@@ -801,19 +801,23 @@ routes/oauth.py, store/oauth.py) answers 401 with a pointer to its
 protected resource metadata (RFC 9728), which names this server as the
 authorization server (RFC 8414). Clients register themselves (RFC 7591,
 public clients only; Claude registers on every new connection, so unused
-registrations are dropped after a day and capped per hour). A Client ID
-Metadata Document isn't supported: Claude falls back to registering when
-the metadata doesn't advertise one. The consent page signs in with the
-user's existing access token, so there's no new credential; it's plain
-HTML with its own CSP, whose `form-action` allows the app's callback
-origin, as Chrome applies `form-action` to the redirect after a POST.
-PKCE is S256 only. Loopback redirect URIs match on any port (RFC 8252),
-as Claude Code picks a free port each time. Access tokens last an hour
-and refresh tokens 30 days; refresh tokens rotate, and one used twice
-revokes its grant (it was copied). A grant remembers the login token the
-user consented with, so revoking that token, **New token** or deleting
-the user ends it too. `PUBLIC_URL`, when set, is the issuer and resource
-URL: behind a proxy the request's own host may not be what clients use.
+registrations are dropped after a day, and capped per hour, per address
+and in all). A Client ID Metadata Document isn't supported: Claude falls
+back to registering when the metadata doesn't advertise one. The consent
+page signs in with the user's existing access token, so there's no new
+credential, and only takes POSTs from its own page (Origin,
+Sec-Fetch-Site), against login CSRF; it's plain HTML with its own CSP,
+whose `form-action` allows the app's callback origin, as Chrome applies
+`form-action` to the redirect after a POST. PKCE is S256 only. Loopback
+redirect URIs match on any port (RFC 8252), as Claude Code picks a free
+port each time. Access tokens last an hour and refresh tokens 30 days;
+refresh tokens rotate, and one used again more than 30 s after its first
+use revokes its grant (it was copied); sooner is a retry or two requests
+refreshing at once, and gets tokens. A grant remembers the login token
+the user consented with, so revoking that token, **New token** or
+deleting the user ends it too. `PUBLIC_URL`, when set, is the issuer and
+resource URL: behind a proxy the request's own host may not be what
+clients use.
 
 **The MCP write tools have no amount cap; the plan is the guard.** A fixed
 cap can't be right for every item (100k mB of a fluid is little, 100k of an
 
@@ -643,7 +643,8 @@ def _app_oauth(conn):
             id TEXT PRIMARY KEY,
             name TEXT NOT NULL,
             redirect_uris TEXT NOT NULL,
-            created_at REAL NOT NULL
+            created_at REAL NOT NULL,
+            created_by_ip TEXT
         )
     """)
     conn.execute("""
 
@@ -158,10 +158,9 @@ def handle(message, headers, user):
         name = params.get("name")
         if not isinstance(name, str):
             return 200, error(msg_id, INVALID_PARAMS, "params.name must be a tool name")
-        try:
-            answer, is_error = tools.call(name, params.get("arguments"), user)
-        except KeyError:
+        if not tools.exists(name):
             return 200, error(msg_id, INVALID_PARAMS, f"Unknown tool: {name}")
+        answer, is_error = tools.call(name, params.get("arguments"), user)
         result = {"content": [{"type": "text", "text": _compact_json(answer)}], "isError": is_error}
     else:
         return (404 if modern else 200), error(msg_id, METHOD_NOT_FOUND, f"Method not found: {method}")
 
@@ -12,13 +12,17 @@
 of several items called alike."""
 
 import datetime
+import logging
+import math
 import time
 
 from gcm import (
     auth, bottlenecks, commands, craft_stats, inventory, item_info, patterns, planner, rates,
     mctext, search, state, stock, store,
 )
 
+log = logging.getLogger(__name__)
+
 
 class ToolError(Exception):
     """A tool call that can't be answered: its message goes back to the
@@ -136,13 +140,14 @@ def _arg(args, name, kind, default=None, choices=None, minimum=None, maximum=Non
         if required:
             raise ToolError(f"{name} is required")
         return None
-    if kind == "integer":
-        if isinstance(value, bool) or not isinstance(value, (int, float)) or value != int(value):
-            raise ToolError(f"{name} must be a whole number")
-        value = int(value)
-    elif kind == "number":
-        if isinstance(value, bool) or not isinstance(value, (int, float)):
+    if kind in ("integer", "number"):
+        # JSON allows 1e400, which Python reads as infinity.
+        if isinstance(value, bool) or not isinstance(value, (int, float)) or not math.isfinite(value):
             raise ToolError(f"{name} must be a number")
+        if kind == "integer":
+            if value != int(value):
+                raise ToolError(f"{name} must be a whole number")
+            value = int(value)
     elif kind == "string":
         if not isinstance(value, str):
             raise ToolError(f"{name} must be a string")
@@ -177,7 +182,7 @@ def _range_arg(choices, default, what):
 
