@agentwonderland/mcp 0.1.28 → 0.1.30

package/dist/core/config.d.ts

@@ -1,6 +1,6 @@
 export interface WalletEntry {
     id: string;
-    keyType: "evm" | "ows";
+    keyType: "evm" | "solana" | "ows";
     key?: string;
     owsWalletId?: string;
     chains: string[];

package/dist/core/ows-adapter.d.ts

@@ -13,6 +13,23 @@ import type { Keypair } from "@solana/web3.js";
  * Check whether the OWS native module can be loaded.
  */
 export declare function isOwsAvailable(): Promise<boolean>;
+/**
+ * Heuristic: is this platform likely to have a prebuilt OWS binary?
+ * OWS ships prebuilds for {darwin, linux, win32} x {x64, arm64}.
+ * Musl-libc environments (Alpine) often lack prebuilds.
+ */
+export declare function platformSupportsOws(): boolean;
+export interface OwsInstallResult {
+    ok: boolean;
+    message: string;
+    needsRestart?: boolean;
+}
+/**
+ * Attempt to install @open-wallet-standard/core into the MCP package's own
+ * node_modules. Avoids sudo for npx-based installs; may require sudo for a
+ * global MCP install.
+ */
+export declare function installOws(): Promise<OwsInstallResult>;
 /**
  * Build a viem-compatible `LocalAccount` backed by an OWS wallet.
  *

package/dist/core/ows-adapter.js

@@ -71,6 +71,62 @@ export async function isOwsAvailable() {
         return false;
     }
 }
+/**
+ * Heuristic: is this platform likely to have a prebuilt OWS binary?
+ * OWS ships prebuilds for {darwin, linux, win32} x {x64, arm64}.
+ * Musl-libc environments (Alpine) often lack prebuilds.
+ */
+export function platformSupportsOws() {
+    const ok = new Set([
+        "darwin-x64", "darwin-arm64",
+        "linux-x64", "linux-arm64",
+        "win32-x64", "win32-arm64",
+    ]);
+    return ok.has(`${process.platform}-${process.arch}`);
+}
+/**
+ * Attempt to install @open-wallet-standard/core into the MCP package's own
+ * node_modules. Avoids sudo for npx-based installs; may require sudo for a
+ * global MCP install.
+ */
+export async function installOws() {
+    if (await isOwsAvailable()) {
+        return { ok: true, message: "OWS is already installed." };
+    }
+    if (!platformSupportsOws()) {
+        return {
+            ok: false,
+            message: `OWS does not ship a prebuilt binary for ${process.platform}-${process.arch}. Continue with plaintext storage, or install a Node build toolchain (python3, make, node-gyp) and run: npm install -g @open-wallet-standard/core`,
+        };
+    }
+    const { execFileSync } = await import("node:child_process");
+    const { dirname, resolve } = await import("node:path");
+    const { fileURLToPath } = await import("node:url");
+    // dist/core/ows-adapter.js → package root is ../../
+    const pkgRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
+    try {
+        execFileSync(process.platform === "win32" ? "npm.cmd" : "npm", ["install", "@open-wallet-standard/core", "--no-save", "--no-audit", "--no-fund", "--prefer-offline", "--loglevel=error"], { cwd: pkgRoot, stdio: ["ignore", "pipe", "pipe"], timeout: 120_000 });
+    }
+    catch (err) {
+        const e = err;
+        const stderr = e.stderr?.toString() ?? "";
+        const hint = stderr.includes("EACCES")
+            ? " (permission denied — try: sudo npm install -g @open-wallet-standard/core)"
+            : "";
+        return {
+            ok: false,
+            message: `npm install failed: ${(e.message ?? "unknown error").split("\n")[0]}${hint}`,
+        };
+    }
+    if (!(await isOwsAvailable())) {
+        return {
+            ok: false,
+            message: "OWS installed but the module could not be loaded. Restart Claude Code (or whichever MCP host) and retry.",
+            needsRestart: true,
+        };
+    }
+    return { ok: true, message: "OWS installed and ready." };
+}
 /**
  * Build a viem-compatible `LocalAccount` backed by an OWS wallet.
  *

package/dist/core/payments.js

@@ -368,7 +368,19 @@ export async function getWalletAddress(method) {
         }
     }
     if (chain === "solana") {
-        return null;
+        // Raw Solana ed25519 key path (plaintext fallback when OWS is unavailable)
+        if (!wallet.key)
+            return null;
+        try {
+            const { Keypair } = await import("@solana/web3.js");
+            const hex = wallet.key.startsWith("0x") ? wallet.key.slice(2) : wallet.key;
+            const bytes = Uint8Array.from(Buffer.from(hex, "hex"));
+            const kp = bytes.length === 32 ? Keypair.fromSeed(bytes) : Keypair.fromSecretKey(bytes);
+            return kp.publicKey.toBase58();
+        }
+        catch {
+            return null;
+        }
     }
     // Raw EVM key path
     if (!wallet.key)

