USPTO Final Petition Decisions MCP Server

A high-performance Model Context Protocol (MCP) server for the USPTO Final Petition Decisions API with token-saving context reduction capabilities, user-customizable fields, and cross-MCP integration for complete patent lifecycle analysis.

📚 Documentation

Related MCP server: USPTO Patent Citation MCP Server

⚡Quick Start

Windows Install

Run PowerShell as Administrator, then:

# Navigate to your user profile
cd $env:USERPROFILE

# If git is installed:
git clone https://github.com/john-walkoe/uspto_fpd_mcp.git
cd uspto_fpd_mcp

# If git is NOT installed:
# Download and extract the repository to C:\Users\YOUR_USERNAME\uspto_fpd_mcp
# Then navigate to the folder:
# cd C:\Users\YOUR_USERNAME\uspto_fpd_mcp

# The script detects if uv is installed and if it is not it will install uv - https://docs.astral.sh/uv

# Run setup script (sets execution policy for this session only):
Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope Process
.\deploy\windows_setup.ps1

## View INSTALL.md for sample script output.
# Close Powershell Window.
# If choose option to "configure Claude Desktop integration" during the script then restart Claude Desktop

The PowerShell script will:

• ✅ Check for and auto-install uv (via winget or PowerShell script)

• ✅ Install dependencies and create executable

• ✅ Prompt for USPTO API key (required) and Mistral API key (optional) or Detect if you had installed the developer's other USPTO MCPs and ask if want to use existing keys from those installation.

• 🔒 If entering in API keys, the script will automatically store API keys securely using Windows DPAPI encryption

• ✅ Ask if you have USPTO PFW MCP already installed, and if so will used the USPTO PFW MCP's default centralized proxy

• ✅ Ask if you want Claude Desktop integration configured

• 🔒 Offer secure configuration method (recommended) or traditional method (API keys in plain text in the MCP JSON file)

• ✅ Backups and then automatically merge with existing Claude Desktop config (preserves other MCP servers)

• ✅ Provide installation summary and next steps

Claude Desktop Configuration - Manual installs

{
  "mcpServers": {
    "uspto_fpd": {
      "command": "uv",
      "args": [
        "--directory",
        "C:/Users/YOUR_USERNAME/uspto_fpd_mcp",
        "run",
        "fpd-mcp"
      ],
      "env": {
        "USPTO_API_KEY": "your_actual_USPTO_api_key_here",
        "MISTRAL_API_KEY": "your_mistral_api_key_here_OPTIONAL",
        "MISTRAL_OCR_MODEL": "mistral-ocr-latest_OPTIONAL_pin_a_dated_slug",
        "CENTRALIZED_PROXY_PORT": "none",
        "FPD_PROXY_PORT": "8081"
      }
    }
  }
}

Proxy Configuration Notes:

• CENTRALIZED_PROXY_PORT:

  • Set to "none" for standalone use (not recommended)

  • Set to 8080 When USPTO PFW MCP is installed and PFW is using its default port for the local proxy. (If PFW is not using its default port change this value to match)

• FPD_PROXY_PORT: Local proxy port (default: 8081, avoids conflict with PFW on 8080)

  • Only used in standalone mode (no PFW MCP detected)

  • When PFW MCP is installed, FPD automatically uses PFW's centralized proxy (port 8080), but will fall back to FPD's local proxy port

  • Centralized Proxy Benefits: Single port for all USPTO MCPs, 7-day persistent links, unified rate limiting

🚀 FastMCP 4.0

The server runs on FastMCP 4.0.1 (fastmcp[apps]>=4.0.0,<5.0.0) over the MCP Python SDK 2.x, speaking MCP protocol revision 2026-07-28. It ships MCP Apps (petition search cards + recent-downloads panel render as iframes in Claude Desktop), progress notifications during document extraction, 7-day persistent download links, dual STDIO/HTTP transport, and a Dockerfile for containerized deployment.

Environment variables:

Response-size markers

Tool responses are measured in characters (len(json.dumps(...))), not token estimates, because an oversized result is replaced client-side with a truncation error the server never sees. Every search envelope carries a paging block (limit_requested, limit_applied, offset, returned, total, has_more, next_offset). Three further markers appear only when they applied and are absent entirely on a no-op:

FPD_get_guidance(section="limits") prints the live budgets and this marker contract at runtime.

Testing: see tests/TEST_SUITE.md for the manual end-to-end suite; automated tests via plain uv run pytest (the key-management/storage tests that touch real encrypted key storage are excluded via addopts in pyproject.toml and additionally gated by FPD_RUN_KEY_TESTS=1).

