@agentwonderland/mcp 0.1.29 → 0.1.31

package/dist/core/ows-adapter.d.ts

@@ -13,6 +13,23 @@ import type { Keypair } from "@solana/web3.js";
  * Check whether the OWS native module can be loaded.
  */
 export declare function isOwsAvailable(): Promise<boolean>;
+/**
+ * Heuristic: is this platform likely to have a prebuilt OWS binary?
+ * OWS ships glibc prebuilds for {darwin, linux, win32} x {x64, arm64}.
+ * Musl-libc (Alpine) and other libcs have no prebuilds.
+ */
+export declare function platformSupportsOws(): boolean;
+export interface OwsInstallResult {
+    ok: boolean;
+    message: string;
+    needsRestart?: boolean;
+}
+/**
+ * Attempt to install @open-wallet-standard/core into the MCP package's own
+ * node_modules. Avoids sudo for npx-based installs; may require sudo for a
+ * global MCP install.
+ */
+export declare function installOws(): Promise<OwsInstallResult>;
 /**
  * Build a viem-compatible `LocalAccount` backed by an OWS wallet.
  *

package/dist/core/ows-adapter.js

@@ -71,6 +71,81 @@ export async function isOwsAvailable() {
         return false;
     }
 }
+/**
+ * Heuristic: is this platform likely to have a prebuilt OWS binary?
+ * OWS ships glibc prebuilds for {darwin, linux, win32} x {x64, arm64}.
+ * Musl-libc (Alpine) and other libcs have no prebuilds.
+ */
+export function platformSupportsOws() {
+    const ok = new Set([
+        "darwin-x64", "darwin-arm64",
+        "linux-x64", "linux-arm64",
+        "win32-x64", "win32-arm64",
+    ]);
+    if (!ok.has(`${process.platform}-${process.arch}`))
+        return false;
+    // On Linux, distinguish glibc from musl. musl systems have no prebuilt binary.
+    if (process.platform === "linux") {
+        try {
+            // Node exposes the runtime glibc version when linked against glibc;
+            // on musl this field is empty.
+            const report = process.report;
+            const glibc = report?.getReport?.()?.header?.glibcVersionRuntime;
+            if (!glibc)
+                return false;
+        }
+        catch {
+            return false;
+        }
+    }
+    return true;
+}
+/**
+ * Attempt to install @open-wallet-standard/core into the MCP package's own
+ * node_modules. Avoids sudo for npx-based installs; may require sudo for a
+ * global MCP install.
+ */
+export async function installOws() {
+    if (await isOwsAvailable()) {
+        return { ok: true, message: "OWS is already installed." };
+    }
+    if (!platformSupportsOws()) {
+        const label = process.platform === "linux"
+            ? `${process.platform}-${process.arch} (likely musl/Alpine)`
+            : `${process.platform}-${process.arch}`;
+        return {
+            ok: false,
+            message: `OWS does not ship a prebuilt binary for ${label}. Plaintext storage is the only option on this system. To build from source you'd need glibc + Node build tools (python3, make, node-gyp).`,
+        };
+    }
+    const { execFileSync } = await import("node:child_process");
+    const { dirname, resolve } = await import("node:path");
+    const { fileURLToPath } = await import("node:url");
+    // dist/core/ows-adapter.js → package root is ../../
+    const pkgRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
+    try {
+        execFileSync(process.platform === "win32" ? "npm.cmd" : "npm", ["install", "@open-wallet-standard/core", "--no-save", "--no-audit", "--no-fund", "--prefer-offline", "--loglevel=error"], { cwd: pkgRoot, stdio: ["ignore", "pipe", "pipe"], timeout: 120_000 });
+    }
+    catch (err) {
+        const e = err;
+        const stderr = e.stderr?.toString() ?? "";
+        const hint = stderr.includes("EACCES")
+            ? " (permission denied — try: sudo npm install -g @open-wallet-standard/core)"
+            : "";
+        return {
+            ok: false,
+            message: `npm install failed: ${(e.message ?? "unknown error").split("\n")[0]}${hint}`,
+        };
+    }
+    if (!(await isOwsAvailable())) {
+        return {
+            ok: false,
+            message: "OWS installed but the module could not be loaded. Restart Claude Code (or whichever MCP host) and retry.",
+            needsRestart: true,
+        };
+    }
+    return { ok: true, message: "OWS installed and ready." };
+}
 /**
  * Build a viem-compatible `LocalAccount` backed by an OWS wallet.
  *