package/dist/tools/passes.js

@@ -52,8 +52,9 @@ export function registerPassTools(server) {
                 "No payment method configured.",
                 "",
                 "Supported rails: Tempo USDC, Base USDC, Solana USDC.",
-                "Run wallet_setup({ action: \"create\" }) to create a crypto wallet,",
-                "or wallet_setup({ action: \"import\" }) with an existing key.",
+                "Run wallet_setup({ action: \"create\" }) to create a wallet (falls back to plaintext storage",
+                "if OWS is not installed — install @open-wallet-standard/core globally for encrypted keys).",
+                "Or wallet_setup({ action: \"import\", key: \"<hex>\" }) with an existing key.",
             ];
             if (isCardPaymentEnabled()) {
                 setupLines.push("", "Or wallet_setup({ action: \"add-card\" }) to connect a credit card.");

package/dist/tools/run.js

@@ -78,8 +78,9 @@ export function registerRunTools(server) {
                 "No payment method configured.",
                 "",
                 "Supported rails: Tempo USDC, Base USDC, Solana USDC.",
-                "Run wallet_setup({ action: \"create\" }) to create a crypto wallet,",
-                "or wallet_setup({ action: \"import\" }) with an existing key.",
+                "Run wallet_setup({ action: \"create\" }) to create a wallet (falls back to plaintext storage",
+                "if OWS is not installed — install @open-wallet-standard/core globally for encrypted keys).",
+                "Or wallet_setup({ action: \"import\", key: \"<hex>\" }) with an existing key.",
             ];
             if (isCardPaymentEnabled()) {
                 setupLines.push("", "Or wallet_setup({ action: \"add-card\" }) to connect a credit card.");

package/dist/tools/solve.js

@@ -127,8 +127,9 @@ export function registerSolveTools(server) {
                 "No payment method configured.",
                 "",
                 "Supported rails: Tempo USDC, Base USDC, Solana USDC.",
-                "Run wallet_setup({ action: \"create\" }) to create a crypto wallet,",
-                "or wallet_setup({ action: \"import\" }) with an existing key.",
+                "Run wallet_setup({ action: \"create\" }) to create a wallet (falls back to plaintext storage",
+                "if OWS is not installed — install @open-wallet-standard/core globally for encrypted keys).",
+                "Or wallet_setup({ action: \"import\", key: \"<hex>\" }) with an existing key.",
             ];
             if (isCardPaymentEnabled()) {
                 setupLines.push("", "Or wallet_setup({ action: \"add-card\" }) to connect a credit card.");

