@aibtc/mcp-server 1.64.2 → 1.65.1

package/dist/index.js

@@ -7,6 +7,7 @@ import { createRequire } from "module";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { registerAllTools } from "./tools/index.js";
+import { installBountyHint } from "./tools/bounty-hint.js";
 import { NETWORK, API_URL } from "./config/index.js";
 import { redactSensitive } from "./utils/redact.js";
 import { initializeStorage } from "./utils/storage.js";
@@ -253,9 +254,26 @@ else {
     const server = new McpServer({
         name: "aibtc-mcp-server",
         version: packageJson.version,
+    }, {
+        instructions: [
+            "This server lets an agent earn and move real Bitcoin/sBTC on Stacks.",
+            "",
+            "Hunt bounties. The most direct way to earn here is the sBTC bounty board:",
+            "call bounty_list to see open bounties, bounty_get for the task detail, do",
+            "the work, then bounty_submit your deliverable. Accepted submissions are paid",
+            "in sBTC. Check periodically for new open bounties.",
+            "",
+            "For the full menu of ways to put assets to work (stacking, DeFi yield,",
+            "trading, paid endpoints), call earning_opportunities. Submitting to a bounty",
+            "requires a Registered (L1+) on-chain identity — see identity_register.",
+        ].join("\n"),
     });
+    // Append a bounty-board hint to spend/onboarding-tool output.
+    // Must wrap registerTool before registration; restore it after.
+    const restoreBountyHint = installBountyHint(server);
     // Register all tools from the modular registry
     registerAllTools(server);
+    restoreBountyHint();
     async function main() {
         await initializeStorage();
         const transport = new StdioServerTransport();

package/dist/services/x402.service.d.ts

@@ -9,6 +9,28 @@ export declare class X402RateLimitError extends Error {
     readonly retryAfterSeconds: number;
     constructor(message: string, retryAfterSeconds: number);
 }
+/**
+ * How long a completed x402 request suppresses an identical repeat.
+ *
+ * This was 60s, which is shorter than a realistic agent retry: an agent that
+ * reports a failure to its operator and retries takes minutes, not seconds.
+ * In the incident behind #630 the two payments landed 362s apart — 6x the old
+ * window — so the guard never engaged and the endpoint was paid twice.
+ *
+ * The asymmetry favours a long window: a false dedup hit costs a wait (and
+ * still returns the prior txid so the caller can verify), while a miss costs a
+ * duplicate on-chain payment that cannot be reversed. Deliberate repeat
+ * purchases of the same endpoint with the same params must wait it out or vary
+ * a param; raise or lower via X402_DEDUP_TTL_SECONDS.
+ */
+export declare const X402_DEDUP_TTL_MS: number;
+/**
+ * Point the dedup cache at a different state file and drop what is in memory.
+ *
+ * Also the seam tests use to simulate a restart: re-pointing at the same file
+ * clears memory and forces the next read to come off disk.
+ */
+export declare function setDedupStateFile(file: string): void;
 /**
  * Convert mnemonic to account
  */
@@ -168,14 +190,21 @@ export declare function probeEndpoint(options: {
  */
 export declare function generateDedupKey(method: string, url: string, params?: Record<string, string>, data?: Record<string, unknown>): string;
 /**
- * Check if a request was recently processed (within 60s)
+ * Check if a request was recently processed (within X402_DEDUP_TTL_MS).
+ *
+ * Loads persisted entries first so a payment broadcast before a server restart
+ * still suppresses the retry that follows it.
+ *
  * @returns txid if duplicate found, null otherwise
  */
-export declare function checkDedupCache(key: string): string | null;
+export declare function checkDedupCache(key: string): Promise<string | null>;
 /**
- * Record a transaction in the dedup cache
+ * Record a transaction in the dedup cache and persist it.
+ *
+ * Awaits the write so the entry survives a crash immediately after a payment —
+ * the window where losing it costs a duplicate payment.
  */
-export declare function recordTransaction(key: string, txid: string): void;
+export declare function recordTransaction(key: string, txid: string): Promise<void>;
 /**
  * Check if account has sufficient balance to pay for x402 endpoint.
  * @throws InsufficientBalanceError if balance is too low

