rm-rf-prod · rm-rf-prod · May 30, 2026 · May 30, 2026 · May 30, 2026 · May 30, 2026
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -33,7 +33,7 @@ jobs:
           registry-url: "https://registry.npmjs.org"
 
       - name: Upgrade npm to latest (trusted publishing requires 11.5.1+)
-        run: npm install -g npm@latest
+        run: npm install -g "npm@11"
 
       - name: Verify versions match
         run: |
@@ -132,7 +132,11 @@ jobs:
 
       - name: Install mcp-publisher
         run: |
-          curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_linux_amd64.tar.gz" | tar xz mcp-publisher
+          # Download to a file instead of piping curl into tar, so a sha256
+          # verification can slot in once modelcontextprotocol/registry publishes
+          # a checksums file (BSC-003). -f fails the job on an HTTP error.
+          curl -fsSL "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_linux_amd64.tar.gz" -o mcp-publisher.tar.gz
+          tar xzf mcp-publisher.tar.gz mcp-publisher
           chmod +x mcp-publisher
           sudo mv mcp-publisher /usr/local/bin/
 

diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
@@ -9,15 +9,19 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   audit:
     name: Dependency audit and CI
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version: '24'
+          node-version-file: ".node-version"
           cache: 'npm'
       - name: Install dependencies
         run: npm ci

diff --git a/.github/workflows/url-health.yml b/.github/workflows/url-health.yml
@@ -0,0 +1,23 @@
+name: URL Health
+
+on:
+  schedule:
+    # Mondays 06:00 UTC — catch docs restructures before users hit dead links
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  check-urls:
+    name: Check curated documentation URLs
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version-file: ".node-version"
+      - name: Check curated URLs
+        run: node scripts/check-urls.mjs
diff --git a/.gitignore b/.gitignore
@@ -41,3 +41,10 @@ CLAUDE*.md
 *.claude*
 .claude/*.local.md
 .claude/*.local.json
+
+# local-only draft artifacts (never publish)
+docs/npm-gdpr-request-draft.md
+docs/*.png
+
+# Internal docs — local-only (purged from public history 2026-05-31)
+docs/
diff --git a/.node-version b/.node-version
@@ -1 +1 @@
-22.11.0
+24.15.0
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,85 @@
 # Changelog
 
+## [7.4.0] — 2026-07-15
+
+- fix: adversarially verified hardening across all 14 tools
+- docs: expand 7.3.0 changelog entry
+
+---
+
+## [7.3.0] — 2026-07-10
+
+- feat: gt_compat redesigned on MDN machine-readable data (index.json + BCD API) — exact per-browser version_added incl. Node/Deno/Bun, Baseline status
+- feat: gt_snippets multi-hop traversal (index links, child pages, sitemap) — frameworks whose llms.txt is a link index now yield snippets
+- feat: nested llms.txt pointer following, relative-link index support, path-scoped sitemap discovery, legacy-version-tree ranking penalty
+- feat: gt_search authority-ranked sources (official docs above content farms) + full evidence coverage per source on specific queries
+- feat: gt_migration web-search escalation for upgrade guides at unguessable URLs; gt_examples official-docs fallback (GitHub code search is auth-only)
+- fix: gt_get_docs index-content escalation + latency guard; raceUrls ranks topic-first; dispatch routes natural browser-support phrasing to gt_compat
+
+---
+
+## [7.2.0] — 2026-07-10
+
+- feat: multi-source retrieval, Jina 404 gate, prose-only evidence
+- feat: topic-synonym discovery (migration/upgrade, performance/optimization), index-first deep-fetch, link-list guard
+- feat: weekly URL-health CI workflow; 73 rotted curated URLs replaced with live-verified pages
+- fix: query-meta words no longer count as topic evidence; shared web-search helper in gt_search
+- chore: undici 8.7.0 + hono 4.12.28 (clears 2 high-severity production advisories)
+
+---
+
+## [7.1.0] — 2026-06-12
+
+- feat: evidence engine — verified topic coverage, no generic answers
+
+---
+
+## [7.0.4] — 2026-06-03
+
+- fix: eliminate documentation noise across all MCP tools
+- chore: sync llms.txt to 7.0.3 and auto-stage it on version bump
+
+---
+
+## [7.0.3] — 2026-06-02
+
+- docs: sync generated stats (1198 tests, 14 tools)
+- test: add 78 regression tests for the audit-hardening fixes
+- ci: pin actions, gate release scripts, automate stat writeback
+- refactor: extract server instructions to a testable module
+- perf: cut tokenization cost and fetch fan-out
+- fix: correct resolver, router, scanner and tool defects from audit
+- fix: harden security and reliability from deep audit (wave 2)
+- chore: sync llms.txt stats for 7.0.2
+
+---
+
+## [7.0.2] — 2026-06-02
+
+- fix: backfill registry languages, cover gt_dispatch, sync docs
+- fix: correct resolver, migration band and compat cache defects
+- fix: harden security, reliability and observability from deep audit
+- chore: gitignore docs/ — internal planning docs, local-only
+- fix(scripts): stop version-sweep from rewriting .github action versions
+
+---
+
+## [7.0.1] — 2026-05-30
+
+- chore: ignore local draft artifacts
+- docs: record implementation status (done / skipped-as-wrong / deferred)
+- fix(resolve): key llms.txt probe cache on full path, not origin
+- perf: snippet IDF ranking, cache + lockfile + telemetry cleanup
+- build: upgrade to TypeScript 6.0 + NodeNext, align Node 24
+- fix: reliability, security and protocol hardening
+- fix(audit): use charOffset for repeated-line context windows
+- fix: version-aware migration/changelog pipeline
+- docs: add enterprise upgrade plan
+- chore: shorten server.json description (MCP registry 100-char limit)
+- chore: stats — README library count 444 -> 445
+
+---
+
 ## [7.0.0] — 2026-05-28
 