package/dist/tools/wallet.js

@@ -4,7 +4,7 @@ import { getWalletAddress, isCardPaymentEnabled } from "../core/payments.js";
 import { fetchUsdcBalance } from "../core/balances.js";
 import { getSettings } from "../core/settings.js";
 import { getOrCreatePendingCardSetup, formatCardSetupBlocks, getCardCapabilities, pollCardSetup, } from "../core/card-setup.js";
-import { isOwsAvailable, createOwsWallet, importKeyToOws, listOwsWallets, listOwsWalletsByChain, } from "../core/ows-adapter.js";
+import { isOwsAvailable, createOwsWallet, importKeyToOws, listOwsWallets, listOwsWalletsByChain, installOws, platformSupportsOws, } from "../core/ows-adapter.js";
 import { ensureConsumerPrincipal, getConsumerPrincipal } from "../core/principal.js";
 function text(t) {
     return { content: [{ type: "text", text: t }] };
@@ -63,13 +63,20 @@ export function registerWalletTools(server) {
         if (consumerPrincipal) {
             lines.push("", `Consumer principal: ${consumerPrincipal}`);
         }
+        const plaintextWallets = wallets.filter((w) => w.keyType !== "ows");
+        if (plaintextWallets.length > 0) {
+            const owsAvailable = await isOwsAvailable();
+            if (!owsAvailable && platformSupportsOws()) {
+                lines.push("", `⚠ ${plaintextWallets.length} wallet(s) stored in plaintext. Run wallet_setup({ action: "enable-ows" }) to upgrade to encrypted storage.`);
+            }
+        }
         return text(lines.join("\n"));
     });
     // ── wallet_setup ────────────────────────────────────────────────
-    server.tool("wallet_setup", "Set up or manage a payment wallet. 'create' makes a new encrypted crypto wallet (OWS); 'import' takes an existing private key. Tempo/Base share one EVM key — a single wallet covers both. Solana uses a separate ed25519 key. For crypto wallet deletion or key rotation, direct users to edit ~/.agentwonderland/config.json or ~/.ows/ manually; never handle key material programmatically.", {
+    server.tool("wallet_setup", "Set up or manage a payment wallet. 'create' makes a new crypto wallet (encrypted via OWS if available, otherwise plaintext — run 'enable-ows' to upgrade). 'import' takes an existing private key. 'enable-ows' installs the Open Wallet Standard native module for encrypted at-rest storage. Tempo/Base share one EVM key; Solana uses a separate ed25519 key. NEVER delete or rotate keys programmatically; direct users to edit ~/.agentwonderland/config.json or ~/.ows/ manually.", {
         action: z
-            .enum(["create", "import", "add-card", "remove-card"])
-            .describe("'create' a crypto wallet (recommended), 'import' an existing key, 'add-card'/'remove-card' for credit card (card-backed MPP availability depends on Stripe SPT)"),
+            .enum(["create", "import", "add-card", "remove-card", "enable-ows"])
+            .describe("'create' a wallet, 'import' an existing key, 'enable-ows' to install encrypted key storage, 'add-card'/'remove-card' for credit card (may be disabled depending on Stripe SPT availability)"),
         name: z
             .string()
             .optional()
@@ -131,6 +138,27 @@ export function registerWalletTools(server) {
             setCardConfig(null);
             return text(`Removed ${existing.brand} ****${existing.last4}. Card disconnected from Agent Wonderland.`);
         }
+        // ── Install OWS for encrypted key storage ────────────────
+        if (action === "enable-ows") {
+            if (await isOwsAvailable()) {
+                return text("OWS is already installed — your crypto wallets are stored with AES-256-GCM encryption at rest.");
+            }
+            if (!platformSupportsOws()) {
+                return text(`Your platform (${process.platform}-${process.arch}) does not have a prebuilt OWS binary.\n` +
+                    "Plaintext storage will remain in effect. To install from source you'd need Node build tools (python3, make, node-gyp).");
+            }
+            const result = await installOws();
+            if (result.ok) {
+                const plaintextWallets = getWallets().filter((w) => w.keyType !== "ows");
+                const migrationHint = plaintextWallets.length > 0
+                    ? "\n\nExisting plaintext wallets are NOT auto-migrated. To move them to encrypted storage, re-import each via wallet_setup({ action: \"import\", key: \"<hex>\" }) after OWS is active, then delete the plaintext copy from ~/.agentwonderland/config.json."
+                    : "";
+                return text(`${result.message}\n\n` +
+                    `New wallets created via wallet_setup({ action: "create" }) will now use encrypted storage.${migrationHint}`);
+            }
+            return text(`Could not install OWS: ${result.message}\n\n` +
+                "Plaintext storage still works. Try again later or install manually: npm install -g @open-wallet-standard/core");
+        }
         // ── Crypto wallet setup ──────────────────────────────────
         if (action === "import" && !key) {
             return text("Error: 'key' parameter is required when action is 'import'.");
@@ -190,11 +218,59 @@ export function registerWalletTools(server) {
                 }
             }
             if (!owsReady) {
-                return text("Cannot create wallet: OWS (Open Wallet Standard) is not installed.\n" +
-                    "Install with: npm install -g @open-wallet-standard/core\n\n" +
-                    (defaultCh === "solana"
-                        ? "Solana wallets currently require OWS-managed encrypted storage."
-                        : "Alternatively, use action 'import' with an existing private key."));
+                // Fallback: generate a plaintext wallet stored in ~/.agentwonderland/config.json.
+                // Safe for prototyping; install OWS for encrypted at-rest storage.
+                const walletName = name ?? `aw-${Date.now()}`;
+                if (preferredOwsChain === "solana") {
+                    const { Keypair } = await import("@solana/web3.js");
+                    const kp = Keypair.generate();
+                    const secretHex = Buffer.from(kp.secretKey).toString("hex");
+                    addWallet({
+                        id: walletName,
+                        keyType: "solana",
+                        key: secretHex,
+                        chains: ["solana"],
+                        defaultChain: "solana",
+                        label: walletName,
+                    });
