway.app"
+    }
+  ]
+}

package/src/server.js

@@ -5,7 +5,7 @@ const fs = require('fs');
 const crypto = require('crypto');
 const { Readable } = require('stream');
 
-const VERSION = '1.2.25';
+const VERSION = '1.2.27';
 const PRO_UPGRADE_URL = 'https://buy.stripe.com/5kQeVc9Ah4n3c8c0h2ebu0t';
 const ENTERPRISE_UPGRADE_URL = 'https://buy.stripe.com/4gMdR88wddXDfko0h2ebu0u';
 const ALLOWED_PAYMENT_LINK_IDS = ['plink_1TQzIHD6WvRe6sn3820kFk07', 'plink_1TQzJdD6WvRe6sn3GN8mQkj9'];
@@ -512,6 +512,9 @@ async function checkUrl(rawUrl) {
   const signals = { google_web_risk: webRisk, google_safe_browsing: safeBrowsing, domain_age: domainAge, ssl };
 
   const ai = await getAITrustScore(href, hostname, signals);
+  // Caching/staleness policy and source-confidence flag (Task 3/4) -- Google Web Risk is the critical source for this server.
+  const VERDICT_TTL_CHECK_URL = 3600; // 1 hour -- threat landscape changes fast
+  const dataSourceStatus = !webRisk.available ? 'degraded' : (!ai.available ? 'partial' : 'full');
 
   // Determine final verdict -- hard overrides
   let verdict = ai.available ? ai.verdict : 'SUSPICIOUS';
@@ -554,6 +557,8 @@ async function checkUrl(rawUrl) {
     },
     checked_at: nowISO(),
     source_url: 'webrisk.googleapis.com',
+    verdict_ttl: VERDICT_TTL_CHECK_URL,
+    data_source_status: dataSourceStatus,
     _disclaimer: LEGAL_DISCLAIMER
   };
 
@@ -1032,6 +1037,7 @@ const server = http.createServer(async (req, res) => {
               recordCall(clientIp, apiKey);
               saveFreeTierToRedis().catch(() => {});
               const result = await checkUrl(url);
+              result.calls_remaining = tier.paid ? 'unlimited' : Math.max(0, tier.remaining);
               appendSessionLog(clientIp, 'check_url').catch((e) => console.error('[SessionLog] appendSessionLog failed:', e));
               usageLog.push({ tool: 'check_url', ip: clientIp, tier: tier.paid ? 'paid' : 'free', timestamp: nowISO() });
               toolUsageCounts['check_url'] = (toolUsageCounts['check_url'] || 0) + 1;

package/.claude/settings.local.json

@@ -1,13 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(git add *)",
-      "Bash(git commit *)",
-      "Bash(git push *)",
-      "Bash(railway up *)",
-      "Bash(curl -sf https://url-safety-validator-mcp-production.up.railway.app/health)",
-      "Bash(curl -si -X OPTIONS https://url-safety-validator-mcp-production.up.railway.app/health -H \"Origin: https://bizfile.forsenia.in\")",
-      "Bash(curl -si https://url-safety-validator-mcp-production.up.railway.app/health)"
-    ]
-  }
-}