@aibtc/mcp-server 1.58.0 → 1.60.0

package/dist/tools/news.tools.js

@@ -56,21 +56,18 @@ async function getNextNonce(address) {
     const hiroApi = getHiroApi(NETWORK);
     const accountInfo = await hiroApi.getAccountInfo(address);
     const confirmedNonce = accountInfo.nonce;
+    // The mempool scan is what makes the nonce safe against pending txs —
+    // silently skipping it on failure risks a nonce collision, so let it fail.
     let highestMempoolNonce = -1;
-    try {
-        const mempool = await hiroApi.getMempoolTransactions({
-            sender_address: address,
-            limit: 50,
-        });
-        for (const tx of mempool.results) {
-            if (tx.nonce > highestMempoolNonce) {
-                highestMempoolNonce = tx.nonce;
-            }
+    const mempool = await hiroApi.getMempoolTransactions({
+        sender_address: address,
+        limit: 50,
+    });
+    for (const tx of mempool.results) {
+        if (tx.nonce > highestMempoolNonce) {
+            highestMempoolNonce = tx.nonce;
         }
     }
-    catch {
-        // Non-fatal
-    }
     const chainNext = Math.max(confirmedNonce, highestMempoolNonce + 1);
     await reconcileWithChain(address, chainNext);
     return Math.max(chainNext, localNext ?? 0);
@@ -466,10 +463,11 @@ Fields:
     server.registerTool("news_file_signal", {
         description: `File a signal on a beat at aibtc.news.
 
-Requires an unlocked wallet with a P2WPKH (bc1q) BTC address and sBTC balance
-for the x402 payment. The tool handles the full payment flow:
-1. POST with BIP-322 auth → receive 402 payment challenge
-2. Build sponsored sBTC transfer (relay pays gas)
+Filing is free — no payment required. Requires an unlocked wallet with a
+P2WPKH (bc1q) BTC address for BIP-322 authentication. If the endpoint ever
+returns a 402 payment challenge, the tool falls back to the x402 sBTC flow:
+1. POST with BIP-322 auth → signal filed (or receive 402 payment challenge)
+2. On 402: build sponsored sBTC transfer (relay pays gas)
 3. Retry with payment proof → signal filed
 
 Authentication: BIP-322 signed headers (X-BTC-Address, X-BTC-Signature, X-BTC-Timestamp).