🔑 Key Features

• ⚙️User-Customizable Fields - Configure field sets through YAML without code changes

• 🎯Context Reduction - Get focused responses instead of massive API dumps (80-99% reduction)

• 📊Progressive Disclosure Strategy - Minimal discovery → Balanced analysis → Document extraction

• 🔍Petition-Type Focused Search - Specialized tools for art unit and application-specific searches

• ✨Intelligent Document Extraction - Auto-optimized hybrid extraction (native pypdf text layer → OCR fallback for scanned pages) with secure browser downloads

• 🆕Centralized Proxy Integration - Auto-detects PFW MCP and uses unified proxy (port 8080) for persistent links and cross-MCP downloads

• 🌐Secure Browser Downloads - Click proxy URLs to download PDFs directly while keeping API keys secure

• 👁️Advanced OCR Capabilities - Extract text from scanned PDFs using Mistral OCR when needed

• 📁 Document Bag Integration - Full petition document access alongside structured petition data

• Extraction Method Transparency - Reports which extraction method was used for every document

• 🔐 Secure API Key Storage - Optional Windows DPAPI encryption keeps API keys secure (no plain text in config files)

• 🚀High Performance - Retry logic with exponential backoff, rate limiting compliance

• 🛡️ Production Ready - Enhanced error handling, structured logging with request IDs, comprehensive security guidelines

• 💻Cross-Platform - Works seamlessly on Linux and Windows

• 📋Complete API Coverage - All USPTO Final Petition Decisions endpoints supported

• 🔗Cross-MCP Integration - Seamless integration with Patent File Wrapper and PTAB MCPs for complete lifecycle analysis

Workflow Design - All Performed by the LLM with Minimal User Guidance

User Requests the following:

• "Find all petitions filed by TechCorp and tell me about any red flags"

• "Show me revival petitions for art unit 2128 - I'm analyzing abandonment patterns"

• "Get me the petition history for application 17414168"

• "Research this company's petition track record and correlate with their PTAB challenges" - * Requires that the USPTO Patent Trial and Appeal Board (PTAB) be installed - uspto_ptab_mcp and also recommended to ask LLM to perform a FPD_get_guidance tool call prior to this or any cross MCP prompt (see quick reference chart for section selection, additional details in Usage Examples)

• "Analyze this art unit's prosecution quality by looking at petition frequency and types"

LLM Performs these steps:

Step 1: Discovery (Minimal) → Step 2: Selection and Analysis (Balanced - Optional) → Step 3: Detailed Petition Review → Step 4 (Optional): Select specific petition documents for examination → Step 5 (Optional): Retrieve document_id(s) from documentBag → Step 6 (Optional): Document Extraction for LLM use and/or Download Links of PDFs for user's use

The field configuration supports an optimized research progression:

1. Discovery (Minimal) returns 50-100 petitions efficiently without document bloat

2. Selection and Analysis (Balanced - Optional) from the retrieved select likely petition(s). Optional balanced search(es) performed if needed in advanced workflows and/or cross-MCP workflows with Patent File Wrapper or PTAB

3. Detailed Petition Review via FPD_Get_petition_details for selected petitions with complete structured data for LLM's use in analysis

4. Select specific petition documents for examination (Optional) e.g. Decision letters, petition filings, supporting evidence

5. Retrieve document_id(s) from documentBag (Optional) use FPD_Get_petition_details with include_documents=True to get the document_id(s)

6. Document Extraction for LLM use and/or Download Links (Optional) Document extraction via intelligent hybrid tool that auto-optimizes for speed and quality, and Downloads of the documents as PDFs uses URLs from an HTTP proxy that obscures the USPTO's API key from chat history

🎯 Prompt Templates

This MCP server includes sophisticated AI-optimized prompt templates for complex petition workflows. Prompt templates are opt-in server-side: they register only when the server is started with FPD_ENABLE_PROMPTS=true (default off - no prompts are advertised). For detailed documentation on all templates, features, and usage examples, see PROMPTS.md.

Quick Template Overview

Key Features Across All Templates:

• Enhanced Input Processing - Flexible identifier support (petition IDs, application numbers, company names)

• Smart Validation - Automatic format detection and guidance

• Cross-MCP Integration - Seamless workflows with PFW, PTAB, and Citations MCPs

• Context Optimization - Token reduction through progressive disclosure

📊 Available Functions

Search Functions (4 Focused Tools)

Search Strategies

Specialized Search Strategies

• Art Unit Quality Assessment - Use FPD_Search_petitions_by_art_unit to analyze petition patterns across art units for examiner behavior and technology difficulty assessment

• Application Petition History - Use FPD_Search_petitions_by_application to get complete petition timeline for specific applications during prosecution

• Cross-MCP Integration - Link petition data with PFW prosecution history using applicationNumberText and PTAB challenges using patentNumber

• Red Flag Identification - Focus on revival petitions (37 CFR 1.137), examiner disputes (37 CFR 1.181), and denied decisions for prosecution quality analysis

Query Examples

# Art unit quality assessment
FPD_Search_petitions_by_art_unit(
    art_unit="2128",
    date_range="2020-01-01:2024-12-31",
    limit=100
)

# Complete application petition history
FPD_Search_petitions_by_application(
    application_number="17414168",
    include_documents=False
)