 
 def _rank(item, query):
-    name = (item.get("name") or "").lower()
+    name = mctext.plain(item.get("name") or "").lower()
     q = query.strip().lower()
     if name == q:
         return 0
@@ -211,7 +216,7 @@ def search_items(user, args):
             item_info.mod_name(item.get("mod")), info.get("formula"),
         ):
             found.append(item)
-    found.sort(key=lambda it: (_rank(it, query), len(it.get("name") or ""), -(it.get("size") or 0)))
+    found.sort(key=lambda it: (_rank(it, query), len(mctext.plain(it.get("name") or "")), -(it.get("size") or 0)))
     return {
         "scanned_at": _iso(scanned_at),
         "matches": len(found),
@@ -283,11 +288,14 @@ def inventory_changes(user, args):
     sort = _arg(args, "sort", "string", "biggest", choices=CHANGE_SORTS)
     limit = _arg(args, "limit", "integer", 25, minimum=1, maximum=100)
     range_key, changes = inventory.changes(range_key)
-    sizes, _, _ = inventory.stock_levels()
+    # One pass over the snapshot: looking each item up would go through
+    # all of it again for every changed item.
+    with state.network_lock:
+        by_key = {store.items.key_of(it): it for it in state.network["items"]}
     rows = []
     for key, change in changes.items():
-        item = _network_item(key)
-        now = sizes.get(key, 0)
+        item = by_key.get(key)
+        now = (item.get("size") or 0) if item else 0
         delta = now - change["from"]
         if (sort == "falling" and delta >= 0) or (sort == "rising" and delta <= 0):
             continue
@@ -688,6 +696,13 @@ def cancel_craft(user, args):
         except ValueError:
             raise ToolError("job_id must be the job_id current_crafts gave for this CPU") from None
         shown = {"mod": parts[0] or None, "internal": parts[1], "damage": damage}
+    if shown is None:
+        # Without it, a CPU that moved on to another job since the user
+        # agreed would have that one cancelled instead.
+        with state.crafts_lock:
+            job = next((j for j in state.crafts["jobs"] if j.get("name") == cpu), None)
+        if job is not None and job.get("busy") and _job_id(job):
+            raise ToolError("Pass the job_id current_crafts gave for this CPU, so only that job is cancelled.")
     req_id, error = commands.request_cancel(user["id"], cpu, shown)
     if error:
         raise ToolError(error[0])
@@ -700,6 +715,10 @@ def cancel_craft(user, args):
 def request_status(user, args):
     req_id = _arg(args, "request_id", "integer", required=True)
     kind = _arg(args, "type", "string", "craft", choices=("craft", "cancel"))
+    # A request the game never picked up is only marked failed when its
+    # queue is next looked at (the game's poll, the page): look now.
+    queue = commands.craft_requests if kind == "craft" else commands.cancel_requests
+    queue.select(lambda r: False)
     found = store.requests.find(kind, req_id, user["id"])
     if found is None:
         raise ToolError(f"You have no {kind} request with that id.")
@@ -962,7 +981,10 @@ def request_status(user, args):
         ),
         "inputSchema": _schema({
             "cpu": {"type": "string", "description": "A CPU name from current_crafts."},
-            "job_id": {"type": "string", "description": "The job_id current_crafts gave for that CPU's job."},
+            "job_id": {"type": "string", "description": (
+                "The job_id current_crafts gave for that CPU's job. Required unless current_crafts "
+                "gave none (the CPU has no Crafting Monitor)."
+            )},
         }, ["cpu"]),
         "annotations": GAME_CHANGES,
         "operator": True,
@@ -983,12 +1005,15 @@ def listing(user):
     ]
 