+                    const principal = await ensureConsumerPrincipal();
+                    const owsNudge = platformSupportsOws()
+                        ? "\n\n⚠ Key stored in plaintext at ~/.agentwonderland/config.json. Run wallet_setup({ action: \"enable-ows\" }) to install encrypted at-rest storage — takes ~30s."
+                        : "\n\n⚠ Key stored in plaintext at ~/.agentwonderland/config.json. OWS encrypted storage isn't available for your platform.";
+                    return text([
+                        "Wallet created:",
+                        `  Address: ${kp.publicKey.toBase58()}`,
+                        `  Name: ${walletName}`,
+                        `  Chains: solana`,
+                        `  Consumer principal: ${principal}`,
+                        "",
+                        "Fund this address with USDC on Solana to start using agents.",
+                    ].join("\n") + owsNudge);
+                }
+                const { generatePrivateKey, privateKeyToAccount } = await import("viem/accounts");
+                const privateKey = generatePrivateKey();
+                const account = privateKeyToAccount(privateKey);
+                addWallet({
+                    id: walletName,
+                    keyType: "evm",
+                    key: privateKey,
+                    chains: ["tempo", "base"],
+                    defaultChain: defaultCh === "solana" ? "tempo" : defaultCh,
+                    label: walletName,
+                });
+                const principal = await ensureConsumerPrincipal();
+                const owsNudge = platformSupportsOws()
+                    ? "\n\n⚠ Key stored in plaintext at ~/.agentwonderland/config.json. Run wallet_setup({ action: \"enable-ows\" }) to install encrypted at-rest storage — takes ~30s."
+                    : "\n\n⚠ Key stored in plaintext at ~/.agentwonderland/config.json. OWS encrypted storage isn't available for your platform.";
+                return text([
+                    "Wallet created:",
+                    `  Address: ${account.address}`,
+                    `  Name: ${walletName}`,
+                    `  Chains: tempo, base`,
+                    `  Consumer principal: ${principal}`,
+                    "",
+                    `Fund this address with USDC on Tempo or Base to start using agents.`,
+                ].join("\n") + owsNudge);
             }
             const walletName = name ?? `aw-${Date.now()}`;
             const result = await createOwsWallet(walletName, preferredOwsChain);
@@ -244,8 +320,37 @@ export function registerWalletTools(server) {
             ].join("\n"));
         }
         if (defaultCh === "solana") {
-            return text("Solana key import currently requires OWS (Open Wallet Standard) so the ed25519 key can be stored safely.\n" +
-                "Install with: npm install -g @open-wallet-standard/core");
+            // Plaintext Solana import fallback.
+            try {
+                const { Keypair } = await import("@solana/web3.js");
+                const raw = key.startsWith("0x") ? key.slice(2) : key;
+                const bytes = Uint8Array.from(Buffer.from(raw, "hex"));
+                const kp = bytes.length === 32 ? Keypair.fromSeed(bytes) : Keypair.fromSecretKey(bytes);
+                const walletName = name ?? `imported-${Date.now()}`;
+                addWallet({
+                    id: walletName,
+                    keyType: "solana",
+                    key: raw,
+                    chains: ["solana"],
+                    defaultChain: "solana",
+                    label: walletName,
+                });
+                const principal = await ensureConsumerPrincipal();
+                const owsNudge = platformSupportsOws()
+                    ? "\n\n⚠ Key stored in plaintext at ~/.agentwonderland/config.json. Run wallet_setup({ action: \"enable-ows\" }) to install encrypted at-rest storage — takes ~30s."
+                    : "\n\n⚠ Key stored in plaintext at ~/.agentwonderland/config.json. OWS encrypted storage isn't available for your platform.";
+                return text([
+                    "Key imported:",
+                    `  Address: ${kp.publicKey.toBase58()}`,
+                    `  Name: ${walletName}`,
+                    `  Chains: solana`,
+                    `  Consumer principal: ${principal}`,
+                ].join("\n") + owsNudge);
+            }
+            catch (err) {
+                return text(`Invalid Solana key: ${err instanceof Error ? err.message : String(err)}\n` +
+                    "Expected a 32-byte seed or 64-byte secret key, hex-encoded.");
+            }
         }
         // No OWS — store plaintext
         try {
@@ -262,15 +367,16 @@ export function registerWalletTools(server) {
                 label: walletName,
             });
             const principal = await ensureConsumerPrincipal();
+            const owsNudge = platformSupportsOws()
+                ? "\n\n⚠ Key stored in plaintext at ~/.agentwonderland/config.json. Run wallet_setup({ action: \"enable-ows\" }) to install encrypted at-rest storage — takes ~30s."
+                : "\n\n⚠ Key stored in plaintext at ~/.agentwonderland/config.json. OWS encrypted storage isn't available for your platform.";
             return text([
-                `Key imported [plaintext] \u2014 OWS not available for encrypted storage.`,
+                `Key imported:`,
                 `  Address: ${account.address}`,
                 `  Name: ${walletName}`,
                 `  Chains: ${selectedChains.join(", ")}`,
                 `  Consumer principal: ${principal}`,
-                "",
-                "Install OWS for encrypted storage: npm install -g @open-wallet-standard/core",
-            ].join("\n"));
+            ].join("\n") + owsNudge);
         }
         catch {
             return text("Error: Invalid private key format.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentwonderland/mcp",
-  "version": "0.1.28",
+  "version": "0.1.30",
   "type": "module",
   "description": "MCP server for the Agent Wonderland AI agent marketplace",
   "bin": {
@@ -30,14 +30,9 @@
     "viem": "^2.47.6",
     "zod": "^3.24.0"
   },
-  "peerDependencies": {
+  "optionalDependencies": {
     "@open-wallet-standard/core": "^1.0.0"
   },
-  "peerDependenciesMeta": {
-    "@open-wallet-standard/core": {
-      "optional": true
-    }
-  },
   "devDependencies": {
     "@types/qrcode": "^1.5.6",
     "tsx": "^4.0.0",