package/dist/services/x402.service.js

@@ -10,6 +10,9 @@ import { formatStx, formatSbtc } from "../utils/formatting.js";
 import { getSbtcService } from "./sbtc.service.js";
 import { getHiroApi } from "./hiro-api.js";
 import { createHash } from "crypto";
+import { promises as fs } from "fs";
+import os from "os";
+import path from "path";
 import { InsufficientBalanceError } from "../utils/errors.js";
 import { getContracts, parseContractId } from "../config/contracts.js";
 import { resolveDefaultFee } from "../utils/fee.js";
@@ -104,13 +107,167 @@ export class X402RateLimitError extends Error {
         this.name = "X402RateLimitError";
     }
 }
+/**
+ * How long a completed x402 request suppresses an identical repeat.
+ *
+ * This was 60s, which is shorter than a realistic agent retry: an agent that
+ * reports a failure to its operator and retries takes minutes, not seconds.
+ * In the incident behind #630 the two payments landed 362s apart — 6x the old
+ * window — so the guard never engaged and the endpoint was paid twice.
+ *
+ * The asymmetry favours a long window: a false dedup hit costs a wait (and
+ * still returns the prior txid so the caller can verify), while a miss costs a
+ * duplicate on-chain payment that cannot be reversed. Deliberate repeat
+ * purchases of the same endpoint with the same params must wait it out or vary
+ * a param; raise or lower via X402_DEDUP_TTL_SECONDS.
+ */
+export const X402_DEDUP_TTL_MS = parseSatsCap("X402_DEDUP_TTL_SECONDS", 900) * 1000; // 15 minutes
 // Transaction deduplication cache: {dedupKey -> {txid, timestamp}}
 const dedupCache = new Map();
+/**
+ * Where the dedup cache is persisted.
+ *
+ * Memory alone left the guard open to the same double-pay it exists to stop: an
+ * MCP server restarts routinely (client reconnect, config change, crash), and a
+ * restart inside the TTL window dropped every entry. An agent retrying after one
+ * sailed past the guard and paid a second time — #630's outcome reached by a
+ * different route.
+ *
+ * Keys are SHA-256 digests (see generateDedupKey) and values are chain txids, so
+ * no request content reaches disk. The file is still written 0600 under a 0700
+ * directory to match the wallet store.
+ *
+ * Caveat: entries are keyed by request, not by payer. Switching wallets and
+ * repeating a request inside the window reports a hit for the other wallet's
+ * payment. That is the asymmetry the TTL already takes — a false hit costs a
+ * wait and still surfaces the prior txid to verify, while a miss costs an
+ * irreversible duplicate payment.
+ *
+ * Override the location with X402_DEDUP_STATE_FILE.
+ */
+let dedupStateFile = process.env.X402_DEDUP_STATE_FILE ||
+    path.join(os.homedir(), ".aibtc", "x402-dedup.json");
+let dedupLoad = null;
+let dedupWriteLock = Promise.resolve();
+/**
+ * Point the dedup cache at a different state file and drop what is in memory.
+ *
+ * Also the seam tests use to simulate a restart: re-pointing at the same file
+ * clears memory and forces the next read to come off disk.
+ */
+export function setDedupStateFile(file) {
+    dedupStateFile = file;
+    dedupLoad = null;
+    dedupCache.clear();
+}
+function isFresh(entry, now) {
+    return now - entry.timestamp <= X402_DEDUP_TTL_MS;
+}
+/** Read persisted entries. A missing file is the normal first-run case. */
+async function readDedupState() {
+    let raw;
+    try {
+        raw = await fs.readFile(dedupStateFile, "utf8");
+    }
+    catch (err) {
+        if (err.code !== "ENOENT") {
+            console.error(`[x402-dedup] Could not read ${dedupStateFile}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        return {};
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== "object")
+            return {};
+        return parsed;
+    }
+    catch {
+        // A corrupt file must not brick every x402 call. Report it and continue
+        // with the in-memory guard; the next write replaces the file.
+        console.error(`[x402-dedup] Ignoring corrupt state at ${dedupStateFile}`);
+        return {};
+    }
+}
+/**
+ * Load persisted entries into memory once per state file.
+ *
+ * Must be awaited before any dedup read: answering from a not-yet-loaded cache
+ * would report "no prior payment" for one that is sitting on disk, which is the
+ * exact miss this persistence closes.
+ */
+async function ensureDedupLoaded() {
+    if (!dedupLoad) {
+        dedupLoad = (async () => {
+            const persisted = await readDedupState();