# Cross-MCP workflow example
# 1. Find applications with PFW
# 2. Check petition history for red flags
FPD_Search_petitions_by_application(
    application_number=app_from_pfw,
    include_documents=True
)

Document Processing Functions

Document Processing Capabilities

• Petition Details Tier (FPD_Get_petition_details): Complete petition data retrieval

  • UUID-based lookup - Find petition by unique identifier

  • Optional document bag - Include/exclude documents based on need

  • LLM-optimized parsing - Extracts issues, rules cited, statutes, decision details

  • Cross-reference fields - applicationNumberText, patentNumber, groupArtUnitNumber for cross-MCP workflows

• Intelligent Extraction Tier (FPD_get_document_content_with_ocr): Hybrid auto-optimized extraction

  • Capability-ordered tiers - Reads the PDF's native text layer with pypdf first; falls back to OCR only for pages that have no usable text layer

  • Quality detection - Automatically determines whether the native text layer is usable or the page needs OCR

  • Two OCR backends - Mistral OCR (MISTRAL_API_KEY, optional) or a self-hosted Docling backend such as docling-serve (DOCLING_SERVE_URL); either is sufficient, neither is required for text-layer PDFs

  • Transparent reporting - extraction_method names the tier that produced the text (pypdf, Mistral OCR (...), or Docling (docling-serve))

  • Unified interface - Single tool handles all document types (eliminates tool confusion)

  • Speed - Instant for text-layer PDFs; OCR of scanned documents is slower per page

• Browser Download Tier (FPD_get_document_download): Secure proxy downloads with enhanced filenames

  • Click-to-download URLs that work directly in any browser

  • Centralized proxy integration - If set up, auto-detects PFW MCP and uses unified proxy (port 8080) for all USPTO documents downloads, will fall back to local proxy if issues detected with centralized proxy.

    • Persistent links - 7-day encrypted links when using PFW centralized proxy (work across MCP restarts)

    • Unified architecture - Single HTTP proxy (port 8080) for all USPTO MCPs when PFW installed

    • Standalone fallback - Local proxy (port 8081) when PFW not detected

  • Enhanced filenames - Professional format with petition date, app/patent numbers, and description

    • Format: PET-2013-09-10_APP-13632078_PAT-8803593_PATENT_PROSECUTION_HIGHWAY_DECISION.pdf

    • Chronological sorting by petition filing date

    • Instant context for patent attorneys and file management

  • API key security - USPTO credentials never exposed in chat history or browser

  • Rate limiting compliance - Automatic enforcement of USPTO's 5 downloads per 10 seconds

LLM Guidance Function

Admin Function (OAuth deployments only)

• Context-Efficient Guidance System

  FPD_get_guidance Tool - Solves MCP Resources visibility problem with selective guidance sections:

🎯 Quick Reference Chart - What section for your question?

​ 🔍 "Find petitions by company/art unit" → tools

​ 🚩 "Identify petition red flags" → red_flags

​ 📄 "Download petition documents" → documents

​ 🤝 "Correlate petitions with prosecution" → workflows_pfw

​ ⚖️ "Analyze petition + PTAB patterns" → workflows_ptab

​ 📊 "Citation quality + petition correlation" → workflows_citations

​ 🏢 "Complete portfolio due diligence" → workflows_complete

​ 📚 "Research CFR rules with Assistant" → workflows_assistant

​ 🎯 "Ultra-minimal PFW + FPD workflows" → ultra_context

​ "Choose an extraction approach" → extraction

​ 📏 "Why was my response truncated / how do I page it?" → limits

​ 🗓️ "Why did an old petition return zero results?" → coverage

The tool provides specific workflows, field recommendations, API call optimization strategies, anti-patterns to avoid, and cross-MCP integration patterns for maximum efficiency. See USAGE_EXAMPLES.md for detailed examples and integration workflows.

💻 Usage Examples & Integration Workflows

For comprehensive usage examples, including:

• Basic petition searches (company, type, outcome)

• Art unit quality assessment (petition frequency, types, examiner disputes)

• Application petition history (complete lifecycle tracking)

• Cross-MCP integration workflows (FPD + PFW + PTAB + Pinecone)

• Red flag identification (revival petitions, examiner disputes, denied petitions)

• Document extraction and downloads (hybrid pypdf text-layer / OCR approach)

• Extraction strategy guidance

See the detailed USAGE_EXAMPLES.md documentation.

🔧 Field Customization

The MCP server supports user-customizable field sets through YAML configuration for optimal context reduction. You can modify field sets without changing any code!

Configuration file: field_configs.yaml (in project root)

For complete customization guidance, including progressive workflow strategies, token optimization, and advanced field selection patterns, see CUSTOMIZATION.md.