package/dist/tools/wallet.js

@@ -4,7 +4,7 @@ import { getWalletAddress, isCardPaymentEnabled } from "../core/payments.js";
 import { fetchUsdcBalance } from "../core/balances.js";
 import { getSettings } from "../core/settings.js";
 import { getOrCreatePendingCardSetup, formatCardSetupBlocks, getCardCapabilities, pollCardSetup, } from "../core/card-setup.js";
-import { isOwsAvailable, createOwsWallet, importKeyToOws, listOwsWallets, listOwsWalletsByChain, } from "../core/ows-adapter.js";
+import { isOwsAvailable, createOwsWallet, importKeyToOws, listOwsWallets, listOwsWalletsByChain, installOws, platformSupportsOws, } from "../core/ows-adapter.js";
 import { ensureConsumerPrincipal, getConsumerPrincipal } from "../core/principal.js";
 function text(t) {
     return { content: [{ type: "text", text: t }] };
@@ -63,13 +63,20 @@ export function registerWalletTools(server) {
         if (consumerPrincipal) {
             lines.push("", `Consumer principal: ${consumerPrincipal}`);
         }
+        const plaintextWallets = wallets.filter((w) => w.keyType !== "ows");
+        if (plaintextWallets.length > 0) {
+            const owsAvailable = await isOwsAvailable();
+            if (!owsAvailable && platformSupportsOws()) {
+                lines.push("", `⚠ ${plaintextWallets.length} wallet(s) stored in plaintext. Run wallet_setup({ action: "enable-ows" }) to upgrade to encrypted storage.`);
+            }
+        }
         return text(lines.join("\n"));
     });
     // ── wallet_setup ────────────────────────────────────────────────
-    server.tool("wallet_setup", "Set up or manage a payment wallet. 'create' makes a new encrypted crypto wallet (OWS); 'import' takes an existing private key. Tempo/Base share one EVM key — a single wallet covers both. Solana uses a separate ed25519 key. For crypto wallet deletion or key rotation, direct users to edit ~/.agentwonderland/config.json or ~/.ows/ manually; never handle key material programmatically.", {
+    server.tool("wallet_setup", "Set up or manage a payment wallet. 'create' makes a new crypto wallet (encrypted via OWS if available, otherwise plaintext — run 'enable-ows' to upgrade). 'import' takes an existing private key. 'enable-ows' installs the Open Wallet Standard native module for encrypted at-rest storage. Tempo/Base share one EVM key; Solana uses a separate ed25519 key. NEVER delete or rotate keys programmatically; direct users to edit ~/.agentwonderland/config.json or ~/.ows/ manually.", {
         action: z
-            .enum(["create", "import", "add-card", "remove-card"])
-            .describe("'create' a crypto wallet (recommended), 'import' an existing key, 'add-card'/'remove-card' for credit card (card-backed MPP availability depends on Stripe SPT)"),
+            .enum(["create", "import", "add-card", "remove-card", "enable-ows"])
+            .describe("'create' a wallet, 'import' an existing key, 'enable-ows' to install encrypted key storage, 'add-card'/'remove-card' for credit card (may be disabled depending on Stripe SPT availability)"),
         name: z
             .string()
             .optional()
@@ -131,6 +138,27 @@ export function registerWalletTools(server) {
             setCardConfig(null);
             return text(`Removed ${existing.brand} ****${existing.last4}. Card disconnected from Agent Wonderland.`);
         }
+        // ── Install OWS for encrypted key storage ────────────────
+        if (action === "enable-ows") {
+            if (await isOwsAvailable()) {
+                return text("OWS is already installed — your crypto wallets are stored with AES-256-GCM encryption at rest.");
+            }
+            if (!platformSupportsOws()) {
+                return text(`Your platform (${process.platform}-${process.arch}) does not have a prebuilt OWS binary.\n` +
+                    "Plaintext storage will remain in effect. To install from source you'd need Node build tools (python3, make, node-gyp).");
+            }
+            const result = await installOws();
+            if (result.ok) {
+                const plaintextWallets = getWallets().filter((w) => w.keyType !== "ows");
+                const migrationHint = plaintextWallets.length > 0
+                    ? "\n\nExisting plaintext wallets are NOT auto-migrated. To move them to encrypted storage, re-import each via wallet_setup({ action: \"import\", key: \"<hex>\" }) after OWS is active, then delete the plaintext copy from ~/.agentwonderland/config.json."
+                    : "";
+                return text(`${result.message}\n\n` +
+                    `New wallets created via wallet_setup({ action: "create" }) will now use encrypted storage.${migrationHint}`);
+            }
+            return text(`Could not install OWS: ${result.message}\n\n` +
+                "Plaintext storage still works. Try again later or install manually: npm install -g @open-wallet-standard/core");
+        }
         // ── Crypto wallet setup ──────────────────────────────────
         if (action === "import" && !key) {
             return text("Error: 'key' parameter is required when action is 'import'.");
@@ -206,16 +234,18 @@ export function registerWalletTools(server) {
                         label: walletName,
                     });
                     const principal = await ensureConsumerPrincipal();
+                    const owsNudge = platformSupportsOws()