package/src/core/config.ts

@@ -6,8 +6,8 @@ import { homedir } from "node:os";
 
 export interface WalletEntry {
   id: string;          // e.g. "evm-1"
-  keyType: "evm" | "ows"; // key format: raw EVM key or OWS-managed wallet
-  key?: string;        // private key (legacy / raw EVM only)
+  keyType: "evm" | "solana" | "ows"; // key format: raw EVM / raw Solana / OWS-managed
+  key?: string;        // private key hex (secp256k1 for evm, ed25519 for solana)
   owsWalletId?: string; // OWS wallet reference (when keyType === "ows")
   chains: string[];    // enabled chains: "tempo", "base", "solana"
   defaultChain?: string; // which chain to use by default for this wallet

package/src/core/ows-adapter.ts

@@ -169,6 +169,79 @@ export async function isOwsAvailable(): Promise<boolean> {
   }
 }
 
+/**
+ * Heuristic: is this platform likely to have a prebuilt OWS binary?
+ * OWS ships prebuilds for {darwin, linux, win32} x {x64, arm64}.
+ * Musl-libc environments (Alpine) often lack prebuilds.
+ */
+export function platformSupportsOws(): boolean {
+  const ok = new Set([
+    "darwin-x64", "darwin-arm64",
+    "linux-x64", "linux-arm64",
+    "win32-x64", "win32-arm64",
+  ]);
+  return ok.has(`${process.platform}-${process.arch}`);
+}
+
+export interface OwsInstallResult {
+  ok: boolean;
+  message: string;
+  needsRestart?: boolean;
+}
+
+/**
+ * Attempt to install @open-wallet-standard/core into the MCP package's own
+ * node_modules. Avoids sudo for npx-based installs; may require sudo for a
+ * global MCP install.
+ */
+export async function installOws(): Promise<OwsInstallResult> {
+  if (await isOwsAvailable()) {
+    return { ok: true, message: "OWS is already installed." };
+  }
+
+  if (!platformSupportsOws()) {
+    return {
+      ok: false,
+      message: `OWS does not ship a prebuilt binary for ${process.platform}-${process.arch}. Continue with plaintext storage, or install a Node build toolchain (python3, make, node-gyp) and run: npm install -g @open-wallet-standard/core`,
+    };
+  }
+
+  const { execFileSync } = await import("node:child_process");
+  const { dirname, resolve } = await import("node:path");
+  const { fileURLToPath } = await import("node:url");
+
+  // dist/core/ows-adapter.js → package root is ../../
+  const pkgRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
+
+  try {
+    execFileSync(
+      process.platform === "win32" ? "npm.cmd" : "npm",
+      ["install", "@open-wallet-standard/core", "--no-save", "--no-audit", "--no-fund", "--prefer-offline", "--loglevel=error"],
+      { cwd: pkgRoot, stdio: ["ignore", "pipe", "pipe"], timeout: 120_000 },
+    );
+  } catch (err: unknown) {
+    const e = err as { stderr?: Buffer; message?: string; code?: string };
+    const stderr = e.stderr?.toString() ?? "";
+    const hint = stderr.includes("EACCES")
+      ? " (permission denied — try: sudo npm install -g @open-wallet-standard/core)"
+      : "";
+    return {
+      ok: false,
+      message: `npm install failed: ${(e.message ?? "unknown error").split("\n")[0]}${hint}`,
+    };
+  }
+
+  if (!(await isOwsAvailable())) {
+    return {
+      ok: false,
+      message: "OWS installed but the module could not be loaded. Restart Claude Code (or whichever MCP host) and retry.",
+      needsRestart: true,
+    };
+  }
+
+  return { ok: true, message: "OWS installed and ready." };
+}
+
 /**
  * Build a viem-compatible `LocalAccount` backed by an OWS wallet.
  *