🔗 Cross-MCP Integration

This MCP is designed to work seamlessly with other USPTO MCPs and knowledge bases for comprehensive patent lifecycle analysis:

Related USPTO MCP Servers

Integration Overview

The Final Petition Decisions (FPD) MCP bridges prosecution and post-grant challenges, tracking procedural petitions that reveal prosecution quality issues. When combined with the other MCPs, it enables:

• FPD + PFW: Understand petition context by cross-referencing with prosecution history

• FPD + PFW + Enhanced Citations: Correlate petition patterns with examiner citation quality for comprehensive prosecution assessment (Oct 2017+ applications)

• FPD + PTAB: Correlate petition red flags with post-grant challenge outcomes

• PFW + FPD + PTAB: Complete patent lifecycle tracking from filing through post-grant challenges

• PFW + FPD + Enhanced Citations: Art unit quality assessment with citation intelligence and petition pattern analysis

• FPD + Pinecone (Assistant or RAG): Research MPEP guidance and petition standards before pulling full document text

Key Integration Patterns

Cross-Referencing Fields:

• applicationNumberText - Primary key linking petitions to PFW prosecution and Enhanced Citations

• patentNumber - Secondary key linking granted patents to PTAB challenges

• groupArtUnitNumber - Art unit analysis across all MCPs (FPD, PFW, Enhanced Citations, PTAB)

• firstApplicantName - Party matching across MCPs

• examinerCitedReferenceIndicator (Citations MCP) - Examiner vs applicant citation analysis for petition quality correlation

Progressive Workflow:

1. Discovery (FPD): Find petitions using minimal search

2. Prosecution Context (PFW): Cross-reference petition applications with prosecution history

3. Citation Intelligence (Enhanced Citations): Analyze examiner citation quality for applications with petitions (Oct 2017+ only)

4. Challenge Assessment (PTAB): Check if patents with petition red flags faced post-grant challenges

5. Knowledge Research (RAG): Research MPEP petition guidance if available

6. Detailed Analysis (FPD): Extract petition documents for Director's reasoning

7. Risk Scoring: Quantify prosecution quality based on petition patterns, citation quality, and outcomes

For detailed integration workflows, cross-referencing examples, and complete use cases, see USAGE_EXAMPLES.md.

🆕Centralized Proxy Integration (PFW + FPD)

When both PFW and FPD MCPs are installed, FPD automatically integrates with PFW's centralized proxy for unified document management:

Architecture Benefits:

• Single Port - One HTTP server (port 8080) for all USPTO document downloads

• Persistent Links - 7-day encrypted links via PFW's SQLite database (work across MCP restarts)

• Unified Rate Limiting - Shared USPTO limits (5 requests/10 seconds) across all MCPs

• Cross-MCP Caching - PFW caches documents from all USPTO MCPs for faster access

• Automatic Detection - FPD detects PFW at startup and switches to centralized mode

How It Works:

1. FPD extracts PDF download URL from USPTO API response

2. FPD generates enhanced filename: PET-{date}_APP-{app}_PAT-{patent}_{description}.pdf

3. FPD registers document with PFW: POST /register-fpd-document (includes enhanced filename)

4. PFW stores metadata in database (petition_id, download_url, api_key, enhanced_filename)

5. FPD returns download link: http://localhost:8080/download/{petition_id}/{doc_id}

6. User clicks link → PFW fetches from USPTO → streams PDF with enhanced filename

7. Link persists for 7 days and works across MCP restarts

Standalone Mode:

• Without PFW: FPD uses local proxy (port 8081) for immediate session-based downloads

• Enhanced filenames still work (same generation logic used locally)

• Graceful fallback ensures FPD works independently with full filename functionality

📈 Performance Comparison

🧪 Testing

Automated Suite

uv run pytest

Runs offline (network boundaries are mocked). The live-API tests in tests/test_integration.py skip automatically unless USPTO_API_KEY is set, and the key-management/storage tests that touch real encrypted key storage are excluded via addopts in pyproject.toml (gated by FPD_RUN_KEY_TESTS=1).

Core Tests (Essential)

With uv (Recommended):

# Test core functionality and field configuration
uv run python tests/test_basic.py

# Expected: ALL TESTS PASSED!

With traditional Python:

python tests/test_basic.py

Expected Outputs

test_basic.py:

[OK] Settings imported successfully
[OK] FieldManager imported successfully
[OK] FPDClient initialized successfully
ALL TESTS PASSED!

See tests/README.md for comprehensive testing guide.