+                        ? "\n\n⚠ Key stored in plaintext at ~/.agentwonderland/config.json. Run wallet_setup({ action: \"enable-ows\" }) to install encrypted at-rest storage — takes ~30s."
+                        : "\n\n⚠ Key stored in plaintext at ~/.agentwonderland/config.json. OWS encrypted storage isn't available for your platform.";
                     return text([
-                        "Wallet created [plaintext — install OWS for encrypted storage]:",
+                        "Wallet created:",
                         `  Address: ${kp.publicKey.toBase58()}`,
                         `  Name: ${walletName}`,
                         `  Chains: solana`,
                         `  Consumer principal: ${principal}`,
                         "",
                         "Fund this address with USDC on Solana to start using agents.",
-                        "For encrypted storage, install OWS: npm install -g @open-wallet-standard/core",
-                    ].join("\n"));
+                    ].join("\n") + owsNudge);
                 }
                 const { generatePrivateKey, privateKeyToAccount } = await import("viem/accounts");
                 const privateKey = generatePrivateKey();
@@ -229,16 +259,18 @@ export function registerWalletTools(server) {
                     label: walletName,
                 });
                 const principal = await ensureConsumerPrincipal();
+                const owsNudge = platformSupportsOws()
+                    ? "\n\n⚠ Key stored in plaintext at ~/.agentwonderland/config.json. Run wallet_setup({ action: \"enable-ows\" }) to install encrypted at-rest storage — takes ~30s."
+                    : "\n\n⚠ Key stored in plaintext at ~/.agentwonderland/config.json. OWS encrypted storage isn't available for your platform.";
                 return text([
-                    "Wallet created [plaintext — install OWS for encrypted storage]:",
+                    "Wallet created:",
                     `  Address: ${account.address}`,
                     `  Name: ${walletName}`,
                     `  Chains: tempo, base`,
                     `  Consumer principal: ${principal}`,
                     "",
                     `Fund this address with USDC on Tempo or Base to start using agents.`,
-                    "For encrypted storage, install OWS: npm install -g @open-wallet-standard/core",
-                ].join("\n"));
+                ].join("\n") + owsNudge);
             }
             const walletName = name ?? `aw-${Date.now()}`;
             const result = await createOwsWallet(walletName, preferredOwsChain);
@@ -304,15 +336,16 @@ export function registerWalletTools(server) {
                     label: walletName,
                 });
                 const principal = await ensureConsumerPrincipal();
+                const owsNudge = platformSupportsOws()
+                    ? "\n\n⚠ Key stored in plaintext at ~/.agentwonderland/config.json. Run wallet_setup({ action: \"enable-ows\" }) to install encrypted at-rest storage — takes ~30s."
+                    : "\n\n⚠ Key stored in plaintext at ~/.agentwonderland/config.json. OWS encrypted storage isn't available for your platform.";
                 return text([
-                    "Key imported [plaintext — install OWS for encrypted storage]:",
+                    "Key imported:",
                     `  Address: ${kp.publicKey.toBase58()}`,
                     `  Name: ${walletName}`,
                     `  Chains: solana`,
                     `  Consumer principal: ${principal}`,
-                    "",
-                    "For encrypted storage, install OWS: npm install -g @open-wallet-standard/core",
-                ].join("\n"));
+                ].join("\n") + owsNudge);
             }
             catch (err) {
                 return text(`Invalid Solana key: ${err instanceof Error ? err.message : String(err)}\n` +
@@ -334,15 +367,16 @@ export function registerWalletTools(server) {
                 label: walletName,
             });
             const principal = await ensureConsumerPrincipal();
+            const owsNudge = platformSupportsOws()
+                ? "\n\n⚠ Key stored in plaintext at ~/.agentwonderland/config.json. Run wallet_setup({ action: \"enable-ows\" }) to install encrypted at-rest storage — takes ~30s."
+                : "\n\n⚠ Key stored in plaintext at ~/.agentwonderland/config.json. OWS encrypted storage isn't available for your platform.";
             return text([
-                `Key imported [plaintext] \u2014 OWS not available for encrypted storage.`,
+                `Key imported:`,
                 `  Address: ${account.address}`,
                 `  Name: ${walletName}`,
                 `  Chains: ${selectedChains.join(", ")}`,
                 `  Consumer principal: ${principal}`,
-                "",
-                "Install OWS for encrypted storage: npm install -g @open-wallet-standard/core",
-            ].join("\n"));
+            ].join("\n") + owsNudge);
         }
         catch {
             return text("Error: Invalid private key format.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentwonderland/mcp",
-  "version": "0.1.29",
+  "version": "0.1.31",
   "type": "module",
   "description": "MCP server for the Agent Wonderland AI agent marketplace",
   "bin": {

