` (\"unknown\"), putting the locality in the **store name** instead (\"חולון המרכבה\", \"רעננה\", 'דיל פ\"ת- אליעזר פרדימן'). Both geocode tiers key on `store.city`, so those branches used to be ungeocodable and invisible to every location-scoped query — all 52 Yohananof branches among them. Ingest now derives the city from the branch name when the feed omits it (`resolveStoreCity`), and a `--mode=city` geocode tier repairs existing rows:\n\n```bash\npnpm --filter @super-mcp/db exec tsx src/scripts/geocodeStores.ts --mode=city # name → city\npnpm --filter @super-mcp/db exec tsx src/scripts/geocodeStores.ts --mode=centroid # city → centroid (runs the city tier first)\npnpm --filter @super-mcp/db exec tsx src/scripts/geocodeStores.ts --mode=address # Nominatim branch-level upgrade (rate limited)\n```\n\nFeeds also publish online storefronts, pickup points and logistics warehouses as ordinary `` rows — and those hold the three deepest price catalogs in the data. `store.store_kind` (`branch` / `online` / `pickup` / `warehouse`) marks them so they are never recommended as somewhere to shop.\n\n`store_price` is reconciled against full snapshots: after a store's `PriceFull` file is ingested cleanly, rows the snapshot did not refresh are delisted. `last_seen_at` is the cutoff (always bumped on upsert, unlike the monotonically gated `source_ts`). Four safety gates bias towards keeping stale rows over deleting live ones: full files only (never a delta), no parse errors, a minimum snapshot size, and a refusal to delete more than 35% of a store's catalog in one pass. Counts surface as `pricesReconciled` on the run report.\n\nA configured chain that yields zero files or zero rows now marks the run `degraded` with the chain named, instead of reporting `success`.\n\n### Create API key (self-hosters and the operator)\n\nThe hosted service issues no keys and needs none. This is for a self-hosted deployment\nwith `SUPER_MCP_ALLOW_ANONYMOUS=0`, and for the operator's own break-glass master key.\n\n```bash\n# Standard shopping key\npnpm create-key -- --name=my-agent\n\n# Break-glass master key (CLI only — HTTP admin cannot mint masters)\npnpm create-key -- --name=operations --role=master --expires-at=2026-12-31T23:59:59Z\n```\n\nKeys are stored only as SHA-256 hashes. Keep the one-time raw value in a secret\nmanager and send it as `Authorization: Bearer `; do not put it in config,\nURLs, logs, or this repository. Master\nkeys can list/rotate/revoke and mint **standard** keys under `/v1/admin/keys`, and\nread global usage at `/v1/admin/usage`. Rotation returns the replacement raw key\nonce and revokes the prior key atomically.\n\nQuery-string credentials are rejected. Send the key as `Authorization: Bearer `.\n\n### Keyless (anonymous) access\n\n`SUPER_MCP_ALLOW_ANONYMOUS=1` lets a caller reach the shopping surface with no\ncredential at all, so an agent can point at `/mcp` and start working. It is off by\ndefault; unsetting it is the kill switch and takes effect on the next request\nwithout a redeploy. Issued keys keep working alongside it, with their own quotas.\n\nAnonymous callers get the `standard` role, so `/v1/admin/*` still answers 403 —\nadministration always requires a real master key. Presenting an invalid or revoked\nkey is still a 401: a bad credential is never quietly downgraded to anonymous.\n\nTwo ceilings protect the host, both per minute:\n\n| Variable | Default | Bucket |\n|----------|---------|--------|\n| `SUPER_MCP_ANONYMOUS_RATE_LIMIT` | 30 | one client address |\n| `SUPER_MCP_ANONYMOUS_GLOBAL_RATE_LIMIT` | 600 | all keyless traffic together |\n\nThe per-address window is charged before the shared one, so a single flooding\nclient cannot spend the global budget and lock everyone else out. Exceeding either\nreturns 429 with `details.scope` naming which ceiling was hit.