📁 Project Structure

uspto_fpd_mcp/
├── field_configs.yaml             # Root-level field customization
├── .security/                      # Commit-time security scanning components
│   ├── prompt_injection_detector.py     # Base prompt injection detection
│   ├── fpd_prompt_injection_detector.py # FPD-specific detection patterns
│   └── check_prompt_injections.py # Standalone scanning script (pre-commit hook)
├── src/
│   └── fpd_mcp/
│       ├── main.py                 # Composition root: FastMCP server, 9 tools (8 registered by default; FPD_manage_users needs FPD_ENABLE_USER_MANAGEMENT), OAuth wiring
│       ├── __main__.py            # Entry point for -m execution
│       ├── runtime.py             # Settings/logging bootstrap + service singletons
│       ├── server_bootstrap.py    # Transport startup + proxy lifecycle
│       ├── middleware.py          # HTTP auth / security-header middleware
│       ├── validators.py          # Input validation (petition IDs, dates, identifiers)
│       ├── shared_secure_storage.py # Cross-MCP encrypted API key storage
│       ├── tools/                 # Tool implementations (registered by main.py)
│       │   ├── petitions.py       # 5 search/details tools
│       │   ├── documents.py       # Download + content-extraction tools
│       │   ├── guidance.py        # FPD_get_guidance
│       │   └── admin.py           # FPD_manage_users (registration-gated)
│       ├── config/
│       │   ├── field_manager.py   # Configuration management
│       │   ├── settings.py        # Environment configuration
│       │   ├── tool_reflections.py # Sectioned LLM guidance (80-95% token reduction)
│       │   ├── log_config.py      # Logging setup (sanitizing filter on every handler)
│       │   ├── api_constants.py   # API configuration constants
│       │   ├── feature_flags.py
│       │   └── storage_paths.py    # Storage path management
│       ├── prompts/               # 10 prompt templates (opt-in via FPD_ENABLE_PROMPTS)
│       ├── api/
│       │   ├── fpd_client.py      # FPD API client (retries, circuit breakers, cache)
│       │   ├── docling_client.py  # Self-hosted Docling OCR client
│       │   └── field_constants.py # Field name constants
│       ├── proxy/
│       │   ├── server.py          # HTTP proxy for secure downloads
│       │   ├── secure_link_cache.py # 7-day encrypted persistent links
│       │   ├── centralized_integration.py # PFW centralized-proxy mode
│       │   └── rate_limiter.py    # USPTO rate limiting compliance
│       ├── auth/                  # OAuth 2.1 provider (Google + Entra dual IdP)
│       ├── shared/
│       │   ├── injection_scan.py  # Runtime detection-only injection scanner + provenance note
│       │   ├── error_utils.py     # Error handling utilities
│       │   ├── circuit_breaker.py # Circuit breaker pattern
│       │   ├── internal_auth.py   # Internal authentication
│       │   ├── log_sanitizer.py   # Sink-level log sanitization
│       │   ├── uspto_shared_rate_limiter.py # Cross-process shared rate limiter
│       │   ├── structured_logging.py
│       │   └── security_logger.py # Security event logging
│       ├── services/
│       │   ├── fpd_service.py     # Core business logic layer
│       │   └── document_extraction.py # pypdf -> Mistral OCR -> Docling pipeline
│       ├── ui/                    # MCP App HTML view resources
│       └── util/
│           ├── database.py
│           ├── identity.py        # Per-caller viewer keys for the downloads page
│           └── secure_logger.py   # Secure logging functionality
├── deploy/
│   ├── linux_setup.sh            # Linux deployment script
│   ├── windows_setup.ps1         # PowerShell deployment script
│   ├── manage_api_keys.ps1       # API key management utilities
│   ├── Validation-Helpers.psm1   # PowerShell validation module
│   └── Validation-Helpers.sh     # Bash validation helpers
├── docs/
│   └── CONTENT_PROVENANCE.md     # Retrieved-text handling / provenance posture
├── tests/                         # Automated pytest suite (see tests/README.md)
│   ├── conftest.py               # mock_runtime fixture (mocked client, real service layer)
│   ├── test_basic.py             # Core functionality test
│   ├── test_integration.py       # Live-API tests (skip without USPTO_API_KEY)
│   ├── test_injection_scan.py    # Runtime injection-scan unit + wiring tests
│   ├── TEST_SUITE.md             # Manual end-to-end suite
│   └── README.md                 # Testing documentation
├── reference/
│   ├── Document_Descriptions_List.csv
│   ├── FinalPetitionDecisions_swagger.yaml
│   ├── petition-decision-schema.json
│   └── README.md
├── documentation_photos/          # Visual documentation
├── pyproject.toml                 # Package configuration
├── README.md                      # This file
├── INSTALL.md                     # Comprehensive installation guide
├── USAGE_EXAMPLES.md             # Function examples and workflows
├── CUSTOMIZATION.md              # Field configuration and optimization guide
├── PROMPTS.md                    # Prompt templates documentation
├── SECURITY_GUIDELINES.md        # Security best practices
├── SECURITY_SCANNING.md          # Automated secret detection guide
└── LICENSE                       # MIT License

🔍 Troubleshooting

Common Issues

API Key Issues

• For Claude Desktop: API keys in config file are sufficient

• For test scripts: Environment variables must be set

Setting USPTO API Key:

• Windows Command Prompt: set USPTO_API_KEY=your_key

• Windows PowerShell: $env:USPTO_API_KEY="your_key"

• Linux/macOS: export USPTO_API_KEY=your_key

Setting Mistral API Key (for OCR):

• Windows Command Prompt: set MISTRAL_API_KEY=your_key

• Windows PowerShell: $env:MISTRAL_API_KEY="your_key"

• Linux/macOS: export MISTRAL_API_KEY=your_key

uv vs pip Issues

• uv advantages: Better dependency resolution, faster installs

• Mixed installation: Can use both uv sync and pip install -e .

