Harden public API and MCP inputs

API_CONTRACT.md

@@ -31,7 +31,14 @@ equal timestamps cannot cause duplicates or skips across pages.
 Canonical instrument IDs accept only alphanumeric, colon, period, underscore
 and hyphen characters and are capped at 240 characters.
 
-Full-text document search tokenizes at most 12 terms from a 120-character
-query, uses parameterized SQLite FTS, supports ticker/type/date constraints and
+Full-text document search rejects more than 12 terms or 120 characters, uses
+parameterized SQLite FTS, supports ticker/type/date constraints and
 returns at most 50 ranked results per page. Snippets are capped at 600
 characters; full markdown bodies are never returned by search.
+
+Public requests are protected by bounded global request and concurrency
+budgets. Overload returns `429 rate_limited` or `503 service_busy` with a
+one-second retry hint; URLs over 2,048 characters return `414
+request_too_large`. Non-read API methods return `405 read_only_surface`.
+File/upload/reset, login and monitoring routes are disabled. The complete
+boundary is documented in [`SECURITY.md`](SECURITY.md).

MCP_TOOLS.md

@@ -31,3 +31,8 @@ No MCP tool accepts arbitrary SQL, URLs or storage paths. The service cannot
 write data, mutate the publishing pipeline, list storage or expose credentials
 and worker state. Automated extraction can contain errors; verify research
 against the cited issuer announcement. This is not financial advice.
+
+Oversized values are rejected with clear tool errors instead of being silently
+truncated. Search accepts at most 120 characters and 12 terms. Citation hosts
+and public markdown artifact keys are fail-closed allowlists; service-level
+request and concurrency budgets are described in [`SECURITY.md`](SECURITY.md).

README.md

@@ -30,6 +30,8 @@ The typed REST contract is available at `/openapi.json`; pagination, cursor and
 structured-error rules are documented in [`API_CONTRACT.md`](API_CONTRACT.md).
 The exact MCP tool allowlist, response caps and provenance rules are documented
 in [`MCP_TOOLS.md`](MCP_TOOLS.md).
+Input allowlists, request/concurrency budgets and blocked mutation/file routes
+are documented in [`SECURITY.md`](SECURITY.md).
 
 The Space will load one validated commit of
 [`mzx/dilutionrisk-data`](https://huggingface.co/datasets/mzx/dilutionrisk-data)
@@ -47,10 +49,10 @@ The target update cadence is daily. Every data response will include the exact
 Dataset revision. Full PDFs/markdown are delivered as public artifact URLs and
 are not embedded into MCP responses.
 
-No arbitrary SQL, URL fetching, storage listing, pipeline mutation, credentials
-or operational worker state is exposed. Automated extraction may contain
-errors; verify against the linked issuer announcement. Nothing here is
-financial advice.
+No arbitrary SQL, caller-supplied URL/path fetching, storage listing, file
+upload, pipeline mutation, credentials or operational worker state is exposed.
+Automated extraction may contain errors; verify against the linked issuer
+announcement. Nothing here is financial advice.
 
 The Space code is MIT-licensed. Dataset/source content has separate terms in
 the Dataset card and is not covered by the software licence.

SECURITY.md

@@ -0,0 +1,31 @@
+# Public-service security boundary
+
+The Space is a public, read-only research service. Its accepted inputs are
+tickers, canonical document identities, bounded search/filter values and opaque
+cursors issued by the same Dataset revision. It does not accept SQL, URLs,
+filesystem paths, storage keys or write/delete commands.
+
+Controls enforced in the running service:
+
+- ASX is the only exchange and all REST sorts/filters are typed allowlists;
+- search text is limited to 120 characters and 12 terms, document type to 80
+  characters, canonical identities to 240 and cursors to 1,024;
+- MCP result limits are clamped and REST limits are schema-bounded;
+- citation URLs must be HTTPS on an approved ASX hostname;
+- markdown reads are constructed only from canonical public HF keys matching
+  `artifacts/v1/asx/<TICKER>/...<FILE>.md`;
+- legacy GCS paths, caller-supplied URLs and arbitrary local paths are never
+  fetched;
+- Gradio upload/file/reset, login and monitoring routes are blocked;
+- API write methods return a structured `405 read_only_surface` response;
+- one bounded-memory global token bucket permits a burst of 240 requests and
+  refills at four requests per second;
+- at most 16 public requests enter the query layer concurrently, while each
+  Gradio query function also has a four-call concurrency group; and
+- overload returns structured `429 rate_limited` or `503 service_busy` errors
+  with `Retry-After: 1`.
+
+The service exposes exact public build/data revisions and dependency versions,
+but never serializes environment variables, tokens, credentials or worker
+state. Public artifact and source content should still be treated as untrusted
+text by downstream renderers.

