vat-validator-mcp 2.0.2 → 2.0.4

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "vat-validator-mcp",
   "mcpName": "io.github.OjasKord/vat-validator-mcp",
-  "version": "2.0.2",
+  "version": "2.0.4",
   "description": "VAT number validator for AI agents. EU VIES, UK HMRC, AU ABR — auto-detects jurisdiction. Fraud risk scoring and invoice name cross-check in one call.",
   "main": "src/server.js",
   "scripts": {

package/server.json

@@ -3,7 +3,7 @@
   "name": "io.github.OjasKord/vat-validator-mcp",
   "title": "VAT Validator MCP",
   "description": "Validate EU, UK, AU VAT numbers for AI agents. EU ViDA e-invoicing compliance.",
-  "version": "2.0.1",
+  "version": "2.0.4",
   "websiteUrl": "https://kordagencies.com",
   "repository": {
     "url": "https://github.com/OjasKord/vat-validator-mcp",
@@ -13,7 +13,7 @@
     {
       "registryType": "npm",
       "identifier": "vat-validator-mcp",
-      "version": "2.0.1",
+      "version": "2.0.4",
       "transport": { "type": "stdio" },
       "environmentVariables": [
         { "name": "ANTHROPIC_API_KEY", "description": "Anthropic API key for AI-powered fraud risk analysis", "isRequired": true, "isSecret": true },

package/src/server.js

@@ -7,7 +7,7 @@ const Stripe = require('stripe');
 const stripe = Stripe(process.env.STRIPE_SECRET_KEY);
 
 const PERSIST_FILE = '/tmp/vat_stats.json';
-const VERSION = '2.0.2';
+const VERSION = '2.0.4';
 
 // Persistent device ID for HMRC fraud prevention headers (BATCH_PROCESS_DIRECT)
 const DEVICE_ID_FILE = path.join(__dirname, '..', 'device-id.txt');
@@ -100,6 +100,25 @@ async function redisSet(key, value) {
   } catch(e) {}
 }
 
+async function redisExpire(key, seconds) {
+  try {
+    await fetch(
+      `${UPSTASH_URL}/expire/${encodeURIComponent(key)}/${seconds}`,
+      { method: 'POST', headers: { Authorization: `Bearer ${UPSTASH_TOKEN}` } }
+    );
+  } catch(e) {}
+}
+
+async function appendSessionLog(ip, tool) {
+  const ipSafe = ip.replace(/:/g, '_').replace(/\s/g, '');
+  const dayKey = new Date().toISOString().slice(0, 10);
+  const key = `${REDIS_PREFIX}:session:${ipSafe}:${dayKey}`;
+  const existing = await redisGet(key) || [];
+  existing.push({ tool, timestamp: new Date().toISOString() });
+  await redisSet(key, existing);
+  await redisExpire(key, 86400);
+}
+
 async function redisKeys(pattern) {
   try {
     const res = await fetch(
@@ -211,6 +230,15 @@ async function validateVIES(countryCode, vatNumber) {
   });
 }
 
+async function hmrcFetchWithRetry(url, options, maxRetries = 3) {
+  for (let attempt = 1; attempt <= maxRetries; attempt++) {
+    const response = await fetch(url, options);
+    if (response.status !== 429) return response;
+    if (attempt === maxRetries) return response;
+    await new Promise(resolve => setTimeout(resolve, attempt * 1000));
+  }
+}
+
 function getFraudPreventionHeaders() {
   return {
     'Gov-Client-Connection-Method': 'BATCH_PROCESS_DIRECT',
@@ -223,7 +251,7 @@ function getFraudPreventionHeaders() {
     'Gov-Client-User-IDs': 'os=railway-service',
     'Gov-Vendor-License-IDs': 'vat-validator-mcp=not-applicable',
     'Gov-Vendor-Product-Name': 'VAT%20Validator%20MCP',
-    'Gov-Vendor-Version': 'vat-validator-mcp=2.0.2'
+    'Gov-Vendor-Version': 'vat-validator-mcp=2.0.3'
   };
 }
 
@@ -245,32 +273,23 @@ async function getHMRCToken() {
 
   const body = `client_secret=${encodeURIComponent(clientSecret)}&client_id=${encodeURIComponent(clientId)}&grant_type=client_credentials&scope=read%3Avat`;
 
