[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_186":187,"_188":189},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_139":-5,"_20":140,"_22":141,"_142":143,"_144":145,"_25":146,"_24":-5,"_147":148,"_149":150,"_151":50,"_152":153,"_154":70,"_155":-5,"_156":-5,"_157":158},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":28,"_29":-5,"_30":31,"_32":33,"_34":-5},"handle","sebas1","name","rumbo-guardian-openai","branchName","main","version","path","","project",{"_35":95,"_13":14,"_37":96,"_48":-5,"_97":50,"_51":52,"_98":52,"_99":100,"_101":-5,"_102":103,"_104":63,"_105":50,"_106":-5,"_107":-5,"_108":33,"_54":55,"_109":-5,"_110":-5,"_111":-5,"_112":-5,"_113":114,"_115":114,"_116":117,"_118":117,"_119":117,"_120":114,"_121":114,"_122":123,"_124":125,"_126":127,"_49":50},"tree",[86,87],"file","contents",[58,59],"upstream",{"_35":36,"_37":38,"_39":40,"_13":16,"_41":42,"_17":43,"_44":-5,"_45":-5,"_46":47,"_48":-5,"_49":50,"_51":52,"_53":12,"_54":55,"_56":57},"pull","ahead",2,"behind",0,"envVars","id","1d154af3-3ff9-4df6-84fb-a1cc504e90b8","createdAt",["D",1789016936520],"updatedAt",["D",1789027178708],"projectId","08fe8f04-1253-429f-aa20-389e243a83e4",8,"forkedBranchId","forkedBranchVersion","lockfileKey","1789027178810-esm.town_v_sebas1_rumbo-guardian-mcp@8-main","deletedAt","isOwned",false,"privacy","public","userHandle","orgId","01a04116-f28c-754c-9173-77bf5814fcd6","projectName","rumbo-guardian-mcp",{"_35":79,"_13":80,"_62":81,"_64":-5,"_65":66,"_67":82,"_69":70,"_37":83,"_17":33,"_72":24,"_74":84,"_76":50,"_77":-5,"_18":85},{"_35":60,"_13":61,"_62":63,"_64":-5,"_65":66,"_67":68,"_69":70,"_37":71,"_17":31,"_72":73,"_74":75,"_76":50,"_77":14,"_18":78},"7377cc5b-9b1c-47f6-8b87-0f9e8f0447a5","main.ts","fileId","01a08a78-96e3-7515-851a-2056da8dec97","parentId","branchId","a41c2f5b-9cb0-404d-8cd1-2470ed7060ca","branchVersion",3,"latest",true,["D",1789030562453],"fileType","http","content","import { createMcpHandler, McpServer } from \"npm:@modelcontextprotocol/server@2\";\nimport * as z from \"npm:zod@4/v4\";\n\nconst SOURCE_SHA = \"89cbd20685604a01be8b17a09584a1e7364b4fb0\";\nconst SIGNALS: Record = {\n active_content_scheme: \"The URL uses an active-content scheme such as javascript:, data:, or vbscript: and should not be treated as a normal HTTPS navigation.\",\n credentials: \"The supplied text contains credential, password, verification-code, or account-access language.\",\n urgency: \"The supplied text contains urgency or pressure language that can increase social-engineering risk.\",\n external_redirect_target: \"A recognized redirect parameter points to a different domain; Guardian analyzes the supplied destination locally without fetching it.\",\n embedded_credentials: \"The URL embeds user-information before the host, which can obscure the actual destination.\",\n};\n\nfunction riskMeta(score: number) {\n if (score >= 60) return { level: \"danger\", label: \"Alto\", verdict: \"Se detectaron múltiples señales que requieren intervención.\", guide: \"No continúes con acciones sensibles hasta verificar el origen por un canal independiente.\" };\n if (score >= 30) return { level: \"caution\", label: \"Medio\", verdict: \"Se detectaron señales que justifican una verificación adicional.\", guide: \"Validá identidad, dominio y contexto antes de compartir datos o ejecutar acciones.\" };\n return { level: \"safe\", label: \"Bajo\", verdict: \"No se detectaron señales fuertes con las reglas locales actuales.\", guide: \"Mantené la verificación contextual para acciones sensibles.\" };\n}\n\nfunction analyzeUrl(raw: string) {\n const value = raw.trim();\n const reasons: Array<{ points: number; title: string; detail: string; code: string }> = [];\n let score = 0;\n let url: URL;\n try { url = new URL(/^www\\./i.test(value) ? `https://${value}` : value); }\n catch { return { score: 0, level: \"neutral\", label: \"No válida\", domain: \"\", domainStatus: \"neutral\", url: value, reasons: [{ points: 0, title: \"URL no válida\", detail: \"No se pudo interpretar el enlace.