WebVector 0.3.0

WebVector 0.3.0

package	install
webvector	npm i webvector
webvector-mcp	claude mcp add webvector -- npx -y webvector-mcp
webvector-cli	npx -y webvector-cli search "…"

New: the markets module — news, SEC filings, an event calendar, crowd sentiment and a market pulse for trading and research agents, built only from free, keyless sources that were probed and classified (see docs/MARKETS.md and the research notes). Nothing in the research pipeline changed; everything here is additive and opt-in.

npx -y webvector-mcp --tools research,fetch,markets   # five extra tools

const news = await wv.markets.news({ symbols: ['NVDA'], windowMs: 12 * 3_600_000 });

tool / call	what you get
webvector_news · wv.markets.news()	headlines per ticker (or a market briefing) from Yahoo, Seeking Alpha, Bing, CNBC, MarketWatch, Benzinga, GlobeNewswire, PR Newswire and the Fed — relevance-filtered, deduped across sources with a spread count, event-tagged (earnings, guidance, M&A, FDA, analyst, insider, offering, legal, macro…), newest first; read: N attaches article bodies through the normal robots-respecting fetch
webvector_filings · wv.markets.filings() / searchFilings()	SEC EDGAR filing history and full-text search: decoded 8-K item codes, Form 4, S-3/424B, 13D/G, and the primary-document URL on sec.gov/Archives for every hit
webvector_calendar · wv.markets.calendar()	scheduled macro prints with ET times, impact and forecast/previous/actual, recent Fed press releases, and earnings dates
webvector_sentiment · wv.markets.sentiment()	StockTwits bull/bear skew, posting velocity and top posts, plus FINRA daily short-sale volume share
webvector_pulse · wv.markets.pulse()	Cboe VIX and FRED yields / fed funds, with index and futures quotes when the gray Yahoo source is enabled

Source policy, stated up front. Every source in markets/sources.ts is classified open (documented API/feed, robots allows it), feed (syndication endpoint on a host whose robots targets page crawlers) or gray (keyless, but robots/terms/UA requirements argue against automation). Gray sources — Google News RSS, Nasdaq, the Yahoo chart API — are off unless you set markets.graySources. Reuters, Bloomberg, Dow Jones pages, FT, Seeking Alpha articles, TradingView, Stooq, CME and Reddit JSON are deliberately absent; a headline from a feed may be shown, but the page behind it is never scraped.

How it behaves. Requests reuse the existing polite Fetcher (SSRF guard, per-host pacing, bot-wall detection, size caps) plus a TTL cache with ETag/Last-Modified revalidation in the page-cache SQLite. One deadline per call (markets.deadlineMs, default 12 s) with every source's outcome reported (ok / cached / stale / failed / timeout, and n/m failed for partial failures); a slow or broken source never fails the call. SEC requests declare WebVector/<ver> (<contact>) — set WEBVECTOR_CONTACT_EMAIL, which the fair-access policy requires.

Core additions: markets config section (graySources, feedRobots, disableSources, contact, deadlineMs; WEBVECTOR_MARKETS_* env), the webvector/markets subpath export, FetchInit.robots: 'skip' for syndication endpoints (default respect), Fetcher.setHostMinInterval(host, ms), and Bing News apiclick redirector unwrapping in cleanUrl.

Security: the ToolGuard domain policy now also applies to the unwrapped target of redirect-wrapper URLs (google.com/url, bing.com/news/apiclick, …), closing an allow/blocklist bypass for webvector_fetch. Markets tool output is capped to --max-tokens, every returned string is sanitised and length-capped, and body reads honour --allowed-domains / --blocked-domains. See the new row in SECURITY.md.

No new dependencies; the default tools/list is unchanged unless you opt in with --tools markets.