Rewrite-regression probe pack

Your rewrite can re-ship the bug your predecessor already paid for once — this pack replays your lineage's whole advisory family against the candidate at the major-version bump and signs a verdict per historical class: NOT-REINTRODUCED, REINTRODUCED, or UNTESTABLE.

In February 2026 the MCP TypeScript SDK fixed CVE-2026-25536: a shared-instance server leaked one client's responses to another because lookups were keyed by client-chosen values without a server-owned scope. About eight months later the rewritten @modelcontextprotocol/server 2.x shipped GHSA-jm63-cq47-j5jp — the same class, again. This pack is the pre-release replay work nobody did at bump time: lineage assembly from the predecessor's whole advisory family plus same-window siblings sharing the root class, per-shape concurrent probes, a vacuous-pass guard (a shape with fewer than 8 completed colliding requests is UNTESTABLE, never a clean pass), and signed per-class verdicts bound to the candidate fingerprint (name|version|tools-hash). A changed fingerprint returns EXPIRED, never a stale pass.

Prices

Verdict query $0.01 per query (x402) · Rewrite-regression pack $9.99 per candidate major version (x402) · Maintainer pass $19.99/maintainer/mo (one SDK lineage) · Organisation pass $29.99/organisation/mo (multiple lineages). One free rewrite-regression pack per operator, ever — a one-time trial grant enforced by operator account identity; after that single pack the standard prices apply to all packs, queries, and passes.

How to start

POST /register {"name": "your-operator-name", "payer_wallet": "0x…"} — unauthenticated, returns a claim token.
POST /trial/claim {"claim_token": "…"} — returns your API token (shown once) with the one-time free pack attached.
POST /pack with Authorization: Bearer <token> and either {"house_double": {"vuln": "S1,S2", "version": "2.0.0"}} (the bundled candidate doubles — authorised house targets) or {"target_url": "https://your-candidate/", "authorised": true, "authorisation": "my own build"} — replays run ONLY against targets you authorise; the authorisation is recorded per pack. Probes carry only the probe's own marker payloads, never your data.
GET /verdict?fingerprint=… with your token — $0.01 per query via x402 (verified before, settled after), or covered by a pass. POST /subscribe {"tier": "maintainer"|"organisation"} with an x402 payment at $19.99 / $29.99 for a 30-day pass.
MCP: POST /mcp (streamable-http JSON-RPC) — tools rewrite_pack, rewrite_verdict, rewrite_verify_pack, rewrite_family.

Limits, stated plainly

Detection validity was established on candidate doubles in the lab (each of the 5 launch shapes detected individually and jointly, zero false positives on a fixed rewrite). The reintroduction rate across real rewrites, major-bump volume per year, and willingness to pay are UNMEASURED — nobody has sold a history-seeded rewrite-regression verdict before. A verdict for one generation or language proves nothing about the next, which is exactly why the replay re-runs per rewrite. The SDK fixes themselves (@modelcontextprotocol/sdk 1.26.0 and @modelcontextprotocol/server 2.3.0) and DIY manual replay are free; the paid value here is only the pre-release, history-seeded verdict layer they do not provide — this pack never replaces taking an SDK fix.

Launch family: S1 response routing by JSON-RPC id alone, S2 session-unbound tasks, S3 token audience unchecked, S4 notification subscription unscoped, S5 credential-header carriage across a cross-host fetch. Families beyond 5 shapes enter only as recorded metered legs at a pack-price step. Pass discipline: lineage assembly is performed once per lineage and reused; standing replays fire only on a candidate major-version bump; unchanged and minor/patch ticks serve the precomputed verdict. Support: support@textforagents.com. Full documentation: /docs on this product path. Terms: /terms · Privacy: /privacy.