\", code: \"invalid_url\" }], redirectTargets: [] }; }\n const host = url.hostname.toLowerCase();\n const tld = host.split(\".\").at(-1) || \"\";\n const add = (points: number, title: string, detail: string, code: string) => { score += points; reasons.push({ points, title, detail, code }); };\n if ([\"javascript:\", \"data:\", \"vbscript:\"].includes(url.protocol)) add(65, \"Esquema de contenido activo\", \"El enlace puede ejecutar o incrustar contenido sin una navegación HTTPS normal.\", \"active_content_scheme\");\n if (url.protocol === \"http:\") add(12, \"Conexión sin HTTPS\", \"La URL usa HTTP sin cifrado.\", \"http\");\n if (/^\\d{1,3}(\\.\\d{1,3}){3}$/.test(host)) add(28, \"Dirección IP directa\", \"Puede ocultar la identidad real del sitio.\", \"ip_host\");\n if (host.includes(\"xn--\")) add(18, \"Dominio codificado\", \"Puede usarse para imitar visualmente otro dominio.\", \"punycode\");\n if (new Set([\"zip\",\"mov\",\"top\",\"xyz\",\"click\",\"loan\",\"work\",\"gq\",\"tk\",\"cf\",\"ml\",\"ga\"]).has(tld)) add(14, \"Extensión de dominio sensible\", \"Requiere verificación adicional.\", \"sensitive_tld\");\n if (new Set([\"bit.ly\",\"tinyurl.com\",\"t.co\",\"is.gd\",\"cutt.ly\",\"rb.gy\",\"rebrand.ly\",\"shorturl.at\"]).has(host)) add(18, \"Enlace acortado\", \"Oculta el destino final antes de abrirlo.\", \"shortener\");\n if (url.username || url.password) add(30, \"Credenciales embebidas\", \"La URL contiene credenciales antes del host.\", \"embedded_credentials\");\n if (/login|verify|account|secure|update|password|payment|wallet|unlock|support/i.test(url.pathname + url.search)) add(12, \"Ruta sensible\", \"Contiene términos asociados con acceso, verificación o pagos.\", \"sensitive_path\");\n score = Math.max(0, Math.min(100, score));\n return { score, ...riskMeta(score), domain: host.replace(/^www\\./, \"\"), domainStatus: \"neutral\", url: value, reasons, redirectTargets: [] };\n}\n\nfunction analyzeText(text: string) {\n const reasons: Array<{ points: number; title: string; detail: string; code: string }> = [];\n let score = 0;\n const add = (points: number, title: string, detail: string, code: string) => { score += points; reasons.push({ points, title, detail, code }); };\n if (/urgente|últim[oa] aviso|suspendid[ao]|bloquead[ao]|ahora mismo|inmediatamente|24 horas|vence hoy/i.test(text)) add(14, \"Urgencia o presión\", \"El mensaje intenta acelerar una decisión.\", \"urgency\");\n if (/contraseña|password|código de verificación|\\botp\\b|inici[áa] sesi[oó]n|verific[aá] tu cuenta|credencial/i.test(text)) add(18, \"Solicitud relacionada con acceso\", \"Menciona credenciales, códigos o verificación.\", \"credentials\");\n if (/transfer|pago|factura|premio|ganaste|cripto|bitcoin|wallet|tarjeta|reembolso|mercado ?pago/i.test(text)) add(12, \"Dinero o medios de pago\", \"Menciona pagos, transferencias, premios o activos.\", \"money\");\n const links = text.match(/\\bhttps?:\\/\\/[^\\s<>\"']+|\\bwww\\.[^\\s<>\"']+/gi) || [];\n const linkResults = [...new Set(links)].map(analyzeUrl);\n for (const item of linkResults) { score += item.score; reasons.push(...item.reasons); }\n score = Math.max(0, Math.min(100, score));\n if (!text.trim()) return { score: 0, level: \"neutral\", label: \"Sin datos\", verdict: \"No hay contenido para analizar.\", guide: \"Ingresá un mensaje o URL.