package/dist/tools/pillar-direct.tools.js

@@ -2,7 +2,7 @@ import { z } from "zod";
 import crypto from "crypto";
 import { tupleCV, stringAsciiCV, uintCV, principalCV, noneCV, trueCV, falseCV, } from "@stacks/transactions";
 import { getSigningKeyService, generateAuthId, } from "../services/signing-key.service.js";
-import { getPillarApi } from "../services/pillar-api.service.js";
+import { getPillarApi, PillarApiError } from "../services/pillar-api.service.js";
 import { getHiroApi } from "../services/hiro-api.js";
 import { NETWORK } from "../config/networks.js";
 import { PILLAR_API_KEY } from "../config/pillar.js";
@@ -497,8 +497,12 @@ export function registerPillarDirectTools(server) {
                 const walletInfo = await api.get(`/api/smart-wallet/${walletName}`);
                 walletStatus = walletInfo.data?.status || null;
             }
-            catch {
-                // Wallet not found in backend
+            catch (error) {
+                // 404 = wallet not registered in backend. Anything else (network,
+                // 5xx) must surface, or an initialized wallet gets misreported.
+                if (!(error instanceof PillarApiError && error.status === 404)) {
+                    throw error;
+                }
             }
             if (!walletStatus || walletStatus === "pending_init") {
                 return createJsonResponse({
@@ -554,8 +558,11 @@ export function registerPillarDirectTools(server) {
                 });
                 position = unwindQuote.data;
             }
-            catch {
-                // unwind-quote may fail for fresh wallets with no position
+            catch (error) {
+                // 4xx = fresh wallet with no position. Infra failures must surface.
+                if (!(error instanceof PillarApiError && error.status < 500)) {
+                    throw error;
+                }
             }
             return createJsonResponse({
                 success: true,
@@ -1146,21 +1153,16 @@ export function registerPillarDirectTools(server) {
                 const frac = (micro % BigInt(1_000_000)).toString().padStart(6, "0");
                 return `${whole}.${frac} STX`;
             };
-            // Fetch PoX cycle info
-            let poxInfo = null;
-            try {
-                const pox = await hiro.getPoxInfo();
-                poxInfo = {
-                    currentCycleId: pox.current_cycle.id,
-                    nextCycleId: pox.next_cycle.id,
-                    blocksUntilNextCycle: pox.next_cycle.blocks_until_reward_phase,
-                    minAmountUstx: pox.min_amount_ustx,
-                    isPoxActive: pox.current_cycle.is_pox_active,
-                };
-            }
-            catch {
-                // PoX info fetch failed, continue without it
-            }
+            // Fetch PoX cycle info — a global endpoint with no "not found" case,
+            // so any failure is infrastructure and should surface.
+            const pox = await hiro.getPoxInfo();
+            const poxInfo = {
+                currentCycleId: pox.current_cycle.id,
+                nextCycleId: pox.next_cycle.id,
+                blocksUntilNextCycle: pox.next_cycle.blocks_until_reward_phase,
+                minAmountUstx: pox.min_amount_ustx,
+                isPoxActive: pox.current_cycle.is_pox_active,
+            };
             // Check enrollment status via backend
             const api = getPillarApi();
             const contractParts = session.smartWallet.split(".");
@@ -1175,8 +1177,13 @@ export function registerPillarDirectTools(server) {
                     };
                 }
             }
-            catch {
-                // Backend lookup failed, continue without enrollment info
+            catch (error) {
+                // 404 = wallet not registered, so not enrolled. Other failures
+                // must surface — defaulting to enrolled:false on a backend outage
+                // misreports an enrolled wallet and could prompt re-enrollment.
+                if (!(error instanceof PillarApiError && error.status === 404)) {
+                    throw error;
+                }
             }
             const isStacking = lockedMicro > BigInt(0);
             return createJsonResponse({

package/dist/tools/sbtc.tools.js

@@ -283,16 +283,9 @@ Signers later process the request and send BTC on L1.`,
         description: "Get information about how to deposit BTC to receive sBTC.",
     }, async () => {
         try {
-            // Try to get wallet account (don't throw if not unlocked)
+            // getActiveAccount returns null when locked - generic instructions then
             const walletManager = getWalletManager();
-            let account;
-            try {
-                account = walletManager.getActiveAccount();
-            }
-            catch {
-                // Wallet not unlocked - return generic instructions
-                account = null;
-            }
+            const account = walletManager.getActiveAccount();
             // If wallet is unlocked and has Taproot keys, generate real deposit address
             if (account?.taprootPublicKey) {
                 const depositService = getSbtcDepositService(NETWORK);

package/dist/tools/scaffold.tools.js

@@ -8,20 +8,15 @@ import { getWalletAddress } from "../services/x402.service.js";
  * Check if a directory contains an existing x402 project
  */
 async function isExistingX402Project(dir) {
-    try {
-        const indexPath = path.join(dir, "src", "index.ts");
-        const middlewarePath = path.join(dir, "src", "x402-middleware.ts");
-        const packagePath = path.join(dir, "package.json");
-        const [hasIndex, hasMiddleware, hasPackage] = await Promise.all([
-            fs.access(indexPath).then(() => true).catch(() => false),
-            fs.access(middlewarePath).then(() => true).catch(() => false),
-            fs.access(packagePath).then(() => true).catch(() => false),
-        ]);
-        return hasIndex && hasMiddleware && hasPackage;
-    }
-    catch {
-        return false;
-    }
+    const indexPath = path.join(dir, "src", "index.ts");
+    const middlewarePath = path.join(dir, "src", "x402-middleware.ts");
+    const packagePath = path.join(dir, "package.json");
+    const [hasIndex, hasMiddleware, hasPackage] = await Promise.all([
+        fs.access(indexPath).then(() => true).catch(() => false),
+        fs.access(middlewarePath).then(() => true).catch(() => false),
+        fs.access(packagePath).then(() => true).catch(() => false),
+    ]);
+    return hasIndex && hasMiddleware && hasPackage;
 }
 /**
  * Validate that a project directory does not already exist.

