aivis 1.5.3 — registry description under 100 chars

Registry description fixed to match search terms and fit the 100-char limit.

aivis 1.5.2 — registry description fix

Registry description rewritten to match what people search. The previous description used insider jargon that didn't contain the word 'visibility' — the primary search term for this category on the MCP registry.

aivis 1.5.1 — scope the measurement check to product pages

Measurement finding is a note rather than a warning on pages with no product, so a homepage is no longer told its biggest gap is shipping weights.

Guarded so stores with JavaScript-injected JSON-LD still get the warning — the first version of this fix suppressed it for exactly those stores. Pinned in research/test_api.py.

aivis 1.5.0 — search-safe training opt-out

The ecosystem's most-used AI blocklist (~4k stars) disallows all 166 known AI user-agents — including all seven search crawlers. If you wanted "don't train on me", you also got "don't recommend me, and drop me from Siri, Spotlight and Alexa".

python3 aivis.py --training-optout >> robots.txt

Blocks all 8 training crawlers, leaves all 7 search crawlers allowed. Every token sourced to vendor documentation. CI audits the generated output and fails if it ever blocks a search crawler.

aivis 1.4.0 — library API

aivis is now importable, not just runnable.

from aivis import classify_crawler, audit_robots
classify_crawler("GPTBot")["blocking_effect"]  # 'opts_out_of_training_only'
audit_robots(txt)["visible_to_ai_search"]

Returns None for unknown tokens rather than guessing. Applies real robots.txt group precedence, and won't flag a stock Shopify file's ~45 default rules as a problem. Every classification is sourced to vendor docs and covered by a contract test in CI. Zero dependencies.

aivis 1.3.0 — benchmarks

Answers "compared to what?". Every count is now placed against our published 70-brand survey: median, top 25%, top 10%.

Reports plain bands rather than percentiles, because "at or above the 25th percentile" was technically true for a store with zero measurements — flattering and wrong. Zero now reads "bottom 25% — nothing at all here".

Benchmarks are embedded and dated, so the tool works offline and still means something in three years.

aivis 1.2.1 — bounded reads

Security fix, second of two. Both fetch paths did an unbounded read. The gzip path was worse: decompression was unbounded, so a few hundred KB on the wire could become gigabytes in memory — a decompression bomb.

Demonstrated: a 204 KB payload expanding to 209 MB now caps at 8 MB. Covered in CI by a test that builds a real gzip bomb.

With 1.2.0's SSRF guard, both vulnerabilities were found by reading what competitors describe themselves as doing and checking whether it was true here.

aivis 1.2.0 — SSRF guard

Security fix. aivis fetched user-supplied hostnames without validation. Because it also runs as an MCP server, a model fed untrusted text could induce it to fetch internal addresses — cloud metadata (169.254.169.254), loopback, or private ranges — with the agent as confused deputy. Verified the fetch was actually attempted before the fix.

Now refuses any non-public http(s) target, resolving the hostname rather than pattern-matching it, and re-validating every redirect hop. Fails closed. Covered by research/test_ssrf.py in CI.

Found by reading what a competitor described itself as doing ("SSRF-guarded") and checking whether we did.

aivis 1.1.2 — container image

Adds a multi-arch container (ghcr.io/krisdiallo/aivis) alongside the mcpb bundle, so MCP clients that consume OCI can install from the registry listing.

Fixes an image-verification gate that rejected a working build by grepping for "name":"aivis" when the server emits "name": "aivis". It now parses the JSON-RPC instead.

Also multi-arch (amd64 + arm64) — the first image was amd64-only and ran under emulation on Apple Silicon.

aivis 1.1.1 — fix stale-build packaging bug

Fixes a real install bug. Committed build/ artifacts caused setuptools to package stale 1.0.1 code, so every uvx install got the old version with only one tool. The .mcpb bundle was unaffected.

If you installed via uvx before this, re-run with --refresh.

Same three checks plus build_recommendation_test. Open source, read-only, no account.