 Adds a dispatch tool, hardens the security model, and instruments every tool with telemetry.

diff --git a/README.md b/README.md
@@ -18,7 +18,7 @@
   <a href="./LICENSE"><img src="https://img.shields.io/badge/license-ELv2-orange" alt="Elastic License 2.0" /></a>
   <img src="https://img.shields.io/badge/libraries-445%2B-teal" alt="445+ curated libraries" />
   <img src="https://img.shields.io/badge/audit_patterns-107%2B-red" alt="107+ audit patterns" />
-  <img src="https://img.shields.io/badge/tests-1083-brightgreen" alt="1083 tests" />
+  <img src="https://img.shields.io/badge/tests-1358-brightgreen" alt="1358 tests" />
   <img src="https://img.shields.io/badge/tools-14-blue" alt="14 tools" />
   <img src="https://img.shields.io/badge/node-%3E%3D24-green" alt="Node 24+" />
 </p>
@@ -82,7 +82,7 @@ claude mcp add gt -e GT_GITHUB_TOKEN=ghp_yourtoken -- npx -y @groundtruth-mcp/gt
 
 ## What it does
 
-Twelve tools. Each does one thing.
+Fourteen tools. Each does one thing.
 
 | Tool | What it does |
 |---|---|
@@ -98,6 +98,8 @@ Twelve tools. Each does one thing.
 | `gt_examples` | Real-world code examples from GitHub |
 | `gt_migration` | Migration guides and breaking changes |
 | `gt_batch_resolve` | Resolve up to 20 libraries in one call |
+| `gt_snippets` | Pre-indexed, ranked code snippets per library and version, cached on disk |
+| `gt_dispatch` | Routes a plain-text query ("use gt mcp") to the right tool with args |
 
 ---
 
@@ -261,7 +263,7 @@ Context7 is solid. Here's why I reach for this instead.
 | Rate limits | None | 1,000 free/month ($10/seat for 5,000) |
 | Transport | Stdio + Streamable HTTP | Stdio + Streamable HTTP |
 | Source priority | llms.txt -> Jina -> GitHub -> npm/PyPI | Vector DB with proprietary crawl pipeline |
-| Tools | 13 specialized tools | 2 tools |
+| Tools | 14 specialized tools | 2 tools |
 | Code audit | 107+ patterns, 18 categories, file:line, live fixes | No |
 | Freeform search | OWASP, MDN, AI docs, Google APIs, web standards | Library docs only |
 | Changelog, compat, compare, examples, migration | Yes | No |

diff --git a/llms.txt b/llms.txt
@@ -4,7 +4,7 @@
 
 GroundTruth is a Model Context Protocol (MCP) server that fetches documentation from official sources at query time. It tries llms.txt first, then Jina Reader for JS-rendered pages, then GitHub. It covers 445+ curated libraries and falls back to npm, PyPI, crates.io, and pkg.go.dev for any public package. Unlike cloud-hosted documentation tools, GroundTruth runs on your machine. No rate limits. No API keys.
 
-v7.0.0 adds a dispatch tool for plain-text intent routing, per-tool telemetry, an SSRF-hardened multi-source fetcher, atomic disk cache writes, and Unicode-homoglyph injection defenses.
+v7.4.0 adds a dispatch tool for plain-text intent routing, per-tool telemetry, an SSRF-hardened multi-source fetcher, atomic disk cache writes, and Unicode-homoglyph injection defenses.
 
 ## Install