\", reasons: [], links: [], linkResults: [], text, kind: \"message\" };\n return { score, ...riskMeta(score), reasons, links: [...new Set(links)], linkResults, text, kind: \"message\" };\n}\n\nfunction stable(value: unknown): unknown {\n if (Array.isArray(value)) return value.map(stable);\n if (value && typeof value === \"object\") return Object.keys(value as Record).sort().reduce((out, key) => { out[key] = stable((value as Record)[key]); return out; }, {} as Record);\n return value;\n}\nasync function sha256(text: string) { const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(text)); return [...new Uint8Array(digest)].map(b => b.toString(16).padStart(2, \"0\")).join(\"\"); }\nasync function verifyLedger(ledger: { history?: Array> }) {\n const history = ledger?.history;\n if (!Array.isArray(history)) return { valid: false, entries: 0, brokenAt: 1, reason: \"missing_history\" };\n let previous = \"0\".repeat(64);\n for (let i = 0; i < history.length; i++) {\n const entry = history[i];\n const copy = { ...entry }; delete copy.entryHash;\n const expected = await sha256(JSON.stringify(stable(copy)));\n if (entry.sequence !== i + 1 || entry.previousHash !== previous || entry.entryHash !== expected) return { valid: false, entries: history.length, brokenAt: i + 1, rootHash: previous };\n previous = String(entry.entryHash);\n }\n return { valid: true, entries: history.length, brokenAt: null, rootHash: previous };\n}\n\nconst reasonOutput = z.object({\n points: z.number(), title: z.string(), detail: z.string(), code: z.string(),\n});\nconst urlOutput = z.object({\n score: z.number().min(0).max(100),\n level: z.enum([\"safe\", \"caution\", \"danger\", \"neutral\"]),\n label: z.string(), verdict: z.string().optional(), guide: z.string().optional(),\n domain: z.string(), domainStatus: z.enum([\"trusted\", \"blocked\", \"neutral\"]),\n url: z.string(), reasons: z.array(reasonOutput), redirectTargets: z.array(z.unknown()),\n});\nconst textOutput = z.object({\n score: z.number().min(0).max(100),\n level: z.enum([\"safe\", \"caution\", \"danger\", \"neutral\"]),\n label: z.string(), verdict: z.string(), guide: z.string(),\n reasons: z.array(reasonOutput), links: z.array(z.string()),\n linkResults: z.array(urlOutput), text: z.string(), kind: z.string(),\n});\nconst ledgerOutput = z.object({\n valid: z.boolean(), entries: z.number().int(), brokenAt: z.number().int().nullable(),\n reason: z.string().optional(), rootHash: z.string().optional(),\n});\nconst signalOutput = z.object({ code: z.string(), explanation: z.string(), supported: z.boolean() });\n\nconst handler = createMcpHandler(() => {\n const server = new McpServer({ name: \"rumbo-guardian\", version: \"0.1.3-valtown-staging\" });\n const annotations = { readOnlyHint: true, destructiveHint: false, openWorldHint: false };\n const securitySchemes = [{ type: \"noauth\" as const }];\n server.registerTool(\"analyze_url\", { description: \"Analyzes one user-supplied URL locally for defensive phishing and navigation indicators without opening or fetching the destination.\", inputSchema: z.object({ url: z.string().min(1).max(16384) }), outputSchema: urlOutput, annotations, securitySchemes }, ({ url }) => { const v = analyzeUrl(url); return { content: [{ type: \"text\", text: JSON.stringify(v) }], structuredContent: v }; });\n server.registerTool(\"analyze_text\", { description: \"Analyzes user-supplied text for defensive phishing, fraud, credential-request, and urgency indicators without external actions.\", inputSchema: z.object({ text: z.string().min(1).max(16384) }), outputSchema: textOutput, annotations, securitySchemes }, ({ text }) => { const v = analyzeText(text); return { content: [{ type: \"text\", text: JSON.stringify(v) }], structuredContent: v }; });\n server.registerTool(\"verify_ledger\", { description: \"Verifies a supplied Evidence Ledger hash chain locally without modifying it.