app.py

@@ -7,6 +7,7 @@ import os
 import platform
 import re
 import threading
+import asyncio
 from datetime import date
 import urllib.parse
 import urllib.request
@@ -25,6 +26,7 @@ from company_query import filter_fingerprint,search_companies as query_companies
 from document_query import fingerprint as document_fingerprint,get_document,search_documents as query_documents
 from instrument_query import dilution_instruments
 from search_query import SearchInputError,document_citation,search as search_fts
+from security import TokenBucket,bounded_text,finite_non_negative,valid_markdown_artifact_key
 from cache import RevisionCache
 
 
@@ -35,6 +37,8 @@ CACHE = RevisionCache(
     "https://huggingface.co/buckets/mzx/dilutionrisk-public/resolve/manifests/v1/latest.json",
     RELEASE["dataset_id"],
 )
+REQUEST_BUDGET = TokenBucket(capacity=240, refill_per_second=4)
+QUERY_SLOTS = asyncio.Semaphore(16)
 
 if os.environ.get("SPACE_ID") and os.environ.get("DILUTIONRISK_SKIP_CACHE_BOOTSTRAP") != "1":
     threading.Thread(target=CACHE.bootstrap, name="dataset-cache-bootstrap", daemon=True).start()
@@ -114,6 +118,21 @@ def error_response(status:int,code:str,message:str,details:list[dict]|None=None)
     revision=CACHE.status()["dataset_revision"] or RELEASE["dataset_revision"]
     return JSONResponse(status_code=status,content=ErrorResponse(error=ErrorBody(code=code,message=message,details=details or [],dataset_revision=revision)).model_dump())
 
+@api.middleware("http")
+async def public_abuse_guard(request:Request,call_next):
+    path=request.url.path;protected=path.startswith(("/api/v1/","/gradio_api/"));blocked=path.startswith(("/gradio_api/upload","/gradio_api/file","/file=","/file/","/login","/logout","/monitoring")) or path.rstrip("/").endswith("/reset")
+    if blocked:return error_response(403,"read_only_surface","File, login, monitoring and mutation routes are disabled")
+    if path.startswith("/api/v1/") and request.method not in {"GET","HEAD","OPTIONS"}:return error_response(405,"read_only_surface","This API supports read-only methods only")
+    if protected and len(str(request.url))>2048:return error_response(414,"request_too_large","Request URL must be at most 2048 characters")
+    if protected and not REQUEST_BUDGET.consume():
+        response=error_response(429,"rate_limited","Public request budget exhausted; retry shortly");response.headers["Retry-After"]="1";return response
+    if not protected:return await call_next(request)
+    try:await asyncio.wait_for(QUERY_SLOTS.acquire(),timeout=0.25)
+    except TimeoutError:
+        response=error_response(503,"service_busy","Public query concurrency limit reached; retry shortly");response.headers["Retry-After"]="1";return response
+    try:return await call_next(request)
+    finally:QUERY_SLOTS.release()
+
 @api.exception_handler(RequestValidationError)
 async def validation_error(_request:Request,error:RequestValidationError):
     details=[{"field":".".join(map(str,item["loc"][1:])),"type":item["type"],"message":item["msg"]} for item in error.errors()]
@@ -194,9 +213,9 @@ def search_companies(query:str="",min_risk:float|None=None,max_runway:float|None
         limit: Maximum companies to return; clamped to 1 through 25.
         cursor: Opaque next_cursor from the same query; empty for the first page.
     """
-    cache,context=tool_context();limit=max(1,min(int(limit),25));q=query.strip()[:120] or None;minimum=max(0,min_risk) if min_risk is not None else None;runway=max(0,max_runway) if max_runway is not None else None;sort="risk" if min_risk is not None else "ticker";direction="desc" if min_risk is not None else "asc";filters={"q":q,"min_risk":minimum,"max_runway":runway,"min_expiry_3m":None,"min_expiry_6m":None,"min_expiry_12m":None,"needs_review":needs_review,"sort":sort,"direction":direction};fingerprint=filter_fingerprint(filters);offset=0
+    cache,context=tool_context();limit=max(1,min(int(limit),25));q=bounded_text(query,"query",120) or None;minimum=finite_non_negative(min_risk,"min_risk");runway=finite_non_negative(max_runway,"max_runway");cursor=bounded_text(cursor,"cursor",1024);sort="risk" if min_risk is not None else "ticker";direction="desc" if min_risk is not None else "asc";filters={"q":q,"min_risk":minimum,"max_runway":runway,"min_expiry_3m":None,"min_expiry_6m":None,"min_expiry_12m":None,"needs_review":needs_review,"sort":sort,"direction":direction};fingerprint=filter_fingerprint(filters);offset=0
     if cursor:
-        try:values=decode_cursor(cursor[:1025],cache["dataset_revision"],"mcp_companies")
+        try:values=decode_cursor(cursor,cache["dataset_revision"],"mcp_companies")
         except CursorError as error:raise ValueError(str(error)) from error
         if len(values)!=2 or values[1]!=fingerprint or not isinstance(values[0],int) or not 0<=values[0]<=10000:raise ValueError("cursor does not match this company query")
         offset=values[0]
@@ -208,7 +227,7 @@ def get_company_snapshot(ticker:str)->dict:
     Args:
         ticker: Exact 2-6 character ASX ticker, for example BHP.
     """
-    cache,context=tool_context();ticker=ticker.strip().upper()
+    cache,context=tool_context();ticker=bounded_text(ticker,"ticker",6,required=True).upper()
     if not re.fullmatch(r"[A-Z0-9]{2,6}",ticker):raise ValueError("ticker must be 2-6 ASX characters")
     items,_,_=query_companies(cache["cache_dir"],q=ticker,sort="ticker",direction="asc",limit=10,offset=0);item=next((x for x in items if x["ticker"]==ticker),None);return {**context,"found":item is not None,"company":item}
 