\n\n**Treat the per-address limit as best effort, not a security boundary.** It reads\n`request.ip`, which under `trustProxy` comes from the client-supplied\n`X-Forwarded-For` header, and Google's front end appends to that header rather than\nreplacing it. A caller who rotates the value gets a fresh window each request. The\nshared ceiling is the guarantee; the per-address one is there to stop ordinary\nrunaway clients. So the address map is capped at `MAX_ANONYMOUS_IP_BUCKETS` entries:\npast the cap, unseen addresses are limited by the shared ceiling alone, because\notherwise a rotating flood would mint a window per request.\n\nKeyless traffic is metered against a seeded, permanently revoked `anonymous` key row\n(migration `035`), which the usage and audit foreign keys require — run migrations\nbefore enabling the flag.\n\n## Packages\n\n| Path | Package | Role |\n|------|---------|------|\n| `packages/shared` | `@super-mcp/shared` | Types, units, promo math, embeddings, env config, concurrency |\n| `packages/db` | `@super-mcp/db` | Schema, migrations, upserts |\n| `services/ingestion` | `@super-mcp/ingestion` | Cerberus FTP + Shufersal + Carrefour (PublishPrice) + laibcatalog adapters |\n| `services/api` | `@super-mcp/api` | REST + MCP + auth/metering |\n\nSee [docs/folder-conventions.md](https://github.com/nitaiaharoni1/super-mcp/blob/main/docs/folder-conventions.md) for target folder layout and dedup rules.\n\n## REST (v1)\n\n- `GET /v1/products` · `GET /v1/products/:id`\n- `GET /v1/products/:id/prices` — compare nearby (default **10km**); `?sort=unit_price` for cheaper per 100g/ml. Physical branches only, and rows carry `clubOnly` / `couponOnly`\n- `GET /v1/products/similar` — other products the shopper might have meant (`?q=` and/or `?product_id=`)\n- `GET /v1/products/:id/substitutes` — cheaper similar products by unit price\n- `GET /v1/products/:id/history`\n- `GET /v1/chains` · `GET /v1/stores` — returns `{ stores, location }` (not a bare array); `?near=` defaults to **10km** radius. Each store carries `storeKind` (`branch` / `online` / `pickup` / `warehouse`); only `branch` rows are used for basket recommendations\n- `GET /v1/promotions`\n- `POST /v1/delivery/optimize` — shopping-list path: `{items, address|city|near}` ranks storefronts on delivered cost\n- `GET /v1/usage`\n\n## MCP tools\n\n**`/mcp`:** `optimize_delivery` · `list_delivery_options` · `get_delivery_terms` · `search_products` · `get_product` · `suggest_similar_products` · `get_promotions`\n\nShopping lists: call `optimize_delivery` once with `{query, pack_qty}` or `{query, amount, unit}` plus `address` (preferred) / `city` / `near`. Do not search each line first.\n","changelogMarkdown","videoKey","requiredSecretsJson","publishedAt","priceCents","trialDays",0,"iconType","image","upstream",{"_105":106,"_107":108,"_109":110,"_111":112,"_113":114,"_115":116},"requiredSecrets",[],"tags",[100,101,102,103,104],"assets",[],"stats",{"_98":85,"_99":85},"ratingAvg","reviewCount","israel","openapi","postgresql","supermarket","typescript","topics",[100,117,118,101,119,103,104],"license","Apache-2.0","language","TypeScript","registryName","io.github.nitaiaharoni1/super-mcp","homepage","https://supermcp.web.app","packages",[],"mcp","model-context-protocol","postgres","ENV",{"_122":123,"_124":125,"_126":127},"ENVIRONMENT","production","TURNSTILE_SITE_KEY","0x4AAAAAAB8-rEI2gNDf_QhU","SENTRY_DSN","https://45fd1229f78089d5c3ee78be128030e1@o4510583261757440.ingest.de.sentry.io/4510584253448272"]

SuperMCP