Skip to content

web-researcher-mcp v1.3.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 May 05:26
v1.3.0
17cec11

Highlights

Patent search now actually works. Four dedicated patent APIs (USPTO, EPO OPS, The Lens, SearchAPI) replace the broken web-discovery fallback. The tool automatically routes to the right provider based on patent office region — no config changes needed from users.

Zero audit event loss under load. The audit logger now spills to a swap file when the in-memory buffer is full, instead of silently dropping events. Events are replayed in order once pressure subsides.

Security hardened. JWT nbf claim validation, constant-time admin key comparison, and honest documentation of what's implemented vs. planned.

New Features

Patent-Specific Providers

  • USPTO — US patent search via official API (USPTO_API_KEY)
  • EPO OPS — Worldwide patent search with OAuth2 (EPO_OPS_CONSUMER_KEY, EPO_OPS_CONSUMER_SECRET)
  • The Lens — Worldwide patents + scholarly links (LENS_API_TOKEN)
  • SearchAPI — Fixed HTML tag stripping and patent number extraction from response paths

Each provider gets an independent circuit breaker and declares its regional coverage. The patent_search tool filters providers by patent_office before calling them — no wasted API calls.

Domain Provider Framework

Generic PatentProvider interface with ProviderMeta (regions, capabilities, rate class). Adding a new patent provider later is one file implementing one interface — no router or tool changes needed.

Audit Log Resilience

When the 1000-event channel buffer is full:

  • Before: Events silently dropped
  • Now: Events spill to .audit-swap.jsonl on disk (up to 50MB configurable cap), replayed in order when pressure subsides

Exported Spilled and Dropped atomic counters for observability.

Security

  • JWT nbf validation — Tokens with a future nbf (not-before) claim are now correctly rejected
  • Constant-time admin key comparison — Prevents timing attacks on the X-Admin-Key header via crypto/subtle.ConstantTimeCompare

Documentation

Complete accuracy audit across all docs:

  • Removed false claims (Redis support, LRU eviction, "HTTP/SSE" transport, browser pool sizing)
  • Added patent provider configuration to DEPLOYMENT.md
  • Rewrote horizontal scaling section honestly (documents per-instance limitations)
  • Fixed cache location docs (OS cache dir, not ./cache)
  • Corrected GDPR compliance table (endpoints marked as not yet implemented)
  • Updated all SEARCH_ROUTING examples to include patents operation type

Breaking Changes

None. The patent_search tool interface is unchanged — all improvements are internal routing.

Configuration (new optional env vars)

Variable Description
USPTO_API_KEY US patents (data.uspto.gov)
EPO_OPS_CONSUMER_KEY Worldwide patents (developers.epo.org)
EPO_OPS_CONSUMER_SECRET EPO OAuth2 secret
LENS_API_TOKEN Worldwide + scholarly (lens.org)

All optional. Without them, patent_search falls back to web search discovery (same as before).

Housekeeping

  • Removed project-level .mcp.json (global config is authoritative)
  • Made Google keys optional in smithery.yaml
  • Bumped server.json to v1.3.0
  • Added .gitignore entries for generated demo assets

Docker Images

# GitHub Container Registry
docker pull ghcr.io/zoharbabin/web-researcher-mcp:1.3.0

# Docker Hub
docker pull docker.io/zoharbabin/web-researcher-mcp:1.3.0

Install

go install github.com/zoharbabin/web-researcher-mcp/cmd/web-researcher-mcp@v1.3.0

Verify

sha256sum -c checksums.txt

Full Changelog: v1.2.3...v1.3.0

Assets 21
Loading