package/dist/tools/stacking-lottery.tools.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { uintCV, contractPrincipalCV, PostConditionMode, deserializeCV, cvToJSON, } from "@stacks/transactions";
 import { getAccount, NETWORK } from "../services/x402.service.js";
-import { getHiroApi } from "../services/hiro-api.js";
+import { getHiroApi, isNotFoundError } from "../services/hiro-api.js";
 import { callContract } from "../transactions/builder.js";
 import { getExplorerTxUrl } from "../config/networks.js";
 import { createJsonResponse, createErrorResponse } from "../utils/index.js";
@@ -100,14 +100,17 @@ Note: Stackspot is only available on mainnet.`,
                 try {
                     currentValueUstx = await callPotReadOnly(pot.contractName, "get-pot-value", []);
                 }
-                catch {
-                    // pot may not be deployed or reachable — skip gracefully
+                catch (error) {
+                    // 404 = pot contract not deployed; other failures surface
+                    if (!isNotFoundError(error))
+                        throw error;
                 }
                 try {
                     isLocked = await callPotReadOnly(pot.contractName, "is-locked", []);
                 }
-                catch {
-                    // same
+                catch (error) {
+                    if (!isNotFoundError(error))
+                        throw error;
                 }
                 return {
                     name: pot.name,

package/dist/tools/yield-dashboard.tools.js

@@ -251,21 +251,17 @@ async function readStackingPosition(walletAddress) {
     return pos;
 }
 async function getWalletBalances(walletAddress) {
-    try {
-        const res = await fetch(`${MAINNET_HIRO_API}/extended/v1/address/${walletAddress}/balances`);
-        if (!res.ok)
-            return { stxMicroStx: 0, sbtcSats: 0 };
-        const data = (await res.json());
-        const stxMicroStx = parseInt(data.stx?.balance ?? "0", 10);
-        const sbtcKey = Object.keys(data.fungible_tokens ?? {}).find((k) => k.toLowerCase().includes("sbtc"));
-        const sbtcSats = sbtcKey
-            ? parseInt(data.fungible_tokens?.[sbtcKey]?.balance ?? "0", 10)
-            : 0;
-        return { stxMicroStx, sbtcSats };
-    }
-    catch {
-        return { stxMicroStx: 0, sbtcSats: 0 };
+    const res = await fetch(`${MAINNET_HIRO_API}/extended/v1/address/${walletAddress}/balances`);
+    if (!res.ok) {
+        throw new Error(`Failed to fetch wallet balances for ${walletAddress}: HTTP ${res.status}`);
     }
+    const data = (await res.json());
+    const stxMicroStx = parseInt(data.stx?.balance ?? "0", 10);
+    const sbtcKey = Object.keys(data.fungible_tokens ?? {}).find((k) => k.toLowerCase().includes("sbtc"));
+    const sbtcSats = sbtcKey
+        ? parseInt(data.fungible_tokens?.[sbtcKey]?.balance ?? "0", 10)
+        : 0;
+    return { stxMicroStx, sbtcSats };
 }
 async function checkZestV2() {
     try {