@@ -222,10 +241,10 @@ def search_documents(query:str,ticker:str="",doc_type:str="",limit:int=10,cursor
         limit: Maximum documents to return; clamped to 1 through 25.
         cursor: Opaque next_cursor from the same query; empty for the first page.
     """
-    cache,context=tool_context();limit=max(1,min(int(limit),25));ticker=ticker.strip().upper() or None;doc_type=doc_type.strip()[:80] or None;bounded_query=query[:120];fingerprint=document_fingerprint({"q":bounded_query,"ticker":ticker,"doc_type":doc_type});offset=0
+    cache,context=tool_context();limit=max(1,min(int(limit),25));ticker=bounded_text(ticker,"ticker",6).upper() or None;doc_type=bounded_text(doc_type,"doc_type",80) or None;bounded_query=bounded_text(query,"query",120,required=True);cursor=bounded_text(cursor,"cursor",1024);fingerprint=document_fingerprint({"q":bounded_query,"ticker":ticker,"doc_type":doc_type});offset=0
     if ticker and not re.fullmatch(r"[A-Z0-9]{2,6}",ticker):raise ValueError("ticker must be 2-6 ASX characters")
     if cursor:
-        try:values=decode_cursor(cursor[:1025],cache["dataset_revision"],"mcp_document_search")
+        try:values=decode_cursor(cursor,cache["dataset_revision"],"mcp_document_search")
         except CursorError as error:raise ValueError(str(error)) from error
         if len(values)!=2 or values[1]!=fingerprint or not isinstance(values[0],int) or not 0<=values[0]<=1000:raise ValueError("cursor does not match this document search")
         offset=values[0]
@@ -240,7 +259,7 @@ def get_document_metadata(document_id:str)->dict:
     Args:
         document_id: Canonical document identity such as ASX:CLA:03115626.
     """
-    cache,context=tool_context();document_id=document_id.strip()
+    cache,context=tool_context();document_id=bounded_text(document_id,"document_id",240,required=True)
     if not re.fullmatch(r"ASX:[A-Z0-9]{2,6}:[A-Za-z0-9._-]+",document_id):raise ValueError("invalid canonical document ID")
     item=get_document(cache["cache_dir"],document_id);citation=document_citation(cache["cache_dir"],document_id);return {**context,"found":item is not None,"document":item,"citation":citation["source_link"] if citation else None}
 