-  return new Promise((resolve) => {
-    const req = https.request({
-      hostname,
-      path: '/oauth/token',
+  try {
+    const response = await hmrcFetchWithRetry(`https://${hostname}/oauth/token`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/x-www-form-urlencoded', 'Content-Length': Buffer.byteLength(body), ...getFraudPreventionHeaders() }
-    }, res => {
-      let d = ''; res.on('data', c => d += c);
-      res.on('end', () => {
-        try {
-          const json = JSON.parse(d);
-          if (json.access_token) {
-            hmrcToken = json.access_token;
-            hmrcTokenExpiry = now + (json.expires_in || 14400) * 1000;
-            resolve(hmrcToken);
-          } else {
-            resolve(null);
-          }
-        } catch(e) { resolve(null); }
-      });
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded', ...getFraudPreventionHeaders() },
+      body,
+      signal: AbortSignal.timeout(8000)
     });
-    req.on('error', () => resolve(null));
-    req.setTimeout(8000, () => { req.destroy(); resolve(null); });
-    req.write(body);
-    req.end();
-  });
+    const json = await response.json();
+    if (json.access_token) {
+      hmrcToken = json.access_token;
+      hmrcTokenExpiry = now + (json.expires_in || 14400) * 1000;
+      return hmrcToken;
+    }
+    return null;
+  } catch(e) {
+    return null;
+  }
 }
 
 async function validateHMRC(vatNumber) {
@@ -281,23 +300,18 @@ async function validateHMRC(vatNumber) {
   const sandbox = process.env.HMRC_SANDBOX === 'true';
   const hostname = sandbox ? 'test-api.service.hmrc.gov.uk' : 'api.service.hmrc.gov.uk';
 
-  return new Promise((resolve) => {
-    const req = https.request({
-      hostname,
-      path: '/organisations/vat/check-vat-number/lookup/' + clean,
+  try {
+    const response = await hmrcFetchWithRetry(`https://${hostname}/organisations/vat/check-vat-number/lookup/${clean}`, {
       method: 'GET',
-      headers: { 'Accept': 'application/vnd.hmrc.2.0+json', 'Authorization': 'Bearer ' + token, ...getFraudPreventionHeaders() }
-    }, res => {
-      let d = ''; res.on('data', c => d += c);
-      res.on('end', () => {
-        try { resolve({ source: 'HMRC', status: res.statusCode, data: JSON.parse(d) }); }
-        catch(e) { resolve({ source: 'HMRC', error: 'Parse error' }); }
-      });
+      headers: { 'Accept': 'application/vnd.hmrc.2.0+json', 'Authorization': 'Bearer ' + token, ...getFraudPreventionHeaders() },
+      signal: AbortSignal.timeout(8000)
     });
-    req.on('error', e => resolve({ source: 'HMRC', error: e.message }));
-    req.setTimeout(8000, () => { req.destroy(); resolve({ source: 'HMRC', error: 'Timeout' }); });
-    req.end();
-  });
+    const data = await response.json();
+    return { source: 'HMRC', status: response.status, data };
+  } catch(e) {
+    if (e.name === 'TimeoutError' || e.name === 'AbortError') return { source: 'HMRC', error: 'Timeout' };
+    return { source: 'HMRC', error: e.message };
+  }
 }
 
 async function validateABN(abn) {
@@ -759,6 +773,27 @@ const server = http.createServer(async (req, res) => {
     return;
   }
 
+  if (req.url === '/session-log' && req.method === 'GET') {
+    if (req.headers['x-stats-key'] !== STATS_KEY) { res.writeHead(401, cors); res.end(JSON.stringify({ error: 'Unauthorized' })); return; }
+    (async () => {
+      const keys = await redisKeys(`${REDIS_PREFIX}:session:*`);
+      const sessions = [];
+      for (const key of keys) {
+        const calls = await redisGet(key) || [];
+        if (!calls.length) continue;
+        const withoutPrefix = key.slice(`${REDIS_PREFIX}:session:`.length);
+        const dateIdx = withoutPrefix.lastIndexOf(':');
+        const ipPart = withoutPrefix.slice(0, dateIdx);
+        const date = withoutPrefix.slice(dateIdx + 1);
+        sessions.push({ ip: ipPart.slice(0, 8), date, calls, first_call: calls[0]?.timestamp || '', last_call: calls[calls.length - 1]?.timestamp || '' });
+      }
+      sessions.sort((a, b) => new Date(b.first_call) - new Date(a.first_call));
+      res.writeHead(200, { ...cors, 'Content-Type': 'application/json' });
+      res.end(JSON.stringify(sessions));
+    })();
+    return;
+  }
+
   if (req.url === '/trial-extension' && req.method === 'POST') {
     let body = ''; req.on('data', c => body += c);
     req.on('end', async () => {
@@ -850,6 +885,7 @@ const server = http.createServer(async (req, res) => {
             if (usageLog.length > 1000) usageLog.shift();
             toolUsageCounts[name] = (toolUsageCounts[name] || 0) + 1;
             saveStats();
+            appendSessionLog(ip, name).catch(() => {});
             const result = await executeTool(name, args || {});
             if (access.plan === 'metered' && access.stripeCustomerId) {
               reportMeteredUsage(access.stripeCustomerId, 'vat_query').catch(() => {});
@@ -898,6 +934,7 @@ const server = http.createServer(async (req, res) => {
           if (usageLog.length > 1000) usageLog.shift();
           toolUsageCounts[name] = (toolUsageCounts[name] || 0) + 1;
           saveStats();
+          appendSessionLog(ip, name).catch(() => {});
           const result = await executeTool(name, toolArgs || {});
           if (req._accessWarning) result._notice = req._accessWarning;