Feature/lovable

[AndreiDrang]

No description provided.

[github-actions]

Z.ai Code Review

## 🔍 Review Summary
This PR introduces a Model Context Protocol (MCP) server via a Supabase Edge Function, providing tools to query TokenBel platform information and search for securities. It also includes dependency updates and JSON-LD metadata enhancements. Overall, the implementation is solid, but there are a few metadata bugs and security considerations to address before merging.

## 🚨 Critical Issues & Bugs

• index.html: The dateModified property in the JSON-LD schema is hardcoded to "2026-06-24". Supplying a future date can confuse search engine crawlers and negatively impact SEO validity. It should reflect the actual last-modified date or be dynamically generated.
• supabase/functions/mcp/index.ts / .lovable/mcp/manifest.json: The MCP function is deployed without authentication ("auth": { "type": "none" }) and acts as an open proxy to https://hype.tokenbel.info/search. Because it is unauthenticated, an attacker could easily abuse this endpoint to bypass any IP-based rate limits on your underlying Hype API or exhaust your Supabase Edge Function invocation quotas. It is highly recommended to implement basic authorization (like an API key check) or apply strict rate limiting.

## 💡 Suggestions & Best Practices

• src/lib/mcp/tools/get-site-info.ts: The zod library is imported but never used. While linters typically catch this, removing import { z } from "zod"; will keep the bundle size slightly smaller and the code cleaner.

• src/lib/mcp/tools/search-securities.ts: In the handler function, await res.text() is called before checking if (!res.ok). If the upstream API returns a massive error payload (e.g., an HTML page from a misconfigured proxy), this will read the entire body into memory before truncating it. It is safer and slightly more efficient to check res.ok first:

  handler: async ({ query, limit }) => {
    const url = `${API_BASE}/search?q=${encodeURIComponent(query)}&limit=${limit}`;
    try {
      const res = await fetch(url, { headers: { Accept: "application/json" } });
      
      if (!res.ok) {
        const errorText = await res.text();
        return {
          content: [{ type: "text", text: `Hype API error ${res.status}: ${errorText.slice(0, 500)}` }],
          isError: true,
        };
      }
  
      const text = await res.text();
      return { content: [{ type: "text", text }] };
    } catch (err) {
      // ... error handling
    }
  }

## 📊 Final Assessment

• Rating: Normal
• Reason: The core feature is implemented well, but the PR introduces a metadata bug (incorrect future date) and an architectural security risk by exposing an unauthenticated serverless proxy to an external API.