\", inputSchema: z.object({ ledger: z.object({ history: z.array(z.record(z.string(), z.unknown())).optional() }).passthrough() }), outputSchema: ledgerOutput, annotations, securitySchemes }, async ({ ledger }) => { const v = await verifyLedger(ledger); return { content: [{ type: \"text\", text: JSON.stringify(v) }], structuredContent: v }; });\n server.registerTool(\"explain_signal\", { description: \"Explains one Guardian signal code and its limitation without making an accusation or taking an external action.\", inputSchema: z.object({ code: z.string().min(1).max(256) }), outputSchema: signalOutput, annotations, securitySchemes }, ({ code }) => { const v = { code, explanation: SIGNALS[code] || \"Unknown or unsupported Guardian signal code.\", supported: Boolean(SIGNALS[code]) }; return { content: [{ type: \"text\", text: JSON.stringify(v) }], structuredContent: v }; });\n return server;\n});\n\nfunction addNoauthSchemes(payload: any) {\n if (Array.isArray(payload?.result?.tools)) {\n payload.result.tools = payload.result.tools.map((tool: any) => ({ ...tool, securitySchemes: [{ type: \"noauth\" }] }));\n }\n return payload;\n}\n\nfunction decorateToolsListBody(text: string, contentType: string) {\n if (contentType.includes(\"text/event-stream\")) {\n return text.split(/\\r?\\n/).map((line) => {\n if (!line.startsWith(\"data: \")) return line;\n try { return `data: ${JSON.stringify(addNoauthSchemes(JSON.parse(line.slice(6))))}`; }\n catch { return line; }\n }).join(\"\\n\");\n }\n if (contentType.includes(\"application/json\")) {\n try { return JSON.stringify(addNoauthSchemes(JSON.parse(text))); }\n catch { return text; }\n }\n return text;\n}\n\nexport default async function fetch(req: Request) {\n const requestUrl = new URL(req.url);\n if (req.method === \"GET\" && requestUrl.pathname === \"/.well-known/openai-apps-challenge\") {\n const token = Deno.env.get(\"OPENAI_APPS_CHALLENGE\");\n const headers = { \"content-type\": \"text/plain; charset=utf-8\", \"cache-control\": \"no-store\" };\n if (!token || !token.trim()) return new Response(\"\", { status: 404, headers });\n return new Response(token, { status: 200, headers });\n }\n\n const origin = req.headers.get(\"origin\");\n if (origin) {\n try {\n const source = new URL(origin);\n const target = new URL(req.url);\n if (source.protocol !== \"https:\" || source.host !== target.host) return new Response(JSON.stringify({ jsonrpc: \"2.0\", id: null, error: { code: -32600, message: \"Invalid Origin\" } }), { status: 403, headers: { \"content-type\": \"application/json\", \"cache-control\": \"no-store\" } });\n } catch { return new Response(JSON.stringify({ jsonrpc: \"2.0\", id: null, error: { code: -32600, message: \"Invalid Origin\" } }), { status: 403, headers: { \"content-type\": \"application/json\", \"cache-control\": \"no-store\" } }); }\n }\n\n let rpcMethod = \"\";\n if (req.method === \"POST\") {\n try { rpcMethod = String((await req.clone().json())?.method || \"\"); } catch {}\n }\n\n const response = await handler.fetch(req);\n const headers = new Headers(response.headers);\n headers.set(\"x-rumbo-source-sha\", SOURCE_SHA);\n headers.set(\"cache-control\", \"no-store\");\n\n if (rpcMethod === \"tools/list\") {\n const contentType = headers.get(\"content-type\") || \"\";\n const text = await response.text();\n headers.delete(\"content-length\");\n return new Response(decorateToolsListBody(text, contentType), { status: response.status, headers });\n }\n\n return new Response(response.body, { status: response.status, headers });\n}\n","deleted","label",[61],"999d0233-4724-4a6c-a18f-2a6d4d6a2762","README.md","01a08a78-96e3-7515-851a-1c4d774bbbc9",1,["D",1789029553826],"# MCP server\n\n_In video form:\n[How to build an MCP server in 1 minute](https://youtu.be/sO6-Wl5fy7g?si=oc7s9bVIVFHxHJh2)_\n\nA minimal MCP server with one example tool (that gets the current time in a\ngiven timezone).