• Testing: Use uv run prefix for uv-managed projects

Fields Not Returning Data

• Cause: Field name not in YAML config

• Solution: Edit field_configs.yaml to include desired fields

Authentication Errors

• Cause: Missing or invalid API key

• Solution: Verify USPTO_API_KEY environment variable or Claude Desktop config

MCP Server Won't Start

• Cause: Missing dependencies or incorrect paths

• Solution: Re-run setup script, restart all PowerShell windows, restart Claude Desktop (or other MCP Client) and verify configuration

• If problems persist: Reset the MCP installation (see "Resetting MCP Installation" below)

Virtual Environment Issues (Windows Setup)

• Symptom: "No pyvenv.cfg file" errors during windows_setup.ps1

• Cause: Claude Desktop locks .venv files when running, preventing proper virtual environment creation

• Solution:

  1. Close Claude Desktop completely before running setup script

  2. Remove .venv folder: Remove-Item ./.venv -Force -Recurse -ErrorAction SilentlyContinue

  3. Run .\deploy\windows_setup.ps1 again

Resetting MCP Installation

If you need to completely reset the MCP installation to run the Windows Quick installer again:

# Navigate to the project directory
cd C:\Users\YOUR_USERNAME\uspto_fpd_mcp

# Remove Python cache directories
Get-ChildItem -Path ./src -Directory -Recurse -Force | Where-Object { $_.Name -eq '__pycache__' } | Remove-Item -Recurse -Force

# Remove virtual environment
if (Test-Path ".venv") {
    Remove-Item ./.venv -Force -Recurse -ErrorAction SilentlyContinue
}

# Remove database files (if any)
Remove-Item ./proxy_documents.db -Force -ErrorAction SilentlyContinue
Remove-Item ./petition_links.db -Force -ErrorAction SilentlyContinue

# Now you can run the setup script again
.\deploy\windows_setup.ps1

Linux/macOS Reset:

# Navigate to the project directory
cd ~/uspto_fpd_mcp

# Remove Python cache directories
find ./src -type d -name '__pycache__' -exec rm -rf {} + 2>/dev/null || true

# Remove virtual environment and database files
rm -rf .venv
rm -f proxy_documents.db petition_links.db

# Run setup script again
./deploy/linux_setup.sh

Getting Help

1. Check the test scripts for working examples

2. Review the field configuration in field_configs.yaml

3. Verify your Claude Desktop configuration matches the provided templates in INSTALL.md

🛡️ Security & Production Readiness

Enhanced Error Handling

• Retry logic with exponential backoff - Automatic retries for transient failures (3 attempts with 1s, 2s, 4s delays)

• Smart retry strategy - Doesn't retry authentication errors or client errors (4xx)

• Structured logging - Request ID tracking for better debugging and monitoring

• Production-grade resilience - Handles timeouts, network issues, and API rate limits gracefully

• Configurable timeouts - USPTO_TIMEOUT and USPTO_DOWNLOAD_TIMEOUT environment variables for API request tuning

Security Features

• 🔐 Windows DPAPI Secure Storage - API keys encrypted with Windows Data Protection API (user-specific encryption)

• 🛡️ Safe Logging with Auto-Sanitization - All logging automatically masks API keys, tokens, and sensitive data; file-based audit trail with rotation in ~/.uspto_fpd_mcp/logs/

• Environment variable API keys - No hardcoded credentials anywhere in codebase

• Zero plain text API keys - Secure storage option eliminates API keys from Claude Desktop config files

• Cross-platform security - Automatic fallback to environment variables on non-Windows systems

• Secure test patterns - Test files use environment variables with fallbacks

• Comprehensive .gitignore - Prevents accidental credential commits

• Security guidelines - Complete documentation for secure development practices

• Automated secret scanning - CI/CD and pre-commit hooks prevent API key leaks (detect-secrets)

• 20+ secret types detected - AWS keys, GitHub tokens, JWT, private keys, API keys, and more

• Prompt injection detection - 70+ pattern detection system protects against AI-specific attacks

• Baseline management - Tracks known placeholders while catching real secrets

• Field name constants - Eliminates magic strings, reduces typo-based security issues

Content Provenance & Injection Annotation

Retrieved petition text is served verbatim — nothing is stripped or rewritten, because verbatim fidelity of legal text is the product. The defense against prompt-injection-shaped content inside retrieved documents is labeling and detection, not mutation:

• Every successful FPD_get_document_content_with_ocr response carries a provenance_note stating that extracted/OCR text is quoted data from USPTO petition documents, never instructions to the consuming model, and that petitioner- or office-drafted characterizations should be presented as attributed positions.