 
+def exists(name):
+    return name in _BY_NAME
+
+
 def call(name, args, user):
-    """Runs a tool for a user. Returns (result, is_error): result is the
-    tool's JSON-able answer, or an error message for the model."""
-    tool = _BY_NAME.get(name)
-    if tool is None:
-        raise KeyError(name)
+    """Runs a tool (exists(name)) for a user. Returns (result, is_error):
+    result is the tool's JSON-able answer, or an error message for the
+    model."""
+    tool = _BY_NAME[name]
     if args is None:
         args = {}
     if not isinstance(args, dict):
@@ -1000,3 +1025,8 @@ def call(name, args, user):
         return _compact_numbers(tool["handler"](user, args)), False
     except ToolError as e:
         return str(e), True
+    except Exception:
+        # A bug, not the model's mistake: logged, and the model told so
+        # rather than the client getting a 500 it can't read.
+        log.exception("MCP tool %s failed", name)
+        return "The server hit an error running this tool. Its log has the details.", True
@@ -90,7 +90,7 @@ def register():
         name = urlsplit(uris[0]).hostname or "An app"
     name = " ".join(name.split())[: oauth.MAX_CLIENT_NAME]
 
-    client_id = store.oauth.create_client(name, uris)
+    client_id = store.oauth.create_client(name, uris, request.remote_addr)
     if client_id is None:
         return jsonify({"error": "temporarily_unavailable",
                         "error_description": "too many registrations; try again later"}), 429
@@ -248,9 +248,22 @@ def authorize_get():
     return _consent_page(params, client, auth.session_user())
 
 
+def _from_this_site():
+    """Whether a form POST came from this server's own pages. Browsers
+    send Origin on every cross-site POST (Sec-Fetch-Site too): without
+    this, another site could post a sign-in with its own token and sign
+    the visitor in as someone else."""
+    origin = request.headers.get("Origin")
+    if origin is not None and origin != request.host_url.rstrip("/"):
+        return False
+    return request.headers.get("Sec-Fetch-Site") in (None, "same-origin", "none")
+
+
 @bp.route("/oauth/authorize", methods=["POST"])
-@auth.custom_check  # signing in needs no session; allowing checks it and the form value
+@auth.custom_check  # same-site only; signing in needs no session, allowing checks it and the form value
 def authorize_post():
+    if not _from_this_site():
+        return _error_page("This form has to be sent from this server's own page.", 403)
     params, client, error = _authorize_request(request.form)
     if error and error[1] is None:
         return _error_page(error[0])
 
@@ -23,6 +23,7 @@
 before asking again."""
 
 import logging
+import math
 import time
 
 from gcm import charts, commands, config, icons, push, state, store, webhooks
@@ -141,7 +142,9 @@ def rule_key(item):
 
 
 def _positive(value):
-    return not isinstance(value, bool) and isinstance(value, (int, float)) and value > 0
+    # Finite too: JSON's 1e400 reads as infinity, which a refill would
+    # then ask the game for.
+    return not isinstance(value, bool) and isinstance(value, (int, float)) and math.isfinite(value) and value > 0
 
 
 def _network_item(key):
 
@@ -19,33 +19,40 @@
 
 # Clients are made by anyone who asks (RFC 7591: Claude registers on every
 # new connection), so ones never used for a grant are dropped after a day,
-# and only so many may be made in an hour.
+# and only so many may be made in an hour: per address, so one script
+# can't use up everyone's, and in all, as a backstop.
 UNUSED_CLIENT_SECONDS = 86400
-CLIENTS_PER_HOUR = 200
+CLIENTS_PER_HOUR_PER_IP = 30
+CLIENTS_PER_HOUR = 2000
+# A refresh token used again this soon after its first use is a client
+# retrying, or two requests refreshing at once, not a copy: it gets new
+# tokens instead of revoking the grant.
+REFRESH_REUSE_GRACE_SECONDS = 30
 
 ACCESS_PREFIX = "gcmat_"
 REFRESH_PREFIX = "gcmrt_"
 
 
-def create_client(name, redirect_uris):
-    """Registers a client; returns its id, or None when too many were
-    registered in the last hour."""
+def create_client(name, redirect_uris, ip=None):
+    """Registers a client for a request from ip; returns its id, or None
+    when too many were registered in the last hour."""
     now = time.time()
     with db.transaction(db.app_db) as conn:
         conn.execute(
             "DELETE FROM oauth_clients WHERE created_at < ? "
             "AND id NOT IN (SELECT client_id FROM oauth_grants)",
             (now - UNUSED_CLIENT_SECONDS,),
         )
-        recent = conn.execute(
-            "SELECT COUNT(*) FROM oauth_clients WHERE created_at > ?", (now - 3600,)
-        ).fetchone()[0]
-        if recent >= CLIENTS_PER_HOUR:
+        recent, from_ip = conn.execute(
+            "SELECT COUNT(*), COALESCE(SUM(created_by_ip IS ?), 0) FROM oauth_clients WHERE created_at > ?",
+            (ip, now - 3600),
+        ).fetchone()
+        if recent >= CLIENTS_PER_HOUR or from_ip >= CLIENTS_PER_HOUR_PER_IP:
             return None
         client_id = f"gcmc_{secrets.token_hex(16)}"
         conn.execute(
-            "INSERT INTO oauth_clients (id, name, redirect_uris, created_at) VALUES (?, ?, ?, ?)",
-            (client_id, name, json.dumps(redirect_uris), now),
+            "INSERT INTO oauth_clients (id, name, redirect_uris, created_at, created_by_ip) VALUES (?, ?, ?, ?, ?)",
+            (client_id, name, json.dumps(redirect_uris), now, ip),
         )
     return client_id
 
