vat-validator-mcp 2.0.23 → 2.0.25

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "vat-validator-mcp",
   "mcpName": "io.github.OjasKord/vat-validator-mcp",
-  "version": "2.0.23",
+  "version": "2.0.25",
   "description": "VAT number validator for AI agents. EU VIES, UK HMRC, AU ABR. Fraud risk scoring and name cross-check. PROCEED/HOLD verdict before any invoice payment.",
   "main": "src/server.js",
   "scripts": {

package/server.json

@@ -1,26 +1,48 @@
-{
-  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
-  "name": "io.github.OjasKord/vat-validator-mcp",
-  "title": "VAT Validator MCP",
-  "description": "Validate EU, UK, AU VAT numbers for AI agents. EU ViDA e-invoicing compliance.",
-  "version": "2.0.4",
-  "websiteUrl": "https://kordagencies.com",
-  "repository": {
-    "url": "https://github.com/OjasKord/vat-validator-mcp",
-    "source": "github"
-  },
-  "packages": [
-    {
-      "registryType": "npm",
-      "identifier": "vat-validator-mcp",
-      "version": "2.0.4",
-      "transport": { "type": "stdio" },
-      "environmentVariables": [
-        { "name": "ANTHROPIC_API_KEY", "description": "Anthropic API key for AI-powered fraud risk analysis", "isRequired": true, "isSecret": true },
-        { "name": "HMRC_CLIENT_ID", "description": "HMRC Developer Hub client ID for UK VAT validation", "isRequired": false, "isSecret": true },
-        { "name": "HMRC_CLIENT_SECRET", "description": "HMRC Developer Hub client secret for UK VAT validation", "isRequired": false, "isSecret": true }
-      ]
-    }
-  ],
-  "remotes": [{ "type": "streamable-http", "url": "https://vat-validator-mcp-production.up.railway.app" }]
-}
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
+  "name": "io.github.OjasKord/vat-validator-mcp",
+  "title": "VAT Validator MCP",
+  "description": "Validate EU, UK, AU VAT numbers for AI agents. EU ViDA e-invoicing compliance.",
+  "version": "2.0.23",
+  "websiteUrl": "https://kordagencies.com",
+  "repository": {
+    "url": "https://github.com/OjasKord/vat-validator-mcp",
+    "source": "github"
+  },
+  "packages": [
+    {
+      "registryType": "npm",
+      "identifier": "vat-validator-mcp",
+      "version": "2.0.23",
+      "transport": {
+        "type": "stdio"
+      },
+      "environmentVariables": [
+        {
+          "name": "ANTHROPIC_API_KEY",
+          "description": "Anthropic API key for AI-powered fraud risk analysis",
+          "isRequired": true,
+          "isSecret": true
+        },
+        {
+          "name": "HMRC_CLIENT_ID",
+          "description": "HMRC Developer Hub client ID for UK VAT validation",
+          "isRequired": false,
+          "isSecret": true
+        },
+        {
+          "name": "HMRC_CLIENT_SECRET",
+          "description": "HMRC Developer Hub client secret for UK VAT validation",
+          "isRequired": false,
+          "isSecret": true
+        }
+      ]
+    }
+  ],
+  "remotes": [
+    {
+      "type": "streamable-http",
+      "url": "https://vat-validator-mcp-production.up.railway.app"
+    }
+  ]
+}

package/src/server.js

@@ -7,7 +7,7 @@ const Stripe = require('stripe');
 const stripe = Stripe(process.env.STRIPE_SECRET_KEY);
 
 const PERSIST_FILE = '/tmp/vat_stats.json';
-const VERSION = '2.0.23';
+const VERSION = '2.0.25';
 
 // Persistent device ID for HMRC fraud prevention headers (BATCH_PROCESS_DIRECT)
 const DEVICE_ID_FILE = path.join(__dirname, '..', 'device-id.txt');
@@ -28,6 +28,7 @@ const FREE_TIER_LIMIT = 50;
 const METERED_SUBSCRIBE_URL = 'https://vat-validator-mcp-production.up.railway.app/subscribe';
 const BUNDLE_500_URL = 'https://buy.stripe.com/28EeVceUB06N1ty3teebu0l';
 const BUNDLE_2000_URL = 'https://buy.stripe.com/00w14m7s96vb1ty5Bmebu0m';
+const ALLOWED_PAYMENT_LINK_IDS = ['plink_1TQz5UD6WvRe6sn3I1GPShmC', 'plink_1TQz6rD6WvRe6sn3mqxD0Gy8'];
 
 const freeTierUsage = new Map();
 const usageLog = [];
@@ -226,8 +227,11 @@ async function sendEmail(to, subject, html) {
     const req = https.request({
       hostname: 'api.resend.com', path: '/emails', method: 'POST',
       headers: { 'Authorization': 'Bearer ' + RESEND_API_KEY, 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) }
-    }, res => { let d = ''; res.on('data', c => d += c); res.on('end', () => resolve({ status: res.statusCode, body: d })); });
-    req.on('error', e => resolve({ error: e.message }));
+    }, res => { let d = ''; res.on('data', c => d += c); res.on('end', () => {
+      if (res.statusCode < 200 || res.statusCode >= 300) console.error('[Resend] Email failed: HTTP ' + res.statusCode + ' ' + d);
+      resolve({ status: res.statusCode, body: d });
+    }); });
+    req.on('error', e => { console.error('[Resend] Email network error:', e.message); resolve({ error: e.message }); });
     req.write(body); req.end();
   });
 }
@@ -713,6 +717,11 @@ async function handleStripeWebhook(body, sig) {
     const event = JSON.parse(body);
     if (event.type === 'checkout.session.completed') {
       const session = event.data.object;
+      const paymentLinkId = session.payment_link;
+      if (paymentLinkId && !ALLOWED_PAYMENT_LINK_IDS.includes(paymentLinkId)) {
+        console.log('[vat] Webhook received but payment link ' + paymentLinkId + ' not for this server — ignoring.');
+        return { received: true, ignored: true };
+      }
       const plan = getPlanFromProduct(session.metadata?.product_name);
       const apiKey = generateApiKey();
       const limit = plan === 'metered' ? null : plan === 'bundle_2000' ? 2000 : 500;
@@ -727,7 +736,11 @@ async function handleStripeWebhook(body, sig) {
       };
       apiKeys.set(apiKey, record);
       await saveKeyToRedis(apiKey, record, REDIS_PREFIX);
-      await sendApiKeyEmail(record.email, apiKey, plan);
+      if (record.email && record.email !== 'unknown') {
+        await sendApiKeyEmail(record.email, apiKey, plan);
+      } else {
+        console.error('[vat] No customer email in webhook — skipping email send');
+      }
       console.log('[vat] API key created for ' + record.email + ' (' + plan + ')');
       return { success: true, email: record.email, plan };
     }