• A detection-only scanner (src/fpd_mcp/shared/injection_scan.py, stdlib only) checks extracted text for instruction-override, prompt-extraction, and encoding-evasion language plus invisible-Unicode steganography density. On a hit, the response gains an injection_scan annotation naming the petition, document identifier, and pattern kind — never the matched text. The key is absent entirely when the text is clean.

• The server instructions include a matching provenance-posture paragraph, and the five petition search/details tools return structured metadata only (no free-text passages), so they carry no annotation.

Full write-up: docs/CONTENT_PROVENANCE.md. This runtime layer is separate from the commit-time .security/ codebase scanners described in SECURITY_SCANNING.md.

Request Tracking & Debugging

All API requests include unique request IDs (8-char UUIDs) for correlation:

[a1b2c3d4] Starting GET request to petition/decisions/search
[a1b2c3d4] Request successful on attempt 1

Documentation

• SECURITY_GUIDELINES.md - Comprehensive security best practices

• SECURITY_SCANNING.md - Automated secret detection and prevention guide

• tests/README.md - Complete testing guide with API key setup

• Enhanced error messages with request IDs for better support

📝 Contributing

1. Fork the repository

2. Create a feature branch

3. Add tests for new functionality

4. Ensure all tests pass

5. Submit a pull request

📄 License

MIT License

⚠️ Disclaimer

THIS SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTY OF ANY KIND.

Independent Project Notice: This is an independent personal project and is not affiliated with, endorsed by, or sponsored by the United States Patent and Trademark Office (USPTO).

The author makes no representations or warranties, express or implied, including but not limited to:

• Accuracy & AI-Generated Content: No guarantee of data accuracy, completeness, or fitness for any purpose. Users are specifically cautioned that outputs generated or assisted by Artificial Intelligence (AI) components, including but not limited to text, data, or analyses, may be inaccurate, incomplete, fictionalized, or represent "hallucinations" (confabulations) by the AI model.

• Availability: USPTO API and Mistral API dependencies may cause service interruptions.

• Legal Compliance: Users are solely responsible for ensuring their use of this software, and any submissions or actions taken based on its outputs, strictly comply with all applicable laws, regulations, and policies, including but not limited to:

  • The latest Guidance on Use of Artificial Intelligence-Based Tools in Practice Before the United States Patent and Trademark Office (USPTO Guidance).

  • The USPTO's Duty of Candor and Good Faith (e.g., 37 CFR 1.56, 11.303), which includes a duty to disclose material information and correct errors.

  • The USPTO's signature requirements (e.g., 37 CFR 1.4(d), 2.193(c), 11.18), certifying human review and reasonable inquiry.

  • All rules regarding inventorship (e.g., each claimed invention must have at least one human inventor).

• Legal Advice: This tool provides data access and processing only, not legal counsel. All results must be independently verified, critically analyzed, and professionally judged by qualified legal professionals.

• Commercial Use: Users must verify USPTO and Mistral terms for commercial applications.

• Confidentiality & Data Security: The author makes no representations regarding the confidentiality or security of any data, including client-sensitive or technical information, input by the user into the software's AI components or transmitted to third-party AI services (e.g., Mistral API). Users are responsible for understanding and accepting the privacy policies, data retention practices, and security measures of any integrated third-party AI services.

• Foreign Filing Licenses & Export Controls: Users are solely responsible for ensuring that the input or processing of any data, particularly technical information, through this software's AI components does not violate U.S. foreign filing license requirements (e.g., 35 U.S.C. 184, 37 CFR Part 5) or export control regulations (e.g., EAR, ITAR). This includes awareness of potential "deemed exports" if foreign persons access such data or if AI servers are located outside the United States.

LIMITATION OF LIABILITY: Under no circumstances shall the author be liable for any direct, indirect, incidental, special, or consequential damages arising from use of this software, even if advised of the possibility of such damages.

USER RESPONSIBILITY: YOU ARE SOLELY RESPONSIBLE FOR THE INTEGRITY AND COMPLIANCE OF ALL FILINGS AND ACTIONS TAKEN BEFORE THE USPTO.

• Independent Verification: All outputs, analyses, and content generated or assisted by AI within this software MUST be thoroughly reviewed, independently verified, and corrected by a human prior to any reliance, action, or submission to the USPTO or any other entity. This includes factual assertions, legal contentions, citations, evidentiary support, and technical disclosures.

• Duty of Candor & Good Faith: You must adhere to your duty of candor and good faith with the USPTO, including the disclosure of any material information (e.g., regarding inventorship or errors) and promptly correcting any inaccuracies in the record.

• Signature & Certification: You must personally sign or insert your signature on any correspondence submitted to the USPTO, certifying your personal review and reasonable inquiry into its contents, as required by 37 CFR 11.18(b). AI tools cannot sign documents, nor can they perform the required human inquiry.