@@ -251,13 +270,13 @@ def get_document_markdown(document_id:str,max_chars:int=6000)->dict:
         document_id: Canonical document identity such as ASX:CLA:03115626.
         max_chars: Maximum excerpt length; clamped to 500 through 12,000 characters.
     """
-    cache,context=tool_context();document_id=document_id.strip();max_chars=max(500,min(int(max_chars),12000))
+    cache,context=tool_context();document_id=bounded_text(document_id,"document_id",240,required=True);max_chars=max(500,min(int(max_chars),12000))
     if not re.fullmatch(r"ASX:[A-Z0-9]{2,6}:[A-Za-z0-9._-]+",document_id):raise ValueError("invalid canonical document ID")
     item=get_document(cache["cache_dir"],document_id);citation=document_citation(cache["cache_dir"],document_id);source_link=citation["source_link"] if citation else None
     if not item:return {**context,"found":False,"available":False,"markdown":None,"citation":None}
     key=item.get("markdown_artifact_key")
     if not key:return {**context,"found":True,"available":False,"reason":"HF markdown artifact not yet published","markdown":None,"citation":source_link}
-    if not key.startswith("artifacts/v1/asx/") or ".." in key.split("/"):raise ValueError("invalid published artifact key")
+    if not valid_markdown_artifact_key(key):raise ValueError("invalid published HF markdown artifact key")
     url="https://huggingface.co/buckets/mzx/dilutionrisk-public/resolve/"+urllib.parse.quote(key,safe="/=-._")
     with urllib.request.urlopen(url,timeout=20) as response:body=response.read(max_chars*4+1).decode("utf-8","replace")
     return {**context,"found":True,"available":True,"markdown":body[:max_chars],"truncated":len(body)>max_chars,"citation":source_link,"artifact_url":url}
@@ -269,7 +288,7 @@ def get_dilution_instruments(ticker:str,limit:int=50)->dict:
         ticker: Exact 2-6 character ASX ticker.
         limit: Maximum instruments to return; clamped to 1 through 100.
     """
-    cache,context=tool_context();ticker=ticker.strip().upper()
+    cache,context=tool_context();ticker=bounded_text(ticker,"ticker",6,required=True).upper()
     if not re.fullmatch(r"[A-Z0-9]{2,6}",ticker):raise ValueError("ticker must be 2-6 ASX characters")
     items=dilution_instruments(cache["cache_dir"],ticker,max(1,min(int(limit),100)));return {**context,"ticker":ticker,"items":items,"returned":len(items)}
 

release.json

@@ -1,5 +1,5 @@
 {
-  "service_version": "0.8.1",
+  "service_version": "0.9.0",
   "schema_version": 1,
   "dataset_id": "mzx/dilutionrisk-data",
   "dataset_revision": "d2b8896cabf2489d1b2f82694376f90a3b38049c",

search_query.py

@@ -2,6 +2,7 @@
 from __future__ import annotations
 import re,sqlite3,time
 from pathlib import Path
+from security import public_asx_url
 
 MAX_SNIPPET=600
 class SearchInputError(ValueError):pass
@@ -12,7 +13,8 @@ def database(cache_dir):
 def compile_query(value):
  terms=re.findall(r"[^\W_]+",value.casefold(),flags=re.UNICODE)
  if not terms:raise SearchInputError("Query has no searchable terms")
- return " AND ".join('"%s"'%term.replace('"','') for term in terms[:12])
+ if len(terms)>12:raise SearchInputError("Query must contain at most 12 searchable terms")
+ return " AND ".join('"%s"'%term.replace('"','') for term in terms)
 def search(cache_dir,query,*,ticker=None,doc_type=None,date_from=None,date_to=None,limit=20,offset=0,deadline_seconds=2.0):
  fts=compile_query(query);ticker_candidate=query.strip().upper() if re.fullmatch(r"[A-Za-z0-9]{2,6}",query.strip()) else "";conditions=["search MATCH ?"];params=[fts]
  if ticker:conditions.append("d.ticker=?");params.append(ticker)
@@ -24,7 +26,10 @@ def search(cache_dir,query,*,ticker=None,doc_type=None,date_from=None,date_to=No
  params=[MAX_SNIPPET,MAX_SNIPPET-1,*params,ticker_candidate,limit+1,offset];path=database(cache_dir);connection=sqlite3.connect("file:%s?mode=ro"%path,uri=True,timeout=2);connection.execute("PRAGMA query_only=ON");deadline=time.monotonic()+deadline_seconds;connection.set_progress_handler(lambda:1 if time.monotonic()>deadline else 0,10000)
  try:rows=connection.execute(sql,params).fetchall()
  finally:connection.close()
- names=["document_id","ticker","doc_type","announcement_date","title","source_link","snippet","score"]
- return [dict(zip(names,row)) for row in rows[:limit]],len(rows)>limit
+ names=["document_id","ticker","doc_type","announcement_date","title","source_link","snippet","score"];items=[]
+ for row in rows:
+  item=dict(zip(names,row));item["source_link"]=public_asx_url(item["source_link"])
+  if item["source_link"]:items.append(item)
+ return items[:limit],len(items)>limit
 def document_citation(cache_dir,document_id):
- path=database(cache_dir);connection=sqlite3.connect("file:%s?mode=ro"%path,uri=True);row=connection.execute("SELECT coalesce(source_url,raw_source_uri),markdown_source_uri FROM documents WHERE document_id=?",(document_id,)).fetchone();connection.close();return {"source_link":row[0],"legacy_markdown_source":row[1]} if row else None
+ path=database(cache_dir);connection=sqlite3.connect("file:%s?mode=ro"%path,uri=True);row=connection.execute("SELECT source_url FROM documents WHERE document_id=?",(document_id,)).fetchone();connection.close();source_link=public_asx_url(row[0]) if row else None;return {"source_link":source_link} if source_link else None