package/src/core/payments.ts

@@ -417,7 +417,17 @@ export async function getWalletAddress(method?: string): Promise<string | null>
   }
 
   if (chain === "solana") {
-    return null;
+    // Raw Solana ed25519 key path (plaintext fallback when OWS is unavailable)
+    if (!wallet.key) return null;
+    try {
+      const { Keypair } = await import("@solana/web3.js");
+      const hex = wallet.key.startsWith("0x") ? wallet.key.slice(2) : wallet.key;
+      const bytes = Uint8Array.from(Buffer.from(hex, "hex"));
+      const kp = bytes.length === 32 ? Keypair.fromSeed(bytes) : Keypair.fromSecretKey(bytes);
+      return kp.publicKey.toBase58();
+    } catch {
+      return null;
+    }
   }
 
   // Raw EVM key path

package/src/tools/passes.ts

@@ -84,8 +84,9 @@ export function registerPassTools(server: McpServer): void {
           "No payment method configured.",
           "",
           "Supported rails: Tempo USDC, Base USDC, Solana USDC.",
-          "Run wallet_setup({ action: \"create\" }) to create a crypto wallet,",
-          "or wallet_setup({ action: \"import\" }) with an existing key.",
+          "Run wallet_setup({ action: \"create\" }) to create a wallet (falls back to plaintext storage",
+          "if OWS is not installed — install @open-wallet-standard/core globally for encrypted keys).",
+          "Or wallet_setup({ action: \"import\", key: \"<hex>\" }) with an existing key.",
         ];
         if (isCardPaymentEnabled()) {
           setupLines.push("", "Or wallet_setup({ action: \"add-card\" }) to connect a credit card.");

package/src/tools/run.ts

@@ -119,8 +119,9 @@ export function registerRunTools(server: McpServer): void {
           "No payment method configured.",
           "",
           "Supported rails: Tempo USDC, Base USDC, Solana USDC.",
-          "Run wallet_setup({ action: \"create\" }) to create a crypto wallet,",
-          "or wallet_setup({ action: \"import\" }) with an existing key.",
+          "Run wallet_setup({ action: \"create\" }) to create a wallet (falls back to plaintext storage",
+          "if OWS is not installed — install @open-wallet-standard/core globally for encrypted keys).",
+          "Or wallet_setup({ action: \"import\", key: \"<hex>\" }) with an existing key.",
         ];
         if (isCardPaymentEnabled()) {
           setupLines.push("", "Or wallet_setup({ action: \"add-card\" }) to connect a credit card.");

package/src/tools/solve.ts

@@ -162,8 +162,9 @@ export function registerSolveTools(server: McpServer): void {
           "No payment method configured.",
           "",
           "Supported rails: Tempo USDC, Base USDC, Solana USDC.",
-          "Run wallet_setup({ action: \"create\" }) to create a crypto wallet,",
-          "or wallet_setup({ action: \"import\" }) with an existing key.",
+          "Run wallet_setup({ action: \"create\" }) to create a wallet (falls back to plaintext storage",
+          "if OWS is not installed — install @open-wallet-standard/core globally for encrypted keys).",
+          "Or wallet_setup({ action: \"import\", key: \"<hex>\" }) with an existing key.",
         ];
         if (isCardPaymentEnabled()) {
           setupLines.push("", "Or wallet_setup({ action: \"add-card\" }) to connect a credit card.");

package/src/tools/wallet.ts

@@ -24,6 +24,8 @@ import {
   importKeyToOws,
   listOwsWallets,
   listOwsWalletsByChain,
+  installOws,
+  platformSupportsOws,
 } from "../core/ows-adapter.js";
 import { ensureConsumerPrincipal, getConsumerPrincipal } from "../core/principal.js";
 
@@ -97,6 +99,17 @@ export function registerWalletTools(server: McpServer): void {
         lines.push("", `Consumer principal: ${consumerPrincipal}`);
       }
 