\n\nRemix this val to create your own MCP server on Val\nTown—[**_just like the MCP Core Maintainer team!_**](https://blog.val.town/mcp-core-maintainers)\n\nThis MCP server (<50 LOC in [`main.ts`](./main.ts)) is live on\n[mcp-time.val.run](https://mcp-time.val.run) if you'd like to test it\n([playground.ai.cloudflare.com](https://playground.ai.cloudflare.com) is a great\nplace to test an MCP server quickly). It's built on the v2 TypeScript SDK,\ncompatible with “MCP 2.0” (technically, the\n[2026-07-28 spec](https://modelcontextprotocol.io/specification/2026-07-28)). It\nalso supports the legacy spec, for MCP clients that haven't upgraded yet.",[80],{"_35":79,"_13":80,"_62":81,"_64":-5,"_65":66,"_67":82,"_69":70,"_37":92,"_17":33,"_72":24,"_74":84,"_76":50,"_77":-5,"_89":93,"_18":94},{"_35":60,"_13":61,"_62":63,"_64":-5,"_65":66,"_67":68,"_69":70,"_37":88,"_17":31,"_72":73,"_74":75,"_76":50,"_77":14,"_89":90,"_18":91},["D",1789030562453],"children",[],[61],["D",1789029553826],[],[80],"a1349def-c4b3-4104-b5ed-4780f3a95390",["D",1789029553826],"legacyEnvVars","httpPrivacy","description","RUMBO Guardian OpenAI submission host","imageUrl","userId","d3788f19-13c5-4356-87e8-dce639626bb9","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_138":134},"org",{"_11":12,"_131":132,"_133":134,"_102":103,"_135":136,"_137":50},"branch",{"_17":68,"_13":16,"_35":66,"_41":95,"_44":36,"_45":43,"_128":52,"_129":42,"_130":55,"_56":14,"_53":12},"forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","displayName","sebas","avatar","https://lh3.googleusercontent.com/a/ACg8ocJaC6uiXPmN9dvgA2XcSlzBSkPJO0GN5zKzPm3a8cbjmXC9HYA=s96-c","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_35":95,"_13":14,"_37":182,"_48":-5,"_97":50,"_51":52,"_98":52,"_99":100,"_101":-5,"_102":103,"_104":63,"_105":50,"_106":-5,"_107":-5,"_108":33,"_54":55,"_109":-5,"_110":-5,"_111":-5,"_112":-5,"_113":114,"_115":114,"_116":117,"_118":117,"_119":117,"_120":114,"_121":114,"_122":183,"_124":184,"_126":185,"_49":50},[176,177],"files",[176,177],"counts",{"_167":33,"_168":82,"_169":33,"_34":170,"_171":172},[163,164],"upstreamProject",{"_35":42,"_13":57,"_99":161,"_101":-5,"_51":52,"_122":162},"upstreamBranch",{"_35":36,"_37":159,"_39":160,"_13":16,"_41":42,"_17":43,"_44":-5,"_45":-5,"_46":47,"_48":-5,"_49":50,"_51":52,"_53":12,"_54":55,"_56":57},"emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1789016936520],["D",1789027178708],"RUMBO Guardian bounded MCP staging",{"_11":12,"_138":134},{"_35":79,"_13":80,"_62":81,"_64":-5,"_65":66,"_67":82,"_69":70,"_37":83,"_17":33,"_72":24,"_74":84,"_76":50,"_77":-5,"_18":166},{"_35":60,"_13":61,"_62":63,"_64":-5,"_65":66,"_67":68,"_69":70,"_37":71,"_17":31,"_72":73,"_74":75,"_76":50,"_77":14,"_18":165},[61],[80],"pulls","branches","forks",{"_173":33,"_175":33},"connections",{"_173":33,"_174":33},"count","unfilledCount","emptyCount",{"_35":79,"_13":80,"_62":81,"_64":-5,"_65":66,"_67":82,"_69":70,"_37":92,"_17":33,"_72":24,"_74":84,"_76":50,"_77":-5,"_89":180,"_18":181},{"_35":60,"_13":61,"_62":63,"_64":-5,"_65":66,"_67":68,"_69":70,"_37":88,"_17":31,"_72":73,"_74":75,"_76":50,"_77":14,"_89":178,"_18":179},[],[61],[],[80],["D",1789029553826],{"_11":12,"_138":134},{"_11":12,"_131":132,"_133":134,"_102":103,"_135":136,"_137":50},{"_17":68,"_13":16,"_35":66,"_41":95,"_44":36,"_45":43,"_128":52,"_129":42,"_130":55,"_56":14,"_53":12},"ctx",{"_122":-5,"_156":219,"_220":221,"_222":223,"_224":50,"_225":50,"_226":50,"_227":70,"_228":-5,"_229":-7,"_230":-7,"_231":33,"_232":50,"_233":50,"_234":-5,"_235":50,"_236":50,"_237":50,"_238":-5},"ENV",{"_190":191,"_192":193,"_194":16,"_195":196,"_197":198,"_199":200,"_201":202,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":214,"_215":216,"_217":218},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Code