security.py

@@ -0,0 +1,90 @@
+"""Fail-closed validation and lightweight public-service abuse controls."""
+from __future__ import annotations
+
+import math
+import re
+import threading
+import time
+import urllib.parse
+
+
+ASX_SOURCE_HOSTS = {"www.asx.com.au", "announcements.asx.com.au"}
+MARKDOWN_ARTIFACT = re.compile(
+    r"^artifacts/v1/asx/[A-Z0-9]{2,6}/[A-Za-z0-9][A-Za-z0-9._=-]*(?:/[A-Za-z0-9][A-Za-z0-9._=-]*)*\.md$"
+)
+
+
+def bounded_text(value: str, name: str, maximum: int, *, required: bool = False) -> str:
+    """Strip a public string and reject, rather than truncate, oversized input."""
+
+    if not isinstance(value, str):
+        raise ValueError(f"{name} must be text")
+    normalized = value.strip()
+    if required and not normalized:
+        raise ValueError(f"{name} is required")
+    if len(normalized) > maximum:
+        raise ValueError(f"{name} must be at most {maximum} characters")
+    return normalized
+
+
+def finite_non_negative(value: float | None, name: str) -> float | None:
+    """Reject NaN, infinity and negative public numeric filters."""
+
+    if value is None:
+        return None
+    number = float(value)
+    if not math.isfinite(number) or number < 0:
+        raise ValueError(f"{name} must be a finite non-negative number")
+    return number
+
+
+def public_asx_url(value: str | None) -> str | None:
+    """Return only an HTTPS citation on an approved ASX hostname."""
+
+    if not value or len(value) > 2048:
+        return None
+    try:
+        parsed = urllib.parse.urlsplit(value)
+        port = parsed.port
+    except ValueError:
+        return None
+    if parsed.scheme != "https" or parsed.hostname not in ASX_SOURCE_HOSTS:
+        return None
+    if parsed.username or parsed.password or port not in (None, 443):
+        return None
+    return value
+
+
+def valid_markdown_artifact_key(value: str | None) -> bool:
+    """Allow only canonical public markdown keys, never URLs or paths."""
+
+    return bool(value and len(value) <= 512 and MARKDOWN_ARTIFACT.fullmatch(value))
+
+
+class TokenBucket:
+    """Thread-safe global token bucket with bounded memory."""
+
+    def __init__(self, capacity: int, refill_per_second: float):
+        if capacity < 1 or refill_per_second <= 0:
+            raise ValueError("invalid token bucket configuration")
+        self.capacity = float(capacity)
+        self.refill_per_second = float(refill_per_second)
+        self._tokens = float(capacity)
+        self._updated_at = time.monotonic()
+        self._lock = threading.Lock()
+
+    def consume(self, amount: float = 1.0, *, now: float | None = None) -> bool:
+        if amount <= 0 or amount > self.capacity:
+            return False
+        current = time.monotonic() if now is None else now
+        with self._lock:
+            elapsed = max(0.0, current - self._updated_at)
+            self._tokens = min(
+                self.capacity,
+                self._tokens + elapsed * self.refill_per_second,
+            )
+            self._updated_at = current
+            if self._tokens < amount:
+                return False
+            self._tokens -= amount
+            return True