+      const plaintextWallets = wallets.filter((w) => w.keyType !== "ows");
+      if (plaintextWallets.length > 0) {
+        const owsAvailable = await isOwsAvailable();
+        if (!owsAvailable && platformSupportsOws()) {
+          lines.push(
+            "",
+            `⚠ ${plaintextWallets.length} wallet(s) stored in plaintext. Run wallet_setup({ action: "enable-ows" }) to upgrade to encrypted storage.`,
+          );
+        }
+      }
+
       return text(lines.join("\n"));
     },
   );
@@ -104,11 +117,11 @@ export function registerWalletTools(server: McpServer): void {
   // ── wallet_setup ────────────────────────────────────────────────
   server.tool(
     "wallet_setup",
-    "Set up or manage a payment wallet. 'create' makes a new encrypted crypto wallet (OWS); 'import' takes an existing private key. Tempo/Base share one EVM key — a single wallet covers both. Solana uses a separate ed25519 key. For crypto wallet deletion or key rotation, direct users to edit ~/.agentwonderland/config.json or ~/.ows/ manually; never handle key material programmatically.",
+    "Set up or manage a payment wallet. 'create' makes a new crypto wallet (encrypted via OWS if available, otherwise plaintext — run 'enable-ows' to upgrade). 'import' takes an existing private key. 'enable-ows' installs the Open Wallet Standard native module for encrypted at-rest storage. Tempo/Base share one EVM key; Solana uses a separate ed25519 key. NEVER delete or rotate keys programmatically; direct users to edit ~/.agentwonderland/config.json or ~/.ows/ manually.",
     {
       action: z
-        .enum(["create", "import", "add-card", "remove-card"])
-        .describe("'create' a crypto wallet (recommended), 'import' an existing key, 'add-card'/'remove-card' for credit card (card-backed MPP availability depends on Stripe SPT)"),
+        .enum(["create", "import", "add-card", "remove-card", "enable-ows"])
+        .describe("'create' a wallet, 'import' an existing key, 'enable-ows' to install encrypted key storage, 'add-card'/'remove-card' for credit card (may be disabled depending on Stripe SPT availability)"),
       name: z
         .string()
         .optional()
@@ -181,6 +194,34 @@ export function registerWalletTools(server: McpServer): void {
         return text(`Removed ${existing.brand} ****${existing.last4}. Card disconnected from Agent Wonderland.`);
       }
 
+      // ── Install OWS for encrypted key storage ────────────────
+      if (action === "enable-ows") {
+        if (await isOwsAvailable()) {
+          return text("OWS is already installed — your crypto wallets are stored with AES-256-GCM encryption at rest.");
+        }
+        if (!platformSupportsOws()) {
+          return text(
+            `Your platform (${process.platform}-${process.arch}) does not have a prebuilt OWS binary.\n` +
+            "Plaintext storage will remain in effect. To install from source you'd need Node build tools (python3, make, node-gyp).",
+          );
+        }
+        const result = await installOws();
+        if (result.ok) {
+          const plaintextWallets = getWallets().filter((w) => w.keyType !== "ows");
+          const migrationHint = plaintextWallets.length > 0
+            ? "\n\nExisting plaintext wallets are NOT auto-migrated. To move them to encrypted storage, re-import each via wallet_setup({ action: \"import\", key: \"<hex>\" }) after OWS is active, then delete the plaintext copy from ~/.agentwonderland/config.json."
+            : "";
+          return text(
+            `${result.message}\n\n` +
+            `New wallets created via wallet_setup({ action: "create" }) will now use encrypted storage.${migrationHint}`,
+          );
+        }
+        return text(
+          `Could not install OWS: ${result.message}\n\n` +
+          "Plaintext storage still works. Try again later or install manually: npm install -g @open-wallet-standard/core",
+        );
+      }
+
       // ── Crypto wallet setup ──────────────────────────────────
       if (action === "import" && !key) {
         return text(
@@ -245,12 +286,62 @@ export function registerWalletTools(server: McpServer): void {
         }
 