package/src/core/ows-adapter.ts

@@ -169,6 +169,97 @@ export async function isOwsAvailable(): Promise<boolean> {
   }
 }
 
+/**
+ * Heuristic: is this platform likely to have a prebuilt OWS binary?
+ * OWS ships glibc prebuilds for {darwin, linux, win32} x {x64, arm64}.
+ * Musl-libc (Alpine) and other libcs have no prebuilds.
+ */
+export function platformSupportsOws(): boolean {
+  const ok = new Set([
+    "darwin-x64", "darwin-arm64",
+    "linux-x64", "linux-arm64",
+    "win32-x64", "win32-arm64",
+  ]);
+  if (!ok.has(`${process.platform}-${process.arch}`)) return false;
+
+  // On Linux, distinguish glibc from musl. musl systems have no prebuilt binary.
+  if (process.platform === "linux") {
+    try {
+      // Node exposes the runtime glibc version when linked against glibc;
+      // on musl this field is empty.
+      const report = (process as NodeJS.Process & { report?: { getReport?: () => { header?: { glibcVersionRuntime?: string } } } }).report;
+      const glibc = report?.getReport?.()?.header?.glibcVersionRuntime;
+      if (!glibc) return false;
+    } catch {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+export interface OwsInstallResult {
+  ok: boolean;
+  message: string;
+  needsRestart?: boolean;
+}
+
+/**
+ * Attempt to install @open-wallet-standard/core into the MCP package's own
+ * node_modules. Avoids sudo for npx-based installs; may require sudo for a
+ * global MCP install.
+ */
+export async function installOws(): Promise<OwsInstallResult> {
+  if (await isOwsAvailable()) {
+    return { ok: true, message: "OWS is already installed." };
+  }
+
+  if (!platformSupportsOws()) {
+    const label = process.platform === "linux"
+      ? `${process.platform}-${process.arch} (likely musl/Alpine)`
+      : `${process.platform}-${process.arch}`;
+    return {
+      ok: false,
+      message: `OWS does not ship a prebuilt binary for ${label}. Plaintext storage is the only option on this system. To build from source you'd need glibc + Node build tools (python3, make, node-gyp).`,
+    };
+  }
+
+  const { execFileSync } = await import("node:child_process");
+  const { dirname, resolve } = await import("node:path");
+  const { fileURLToPath } = await import("node:url");
+
+  // dist/core/ows-adapter.js → package root is ../../
+  const pkgRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
+
+  try {
+    execFileSync(
+      process.platform === "win32" ? "npm.cmd" : "npm",
+      ["install", "@open-wallet-standard/core", "--no-save", "--no-audit", "--no-fund", "--prefer-offline", "--loglevel=error"],
+      { cwd: pkgRoot, stdio: ["ignore", "pipe", "pipe"], timeout: 120_000 },
+    );
+  } catch (err: unknown) {
+    const e = err as { stderr?: Buffer; message?: string; code?: string };
+    const stderr = e.stderr?.toString() ?? "";
+    const hint = stderr.includes("EACCES")
+      ? " (permission denied — try: sudo npm install -g @open-wallet-standard/core)"
+      : "";
+    return {
+      ok: false,
+      message: `npm install failed: ${(e.message ?? "unknown error").split("\n")[0]}${hint}`,
+    };
+  }
+
+  if (!(await isOwsAvailable())) {
+    return {
+      ok: false,
+      message: "OWS installed but the module could not be loaded. Restart Claude Code (or whichever MCP host) and retry.",
+      needsRestart: true,
+    };
+  }
+
+  return { ok: true, message: "OWS installed and ready." };
+}
+
 /**
  * Build a viem-compatible `LocalAccount` backed by an OWS wallet.
  *

package/src/tools/wallet.ts

@@ -24,6 +24,8 @@ import {
   importKeyToOws,
   listOwsWallets,
   listOwsWalletsByChain,
+  installOws,
+  platformSupportsOws,
 } from "../core/ows-adapter.js";
 import { ensureConsumerPrincipal, getConsumerPrincipal } from "../core/principal.js";
 