tests/test_search_query.py

@@ -5,8 +5,8 @@ from search_query import SearchInputError,search
 class SearchTests(unittest.TestCase):
  def test_safe_ranked_filtered_bounded_search(self):
   with tempfile.TemporaryDirectory() as td:
-   p=Path(td)/"indexes/v1/x";p.mkdir(parents=True);db=p/"search.sqlite";c=sqlite3.connect(db);c.executescript("CREATE TABLE documents(rowid INTEGER PRIMARY KEY,document_id TEXT,ticker TEXT,doc_type TEXT,announced_date TEXT,title TEXT,source_url TEXT,raw_source_uri TEXT);CREATE VIRTUAL TABLE search USING fts5(title,ticker,doc_type,announced_date,body);INSERT INTO documents VALUES(1,'ASX:BHP:1','BHP','Report','2026-01-01','Annual Report','https://asx/1',NULL);INSERT INTO search(rowid,title,ticker,doc_type,announced_date,body) VALUES(1,'Annual Report','BHP','Report','2026-01-01','Capital raising details');");c.commit();c.close()
+   p=Path(td)/"indexes/v1/x";p.mkdir(parents=True);db=p/"search.sqlite";c=sqlite3.connect(db);c.executescript("CREATE TABLE documents(rowid INTEGER PRIMARY KEY,document_id TEXT,ticker TEXT,doc_type TEXT,announced_date TEXT,title TEXT,source_url TEXT,raw_source_uri TEXT);CREATE VIRTUAL TABLE search USING fts5(title,ticker,doc_type,announced_date,body);INSERT INTO documents VALUES(1,'ASX:BHP:1','BHP','Report','2026-01-01','Annual Report','https://www.asx.com.au/asx/1',NULL);INSERT INTO search(rowid,title,ticker,doc_type,announced_date,body) VALUES(1,'Annual Report','BHP','Report','2026-01-01','Capital raising details');");c.commit();c.close()
    lower,_=search(td,"annual report",limit=10);upper,_=search(td,"ANNUAL REPORT",limit=10);self.assertEqual(lower,upper);self.assertEqual(lower[0]["ticker"],"BHP");self.assertLessEqual(len(lower[0]["snippet"]),600)
-   filtered,_=search(td,"capital-raising",ticker="BHP",doc_type="Report",date_from="2026-01-01",limit=10);self.assertEqual(filtered[0]["source_link"],"https://asx/1")
+   filtered,_=search(td,"capital-raising",ticker="BHP",doc_type="Report",date_from="2026-01-01",limit=10);self.assertEqual(filtered[0]["source_link"],"https://www.asx.com.au/asx/1")
    with self.assertRaises(SearchInputError):search(td,"---___",limit=10)
 if __name__=="__main__":unittest.main()