package/dist/transactions/builder.js

@@ -3,6 +3,7 @@ import { hexToBytes } from "@stacks/common";
 import { getStacksNetwork, getApiBaseUrl } from "../config/networks.js";
 import { getHiroApi } from "../services/hiro-api.js";
 import { resolveDefaultFee } from "../utils/fee.js";
+import { getSpendLimiter } from "../services/spend-limiter.js";
 import { getTrackedNonce, recordNonceUsed, resetTrackedNonce, reconcileWithChain, } from "../services/nonce-tracker.js";
 // ---------------------------------------------------------------------------
 // Pending nonce tracking (unified via SharedNonceTracker, issue #413)
@@ -82,6 +83,9 @@ export function advancePendingNonce(address, nonce, txid = "") {
  * @param fee Optional fee in micro-STX. If omitted, a medium-priority clamped fee is resolved.
  */
 export async function transferStx(account, recipient, amount, memo, fee) {
+    // Safety rail: block before signing if this would exceed the wallet's
+    // cumulative spending limit (per-session or per-day).
+    await getSpendLimiter().check("ustx", amount, account.address);
     const networkName = getStacksNetwork(account.network);
     const nonce = await getNextNonce(account.address, account.network);
     // Always resolve a clamped fee — prevents @stacks/transactions from over-estimating.
@@ -103,6 +107,7 @@ export async function transferStx(account, recipient, amount, memo, fee) {
         throw new Error(`Broadcast failed: ${broadcastResponse.error} - ${broadcastResponse.reason}`);
     }
     advancePendingNonce(account.address, nonce, broadcastResponse.txid);
+    await getSpendLimiter().record("ustx", amount, account.address);
     return {
         txid: broadcastResponse.txid,
         rawTx: transaction.serialize(),

package/dist/utils/encryption.js

@@ -37,6 +37,7 @@ export async function encrypt(plaintext, password) {
     const key = await deriveKey(password, salt);
     // Encrypt with AES-256-GCM
     const cipher = crypto.createCipheriv("aes-256-gcm", key, iv);
+    key.fill(0); // cipher holds its own copy
     const encrypted = Buffer.concat([
         cipher.update(plaintext, "utf8"),
         cipher.final(),
@@ -64,6 +65,7 @@ export async function decrypt(encrypted, password) {
     const key = await deriveKeyWithParams(password, salt, encrypted.scryptParams);
     // Decrypt with AES-256-GCM
     const decipher = crypto.createDecipheriv("aes-256-gcm", key, iv);
+    key.fill(0); // decipher holds its own copy
     decipher.setAuthTag(authTag);
     try {
         const decrypted = Buffer.concat([

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aibtc/mcp-server",
-  "version": "1.58.0",
+  "version": "1.60.0",
   "description": "Bitcoin-native MCP server for AI agents: BTC/STX wallets, DeFi yield, sBTC peg, NFTs, and x402 payments.",
   "mcpName": "io.github.aibtcdev/mcp-server",
   "type": "module",
@@ -14,13 +14,18 @@
     "dev": "tsx src/index.ts",
     "test": "vitest run",
     "test:watch": "vitest",
+    "prepare": "git config core.hooksPath >/dev/null 2>&1 || git config core.hooksPath .githooks 2>/dev/null || true",
     "prepublishOnly": "npm run build"
   },
   "files": [
     "dist",
+    "!dist/**/*.map",
     "README.md",
     "skill"
   ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
   "keywords": [
     "claude",
     "claude-code",
@@ -60,7 +65,7 @@
     "@stacks/transactions": "^7.3.1",
     "@stacks/wallet-sdk": "^7.2.0",
     "alex-sdk": "^3.2.1",
-    "axios": "^1.15.0",
+    "axios": "^1.17.0",
     "dotenv": "^17.3.1",
     "light-bolt11-decoder": "^3.2.0",
     "micro-ordinals": "^0.3.0",
@@ -68,7 +73,7 @@
     "path-to-regexp": "^8.4.0",
     "sbtc": "^0.3.2",
     "tslib": "^2.8.1",
-    "ws": "^8.19.0",
+    "ws": "^8.21.0",
     "x402-stacks": "^2.0.3",
     "zod": "^4.3.6"
   },
@@ -77,9 +82,10 @@
     "@types/ws": "^8.18.1",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",
-    "vitest": "^4.0.18"
+    "vitest": "^4.1.8"
   },
   "overrides": {
-    "lodash": "^4.18.0"
+    "lodash": "^4.18.0",
+    "axios": "^1.17.0"
   }
 }

package/skill/SKILL.md

@@ -4,7 +4,7 @@ description: Bitcoin L1 wallet for agents - check balances, send BTC, manage UTX
 license: MIT
 metadata:
   author: aibtcdev
-  version: 1.58.0 # x-release-please-version
+  version: 1.60.0 # x-release-please-version
   npm: "@aibtc/mcp-server"
   github: https://github.com/aibtcdev/aibtc-mcp-server
 ---