         if (!owsReady) {
+          // Fallback: generate a plaintext wallet stored in ~/.agentwonderland/config.json.
+          // Safe for prototyping; install OWS for encrypted at-rest storage.
+          const walletName = name ?? `aw-${Date.now()}`;
+          if (preferredOwsChain === "solana") {
+            const { Keypair } = await import("@solana/web3.js");
+            const kp = Keypair.generate();
+            const secretHex = Buffer.from(kp.secretKey).toString("hex");
+            addWallet({
+              id: walletName,
+              keyType: "solana",
+              key: secretHex,
+              chains: ["solana"],
+              defaultChain: "solana",
+              label: walletName,
+            });
+            const principal = await ensureConsumerPrincipal();
+            const owsNudge = platformSupportsOws()
+              ? "\n\n⚠ Key stored in plaintext at ~/.agentwonderland/config.json. Run wallet_setup({ action: \"enable-ows\" }) to install encrypted at-rest storage — takes ~30s."
+              : "\n\n⚠ Key stored in plaintext at ~/.agentwonderland/config.json. OWS encrypted storage isn't available for your platform.";
+            return text(
+              [
+                "Wallet created:",
+                `  Address: ${kp.publicKey.toBase58()}`,
+                `  Name: ${walletName}`,
+                `  Chains: solana`,
+                `  Consumer principal: ${principal}`,
+                "",
+                "Fund this address with USDC on Solana to start using agents.",
+              ].join("\n") + owsNudge,
+            );
+          }
+          const { generatePrivateKey, privateKeyToAccount } = await import("viem/accounts");
+          const privateKey = generatePrivateKey();
+          const account = privateKeyToAccount(privateKey);
+          addWallet({
+            id: walletName,
+            keyType: "evm",
+            key: privateKey,
+            chains: ["tempo", "base"],
+            defaultChain: defaultCh === "solana" ? "tempo" : defaultCh,
+            label: walletName,
+          });
+          const principal = await ensureConsumerPrincipal();
+          const owsNudge = platformSupportsOws()
+            ? "\n\n⚠ Key stored in plaintext at ~/.agentwonderland/config.json. Run wallet_setup({ action: \"enable-ows\" }) to install encrypted at-rest storage — takes ~30s."
+            : "\n\n⚠ Key stored in plaintext at ~/.agentwonderland/config.json. OWS encrypted storage isn't available for your platform.";
           return text(
-            "Cannot create wallet: OWS (Open Wallet Standard) is not installed.\n" +
-              "Install with: npm install -g @open-wallet-standard/core\n\n" +
-              (defaultCh === "solana"
-                ? "Solana wallets currently require OWS-managed encrypted storage."
-                : "Alternatively, use action 'import' with an existing private key."),
+            [
+              "Wallet created:",
+              `  Address: ${account.address}`,
+              `  Name: ${walletName}`,
+              `  Chains: tempo, base`,
+              `  Consumer principal: ${principal}`,
+              "",
+              `Fund this address with USDC on Tempo or Base to start using agents.`,
+            ].join("\n") + owsNudge,
           );
         }
 
@@ -312,10 +403,40 @@ export function registerWalletTools(server: McpServer): void {
       }
 
       if (defaultCh === "solana") {
-        return text(
-          "Solana key import currently requires OWS (Open Wallet Standard) so the ed25519 key can be stored safely.\n" +
-          "Install with: npm install -g @open-wallet-standard/core",
-        );
+        // Plaintext Solana import fallback.
+        try {
+          const { Keypair } = await import("@solana/web3.js");
+          const raw = key!.startsWith("0x") ? key!.slice(2) : key!;
+          const bytes = Uint8Array.from(Buffer.from(raw, "hex"));
+          const kp = bytes.length === 32 ? Keypair.fromSeed(bytes) : Keypair.fromSecretKey(bytes);
+          const walletName = name ?? `imported-${Date.now()}`;
+          addWallet({
+            id: walletName,
+            keyType: "solana",
+            key: raw,
+            chains: ["solana"],
+            defaultChain: "solana",
+            label: walletName,
+          });
+          const principal = await ensureConsumerPrincipal();
+          const owsNudge = platformSupportsOws()
+            ? "\n\n⚠ Key stored in plaintext at ~/.agentwonderland/config.json. Run wallet_setup({ action: \"enable-ows\" }) to install encrypted at-rest storage — takes ~30s."
+            : "\n\n⚠ Key stored in plaintext at ~/.agentwonderland/config.json. OWS encrypted storage isn't available for your platform.";
+          return text(
+            [
+              "Key imported:",
+              `  Address: ${kp.publicKey.toBase58()}`,
+              `  Name: ${walletName}`,
+              `  Chains: solana`,
+              `  Consumer principal: ${principal}`,
+            ].join("\n") + owsNudge,
+          );
+        } catch (err) {
+          return text(
+            `Invalid Solana key: ${err instanceof Error ? err.message : String(err)}\n` +
+            "Expected a 32-byte seed or 64-byte secret key, hex-encoded.",
+          );
+        }
       }
 
       // No OWS — store plaintext
@@ -337,16 +458,17 @@ export function registerWalletTools(server: McpServer): void {
         });
         const principal = await ensureConsumerPrincipal();
 
+        const owsNudge = platformSupportsOws()
+          ? "\n\n⚠ Key stored in plaintext at ~/.agentwonderland/config.json. Run wallet_setup({ action: \"enable-ows\" }) to install encrypted at-rest storage — takes ~30s."
+          : "\n\n⚠ Key stored in plaintext at ~/.agentwonderland/config.json. OWS encrypted storage isn't available for your platform.";
         return text(
           [
-            `Key imported [plaintext] \u2014 OWS not available for encrypted storage.`,
+            `Key imported:`,
             `  Address: ${account.address}`,
             `  Name: ${walletName}`,
             `  Chains: ${selectedChains.join(", ")}`,
             `  Consumer principal: ${principal}`,
-            "",
-            "Install OWS for encrypted storage: npm install -g @open-wallet-standard/core",
-          ].join("\n"),
+          ].join("\n") + owsNudge,
         );
       } catch {
         return text("Error: Invalid private key format.");