• Confidential Information: DO NOT input confidential, proprietary, or client-sensitive information into the AI components of this software without full client consent and a clear understanding of the data handling practices of the underlying AI providers. You are responsible for preventing inadvertent or unauthorized disclosure.

• Export Controls: Be aware of and comply with all foreign filing license and export control regulations when using this tool with sensitive technical data.

• Service Compliance: Ensure compliance with all USPTO (e.g., Terms of Use for USPTO websites, USPTO.gov account policies, restrictions on automated data mining) and Mistral terms of service. AI tools cannot obtain USPTO.gov accounts.

• Security: Maintain secure handling of API credentials and client information.

• Testing: Test thoroughly before production use.

• Professional Judgment: This tool is a supplement, not a substitute, for your own professional judgment and expertise.

By using this software, you acknowledge that you have read this disclaimer and agree to use the software at your own risk, accepting full responsibility for all outcomes and compliance with relevant legal and ethical obligations.

Note for Legal Professionals: While this tool provides access to patent research tools commonly used in legal practice, it is a data retrieval and AI-assisted processing system only. All results require independent verification, critical professional analysis, and cannot substitute for qualified legal counsel or the exercise of your personal professional judgment and duties outlined in the USPTO Guidance on AI Use.

🔗 Related Links

• USPTO Open Data Portal

• Model Context Protocol

• Claude

• uv Package Manager

• Mistral AI

💝 Support This Project

If you find this USPTO Final Petition Decisions MCP Server useful, please consider supporting the development! This project was developed during my personal time over many hours to provide a comprehensive, production-ready tool for the patent community.

Your support helps maintain and improve this open-source tool for everyone in the patent community. Thank you!

Acknowledgments

• USPTO for providing the Final Petition Decisions API

• Model Context Protocol for the MCP specification

• Claude Code for exceptional development assistance, architectural guidance, documentation creation, PowerShell automation, test organization, and comprehensive code development throughout this project

• Claude Desktop for additional development support and testing assistance

Questions? See INSTALL.md for complete cross-platform installation guide or review the test scripts for working examples.

OAuth sign-in (optional)

Set FPD_AUTH_MODE=oauth to protect the HTTP endpoint with Google + Microsoft sign-in (OAuth 2.1 with dynamic client registration — works as a Claude.ai / Claude Desktop custom connector). Access is controlled by a local SQLite user list; role admin unlocks the FPD_manage_users user-management tool and its MCP App panel. The default (none) and STDIO are unchanged. Full walkthrough: SSO_SETUP.md.

Admin-tool gating: The FPD_manage_users tool is registered only when FPD_ENABLE_USER_MANAGEMENT=true (default off). In OAuth mode, the tool is additionally gated behind the fpd:admin scope. Important: OAuth deployments must set FPD_ENABLE_USER_MANAGEMENT=true in the compose/systemd config or the admin tool will not appear in the tool list, even if the user has admin role.

Internal authentication split: Headless clients (internal gateway services) send Authorization: Bearer <token> to bypass the browser OAuth flow. The plain FPD_AUTH_INTERNAL_TOKEN grants fpd:user scope only (read access); admin operations require the separate FPD_AUTH_INTERNAL_ADMIN_TOKEN, which grants both fpd:user and fpd:admin. Most deployments should leave the admin token unset unless you have a machine caller that needs user management.

Shared USPTO rate limiting (multi-MCP deployments)

If you run all 4 USPTO MCPs (Citations, PFW, PTAB, FPD) as HTTP containers on the same box, serving multiple users, under one USPTO API key, each server's own in-process limiter can't see what the other 3 processes are doing — and USPTO's documented limits are per-key (burst=1, 4-15 req/sec depending on call type, plus weekly quotas), not per-process. Point all 4 containers at one bind-mounted directory and they share a single cross-process token bucket + a bounded pool of in-flight-request slots, arbitrated via POSIX file locks (crash-safe — a dead process's lock is released by the kernel). Single-MCP or STDIO deployments need nothing; the limiter is off unless the directory variable is set.

# docker-compose.yml (excerpt, all 4 USPTO MCP services)
volumes:
  uspto-rate-limit: {}
services:
  fpd-mcp:
    volumes:
      - uspto-rate-limit:/var/run/uspto-shared-rate-limit
    environment:
      USPTO_SHARED_RATE_LIMIT_DIR: /var/run/uspto-shared-rate-limit
      USPTO_SHARED_RATE_LIMIT_RPS: "4"       # default; total across ALL 4 MCPs
      USPTO_SHARED_MAX_CONCURRENT: "2"       # default; shared in-flight slots

One token bucket and 2 concurrency slots are shared across every process mounting the directory — a heavier MCP naturally draws more of the budget under load, and a long PDF download occupies a slot for its full duration (not just connection setup), per USPTO's burst=1 guidance.