Web Researcher MCP

Highlights

Patent search now actually works. Four dedicated patent APIs (USPTO, EPO OPS, The Lens, SearchAPI) replace the broken web-discovery fallback. The tool automatically routes to the right provider based on patent office region — no config changes needed from users.

Zero audit event loss under load. The audit logger now spills to a swap file when the in-memory buffer is full, instead of silently dropping events. Events are replayed in order once pressure subsides.

Security hardened. JWT nbf claim validation, constant-time admin key comparison, and honest documentation of what's implemented vs. planned.

New Features

Patent-Specific Providers

• USPTO — US patent search via official API (USPTO_API_KEY)
• EPO OPS — Worldwide patent search with OAuth2 (EPO_OPS_CONSUMER_KEY, EPO_OPS_CONSUMER_SECRET)
• The Lens — Worldwide patents + scholarly links (LENS_API_TOKEN)
• SearchAPI — Fixed HTML tag stripping and patent number extraction from response paths

Each provider gets an independent circuit breaker and declares its regional coverage. The patent_search tool filters providers by patent_office before calling them — no wasted API calls.

Domain Provider Framework

Generic PatentProvider interface with ProviderMeta (regions, capabilities, rate class). Adding a new patent provider later is one file implementing one interface — no router or tool changes needed.

Audit Log Resilience

When the 1000-event channel buffer is full:

• Before: Events silently dropped
• Now: Events spill to .audit-swap.jsonl on disk (up to 50MB configurable cap), replayed in order when pressure subsides

Exported Spilled and Dropped atomic counters for observability.

Security

• JWT nbf validation — Tokens with a future nbf (not-before) claim are now correctly rejected
• Constant-time admin key comparison — Prevents timing attacks on the X-Admin-Key header via crypto/subtle.ConstantTimeCompare

Documentation

Complete accuracy audit across all docs:

• Removed false claims (Redis support, LRU eviction, "HTTP/SSE" transport, browser pool sizing)
• Added patent provider configuration to DEPLOYMENT.md
• Rewrote horizontal scaling section honestly (documents per-instance limitations)
• Fixed cache location docs (OS cache dir, not ./cache)
• Corrected GDPR compliance table (endpoints marked as not yet implemented)
• Updated all SEARCH_ROUTING examples to include patents operation type

Breaking Changes

None. The patent_search tool interface is unchanged — all improvements are internal routing.

Configuration (new optional env vars)

| Variable | Description |
|----------|-------------|
| USPTO_API_KEY | US patents (data.uspto.gov) |
| EPO_OPS_CONSUMER_KEY | Worldwide patents (developers.epo.org) |
| EPO_OPS_CONSUMER_SECRET | EPO OAuth2 secret |
| LENS_API_TOKEN | Worldwide + scholarly (lens.org) |

All optional. Without them, patent_search falls back to web search discovery (same as before).

Housekeeping

• Removed project-level .mcp.json (global config is authoritative)
• Made Google keys optional in smithery.yaml
• Bumped server.json to v1.3.0
• Added .gitignore entries for generated demo assets

Docker Images

# GitHub Container Registry
docker pull ghcr.io/zoharbabin/web-researcher-mcp:1.3.0

# Docker Hub
docker pull docker.io/zoharbabin/web-researcher-mcp:1.3.0

Install

go install github.com/zoharbabin/web-researcher-mcp/cmd/[email protected]

Verify

sha256sum -c checksums.txt

Full Changelog: https://github.com/zoharbabin/web-researcher-mcp/compare/v1.2.3...v1.3.0