tests/test_security.py

@@ -0,0 +1,102 @@
+from __future__ import annotations
+
+import math
+import os
+import unittest
+from unittest.mock import patch
+
+from fastapi.testclient import TestClient
+
+import app
+from search_query import SearchInputError,compile_query
+from security import TokenBucket,bounded_text,finite_non_negative,public_asx_url,valid_markdown_artifact_key
+
+
+REVISION = "d2b8896cabf2489d1b2f82694376f90a3b38049c"
+CONTEXT = {
+    "dataset_revision": REVISION,
+    "published_at": "2026-07-17T12:49:16Z",
+    "source_watermark": {"provider": "ASX"},
+    "dataset_citation": "https://huggingface.co/datasets/mzx/dilutionrisk-data/tree/" + REVISION,
+}
+
+
+class SecurityTests(unittest.TestCase):
+    def test_public_text_and_numeric_inputs_fail_closed(self):
+        self.assertEqual(bounded_text(" BHP ", "ticker", 6), "BHP")
+        with self.assertRaisesRegex(ValueError, "at most 6"):
+            bounded_text("TOO-LONG", "ticker", 6)
+        for value in (-1, math.inf, -math.inf, math.nan):
+            with self.subTest(value=value), self.assertRaises(ValueError):
+                finite_non_negative(value, "risk")
+        with self.assertRaises(SearchInputError):
+            compile_query("one two three four five six seven eight nine ten eleven twelve thirteen")
+
+    def test_citations_and_markdown_keys_are_strictly_allowlisted(self):
+        self.assertEqual(
+            public_asx_url("https://www.asx.com.au/asx/v2/statistics/announcements.do?id=1"),
+            "https://www.asx.com.au/asx/v2/statistics/announcements.do?id=1",
+        )
+        for value in ("http://www.asx.com.au/a", "https://evil.example/a", "file:///etc/passwd", "gs://private/key"):
+            with self.subTest(value=value):
+                self.assertIsNone(public_asx_url(value))
+        self.assertTrue(valid_markdown_artifact_key("artifacts/v1/asx/CLA/03115626.md"))
+        for value in (
+            "artifacts/v1/asx/CLA/../../etc/passwd.md",
+            "https://evil.example/file.md",
+            "/etc/passwd.md",
+            "artifacts/v1/asx/CLA/file.pdf",
+        ):
+            with self.subTest(value=value):
+                self.assertFalse(valid_markdown_artifact_key(value))
+
+    def test_markdown_tool_never_fetches_caller_controlled_targets(self):
+        document = {"document_id": "ASX:CLA:03115626", "markdown_artifact_key": "artifacts/v1/asx/CLA/../../etc/passwd.md"}
+        cache = {"cache_dir": "/tmp/cache", "dataset_revision": REVISION}
+        with patch.object(app, "tool_context", return_value=(cache, CONTEXT)), patch.object(app, "get_document", return_value=document), patch.object(app, "document_citation", return_value={"source_link": "https://www.asx.com.au/a"}), patch.object(app.urllib.request, "urlopen") as urlopen:
+            with self.assertRaisesRegex(ValueError, "invalid published HF"):
+                app.get_document_markdown(document["document_id"])
+        urlopen.assert_not_called()
+
+    def test_oversized_mcp_inputs_raise_clear_errors(self):
+        cache = {"cache_dir": "/tmp/cache", "dataset_revision": REVISION}
+        with patch.object(app, "tool_context", return_value=(cache, CONTEXT)):
+            with self.assertRaisesRegex(ValueError, "at most 120"):
+                app.search_companies(query="x" * 121)
+            with self.assertRaisesRegex(ValueError, "at most 80"):
+                app.search_documents(query="capital", doc_type="x" * 81)
+
+    def test_token_bucket_degrades_repeated_requests_without_state_growth(self):
+        bucket = TokenBucket(capacity=2, refill_per_second=1)
+        self.assertTrue(bucket.consume(now=100.0))
+        self.assertTrue(bucket.consume(now=100.0))
+        self.assertFalse(bucket.consume(now=100.0))
+        self.assertTrue(bucket.consume(now=101.0))
+
+    def test_http_rate_limit_and_read_only_guards_are_structured(self):
+        client = TestClient(app.app)
+        with patch.object(app.REQUEST_BUDGET, "consume", return_value=False):
+            response = client.get("/api/v1/status")
+        self.assertEqual(response.status_code, 429)
+        self.assertEqual(response.json()["error"]["code"], "rate_limited")
+        self.assertEqual(response.headers["retry-after"], "1")
+
+        response = client.post("/api/v1/status")
+        self.assertEqual(response.status_code, 405)
+        self.assertEqual(response.json()["error"]["code"], "read_only_surface")
+        response = client.post("/gradio_api/upload")
+        self.assertEqual(response.status_code, 403)
+        self.assertEqual(response.json()["error"]["code"], "read_only_surface")
+        response = client.get("/file=/etc/passwd")
+        self.assertEqual(response.status_code, 403)
+        self.assertEqual(response.json()["error"]["code"], "read_only_surface")
+
+    def test_public_status_does_not_disclose_environment_secrets(self):
+        cache = {"cache_dir": "/tmp/cache", "dataset_revision": REVISION}
+        with patch.dict(os.environ, {"HF_TOKEN": "SECRET_SENTINEL", "OPENAI_API_KEY": "SECRET_SENTINEL"}), patch.object(app, "tool_context", return_value=(cache, CONTEXT)), patch.object(app, "health", return_value={"ready": True}):
+            payload = app.get_dataset_status()
+        self.assertNotIn("SECRET_SENTINEL", repr(payload))
+
+
+if __name__ == "__main__":
+    unittest.main()