@@ -137,8 +144,9 @@ def create_grant(code_details):
 
 def refresh(refresh_token, client_id):
     """New tokens for a refresh token, which is used up. A refresh token
-    used a second time means it was copied: the whole grant is revoked.
-    None when it can't be used."""
+    used again later than REFRESH_REUSE_GRACE_SECONDS after its first
+    use means it was copied: the whole grant is revoked. None when it
+    can't be used."""
     if not isinstance(refresh_token, str) or not refresh_token.startswith(REFRESH_PREFIX):
         return None
     now = time.time()
@@ -154,14 +162,15 @@ def refresh(refresh_token, client_id):
         if not row or row[3] != client_id:
             return None
         grant_id, expires_at, used_at, _, revoked_at, disabled_at = row
-        if used_at is not None:
+        if used_at is not None and now - used_at > REFRESH_REUSE_GRACE_SECONDS:
             conn.execute(
                 "UPDATE oauth_grants SET revoked_at = ? WHERE id = ? AND revoked_at IS NULL", (now, grant_id)
             )
             return None
         if expires_at <= now or revoked_at is not None or disabled_at is not None:
             return None
-        conn.execute("UPDATE oauth_tokens SET used_at = ? WHERE token_hash = ?", (now, hash_secret(refresh_token)))
+        if used_at is None:
+            conn.execute("UPDATE oauth_tokens SET used_at = ? WHERE token_hash = ?", (now, hash_secret(refresh_token)))
         return _issue(conn, grant_id, now)
 
 
 
@@ -216,6 +216,19 @@ def test_not_json_rpc(self, client, token):
         assert post(client, token, {"hello": 1}).status_code == 400
         assert post(client, token, [{"jsonrpc": "2.0", "id": 1, "method": "ping"}]).status_code == 400
 
+    def test_a_bug_in_a_tool_is_a_tool_error_not_a_500(self, client, token, monkeypatch):
+        def broken(user, args):
+            return {}["missing"]
+
+        monkeypatch.setitem(tools._BY_NAME["current_crafts"], "handler", broken)
+        answer, is_error = call(client, token, "current_crafts")
+        assert is_error and "server hit an error" in answer
+
+    def test_infinite_numbers_are_refused(self, client, token):
+        # 1e400 in JSON is infinity to Python.
+        answer, is_error = call(client, token, "search_items", query="x", limit=float("inf"))
+        assert is_error and answer == "limit must be a number"
+
     def test_bad_arguments_come_back_as_tool_errors(self, client, token):
         assert call(client, token, "search_items") == ("query is required", True)
         assert call(client, token, "search_items", query="x", bogus=1) == ("unknown argument(s): bogus", True)
@@ -246,6 +259,14 @@ def test_search_ranks_the_closest_names_first(self, client, token, network):
                                      "unit": "items", "craftable": True}
         assert ok(client, token, "search_items", query="iron plate")["items"][0]["name"] == "Iron Plate"
 
+    def test_search_ranks_by_the_name_without_colour_codes(self, client, token, api_headers):
+        run_scan(client, api_headers, [[
+            {"name": "Infinity Catalyst Dust", "mod": "gregtech", "internal": "dust", "damage": 1, "size": 1},
+            {"name": "\u00a76Infinity Catalyst", "mod": "gregtech", "internal": "ingot", "damage": 1, "size": 1},
+        ]])
+        found = ok(client, token, "search_items", query="infinity catalyst")
+        assert found["items"][0]["name"] == "Infinity Catalyst"
+
     def test_search_filters(self, client, token, network):
         assert ok(client, token, "search_items", query="ingot", craftable_only=True)["matches"] == 1
         assert ok(client, token, "search_items", query="@gregtech")["items"][0]["name"] == "Iron Plate"