@@ -97,6 +99,17 @@ export function registerWalletTools(server: McpServer): void {
         lines.push("", `Consumer principal: ${consumerPrincipal}`);
       }
 
+      const plaintextWallets = wallets.filter((w) => w.keyType !== "ows");
+      if (plaintextWallets.length > 0) {
+        const owsAvailable = await isOwsAvailable();
+        if (!owsAvailable && platformSupportsOws()) {
+          lines.push(
+            "",
+            `⚠ ${plaintextWallets.length} wallet(s) stored in plaintext. Run wallet_setup({ action: "enable-ows" }) to upgrade to encrypted storage.`,
+          );
+        }
+      }
+
       return text(lines.join("\n"));
     },
   );
@@ -104,11 +117,11 @@ export function registerWalletTools(server: McpServer): void {
   // ── wallet_setup ────────────────────────────────────────────────
   server.tool(
     "wallet_setup",
-    "Set up or manage a payment wallet. 'create' makes a new encrypted crypto wallet (OWS); 'import' takes an existing private key. Tempo/Base share one EVM key — a single wallet covers both. Solana uses a separate ed25519 key. For crypto wallet deletion or key rotation, direct users to edit ~/.agentwonderland/config.json or ~/.ows/ manually; never handle key material programmatically.",
+    "Set up or manage a payment wallet. 'create' makes a new crypto wallet (encrypted via OWS if available, otherwise plaintext — run 'enable-ows' to upgrade). 'import' takes an existing private key. 'enable-ows' installs the Open Wallet Standard native module for encrypted at-rest storage. Tempo/Base share one EVM key; Solana uses a separate ed25519 key. NEVER delete or rotate keys programmatically; direct users to edit ~/.agentwonderland/config.json or ~/.ows/ manually.",
     {
       action: z
-        .enum(["create", "import", "add-card", "remove-card"])
-        .describe("'create' a crypto wallet (recommended), 'import' an existing key, 'add-card'/'remove-card' for credit card (card-backed MPP availability depends on Stripe SPT)"),
+        .enum(["create", "import", "add-card", "remove-card", "enable-ows"])
+        .describe("'create' a wallet, 'import' an existing key, 'enable-ows' to install encrypted key storage, 'add-card'/'remove-card' for credit card (may be disabled depending on Stripe SPT availability)"),
       name: z
         .string()
         .optional()
@@ -181,6 +194,34 @@ export function registerWalletTools(server: McpServer): void {
         return text(`Removed ${existing.brand} ****${existing.last4}. Card disconnected from Agent Wonderland.`);
       }
 
+      // ── Install OWS for encrypted key storage ────────────────
+      if (action === "enable-ows") {
+        if (await isOwsAvailable()) {
+          return text("OWS is already installed — your crypto wallets are stored with AES-256-GCM encryption at rest.");
+        }
+        if (!platformSupportsOws()) {
+          return text(
+            `Your platform (${process.platform}-${process.arch}) does not have a prebuilt OWS binary.\n` +
+            "Plaintext storage will remain in effect. To install from source you'd need Node build tools (python3, make, node-gyp).",
+          );
+        }
+        const result = await installOws();
+        if (result.ok) {
+          const plaintextWallets = getWallets().filter((w) => w.keyType !== "ows");
+          const migrationHint = plaintextWallets.length > 0
+            ? "\n\nExisting plaintext wallets are NOT auto-migrated. To move them to encrypted storage, re-import each via wallet_setup({ action: \"import\", key: \"<hex>\" }) after OWS is active, then delete the plaintext copy from ~/.agentwonderland/config.json."
+            : "";
+          return text(
+            `${result.message}\n\n` +
+            `New wallets created via wallet_setup({ action: "create" }) will now use encrypted storage.${migrationHint}`,
+          );
+        }
+        return text(
+          `Could not install OWS: ${result.message}\n\n` +
+          "Plaintext storage still works. Try again later or install manually: npm install -g @open-wallet-standard/core",
+        );
+      }
+
       // ── Crypto wallet setup ──────────────────────────────────
       if (action === "import" && !key) {
         return text(
@@ -261,17 +302,19 @@ export function registerWalletTools(server: McpServer): void {
               label: walletName,
             });
             const principal = await ensureConsumerPrincipal();
+            const owsNudge = platformSupportsOws()
+              ? "\n\n⚠ Key stored in plaintext at ~/.agentwonderland/config.json. Run wallet_setup({ action: \"enable-ows\" }) to install encrypted at-rest storage — takes ~30s."
+              : "\n\n⚠ Key stored in plaintext at ~/.agentwonderland/config.json. OWS encrypted storage isn't available for your platform.";
             return text(
               [
-                "Wallet created [plaintext — install OWS for encrypted storage]:",
+                "Wallet created:",
                 `  Address: ${kp.publicKey.toBase58()}`,
                 `  Name: ${walletName}`,
                 `  Chains: solana`,
                 `  Consumer principal: ${principal}`,
                 "",
                 "Fund this address with USDC on Solana to start using agents.",
-                "For encrypted storage, install OWS: npm install -g @open-wallet-standard/core",
-              ].join("\n"),
+              ].join("\n") + owsNudge,
             );
           }
           const { generatePrivateKey, privateKeyToAccount } = await import("viem/accounts");
@@ -286,17 +329,19 @@ export function registerWalletTools(server: McpServer): void {
             label: walletName,
           });
           const principal = await ensureConsumerPrincipal();
+          const owsNudge = platformSupportsOws()
+            ? "\n\n⚠ Key stored in plaintext at ~/.agentwonderland/config.json. Run wallet_setup({ action: \"enable-ows\" }) to install encrypted at-rest storage — takes ~30s."
+            : "\n\n⚠ Key stored in plaintext at ~/.agentwonderland/config.json. OWS encrypted storage isn't available for your platform.";
           return text(
             [
-              "Wallet created [plaintext — install OWS for encrypted storage]:",
+              "Wallet created:",
               `  Address: ${account.address}`,
               `  Name: ${walletName}`,
               `  Chains: tempo, base`,
               `  Consumer principal: ${principal}`,
               "",
               `Fund this address with USDC on Tempo or Base to start using agents.`,
-              "For encrypted storage, install OWS: npm install -g @open-wallet-standard/core",
-            ].join("\n"),
+            ].join("\n") + owsNudge,
           );
         }
 
@@ -374,16 +419,17 @@ export function registerWalletTools(server: McpServer): void {
             label: walletName,
           });
           const principal = await ensureConsumerPrincipal();
+          const owsNudge = platformSupportsOws()
+            ? "\n\n⚠ Key stored in plaintext at ~/.agentwonderland/config.json. Run wallet_setup({ action: \"enable-ows\" }) to install encrypted at-rest storage — takes ~30s."
+            : "\n\n⚠ Key stored in plaintext at ~/.agentwonderland/config.json. OWS encrypted storage isn't available for your platform.";
           return text(
             [
-              "Key imported [plaintext — install OWS for encrypted storage]:",
+              "Key imported:",
               `  Address: ${kp.publicKey.toBase58()}`,
               `  Name: ${walletName}`,
               `  Chains: solana`,
               `  Consumer principal: ${principal}`,
-              "",
-              "For encrypted storage, install OWS: npm install -g @open-wallet-standard/core",
-            ].join("\n"),
+            ].join("\n") + owsNudge,
           );
         } catch (err) {
           return text(
@@ -412,16 +458,17 @@ export function registerWalletTools(server: McpServer): void {
         });
         const principal = await ensureConsumerPrincipal();
 
+        const owsNudge = platformSupportsOws()
+          ? "\n\n⚠ Key stored in plaintext at ~/.agentwonderland/config.json. Run wallet_setup({ action: \"enable-ows\" }) to install encrypted at-rest storage — takes ~30s."
+          : "\n\n⚠ Key stored in plaintext at ~/.agentwonderland/config.json. OWS encrypted storage isn't available for your platform.";
         return text(
           [
-            `Key imported [plaintext] \u2014 OWS not available for encrypted storage.`,
+            `Key imported:`,
             `  Address: ${account.address}`,
             `  Name: ${walletName}`,
             `  Chains: ${selectedChains.join(", ")}`,
             `  Consumer principal: ${principal}`,
-            "",
-            "Install OWS for encrypted storage: npm install -g @open-wallet-standard/core",
-          ].join("\n"),
+          ].join("\n") + owsNudge,
         );
       } catch {
         return text("Error: Invalid private key format.");