+            const now = Date.now();
+            for (const [key, entry] of Object.entries(persisted)) {
+                if (!entry ||
+                    typeof entry.txid !== "string" ||
+                    typeof entry.timestamp !== "number") {
+                    continue;
+                }
+                if (!isFresh(entry, now))
+                    continue;
+                // Anything recorded in this process is at least as fresh as disk.
+                const existing = dedupCache.get(key);
+                if (!existing || existing.timestamp < entry.timestamp) {
+                    dedupCache.set(key, entry);
+                }
+            }
+        })();
+    }
+    return dedupLoad;
+}
+/**
+ * Merge memory over disk and write atomically, dropping expired entries.
+ *
+ * Re-reads inside the lock so a second server instance sharing the file does not
+ * lose the entries this one never saw. A failure here is logged rather than
+ * thrown: the caller records *after* funds have already moved, so rejecting
+ * would turn a recorded payment into a reported error while leaving the
+ * in-memory guard intact.
+ */
+async function persistDedupCache() {
+    dedupWriteLock = dedupWriteLock
+        .then(async () => {
+        const onDisk = await readDedupState();
+        const now = Date.now();
+        const merged = {};
+        for (const [key, entry] of Object.entries(onDisk)) {
+            if (entry &&
+                typeof entry.txid === "string" &&
+                typeof entry.timestamp === "number" &&
+                isFresh(entry, now)) {
+                merged[key] = entry;
+            }
+        }
+        for (const [key, entry] of dedupCache) {
+            if (!isFresh(entry, now))
+                continue;
+            const existing = merged[key];
+            if (!existing || existing.timestamp <= entry.timestamp) {
+                merged[key] = entry;
+            }
+        }
+        await fs.mkdir(path.dirname(dedupStateFile), {
+            recursive: true,
+            mode: 0o700,
+        });
+        // pid-suffixed so concurrent servers do not clobber each other's temp.
+        const tmp = `${dedupStateFile}.${process.pid}.tmp`;
+        await fs.writeFile(tmp, JSON.stringify(merged), { mode: 0o600 });
+        await fs.rename(tmp, dedupStateFile);
+    })
+        .catch((err) => {
+        console.error(`[x402-dedup] Could not persist ${dedupStateFile}: ${err instanceof Error ? err.message : String(err)}`);
+    });
+    return dedupWriteLock;
+}
 // Cleanup expired dedup entries every 5 minutes
 setInterval(() => {
     const now = Date.now();
     for (const [key, value] of dedupCache) {
-        if (now - value.timestamp > 60000) {
+        if (!isFresh(value, now)) {
             dedupCache.delete(key);
         }
     }
@@ -845,26 +1002,36 @@ export function generateDedupKey(method, url, params, data) {
     return createHash('sha256').update(payload).digest('hex');
 }
 /**
- * Check if a request was recently processed (within 60s)
+ * Check if a request was recently processed (within X402_DEDUP_TTL_MS).
+ *
+ * Loads persisted entries first so a payment broadcast before a server restart
+ * still suppresses the retry that follows it.
+ *
  * @returns txid if duplicate found, null otherwise
  */
-export function checkDedupCache(key) {
+export async function checkDedupCache(key) {
+    await ensureDedupLoaded();
     const cached = dedupCache.get(key);
     if (!cached) {
         return null;
     }
     const now = Date.now();
-    if (now - cached.timestamp > 60000) {
+    if (!isFresh(cached, now)) {
         dedupCache.delete(key);
         return null;
     }
     return cached.txid;
 }
 /**
- * Record a transaction in the dedup cache
+ * Record a transaction in the dedup cache and persist it.
+ *
+ * Awaits the write so the entry survives a crash immediately after a payment —
+ * the window where losing it costs a duplicate payment.
  */
-export function recordTransaction(key, txid) {
+export async function recordTransaction(key, txid) {
+    await ensureDedupLoaded();
     dedupCache.set(key, { txid, timestamp: Date.now() });
+    await persistDedupCache();
 }
 /**
  * Check if account has sufficient balance to pay for x402 endpoint.

package/dist/tools/bounty-hint.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Bounty hint injector.
+ *
+ * Appends a one-line pointer to the sBTC bounty board on the output of two tool
+ * groups:
+ *  - SPEND_TOOLS: money-moving tools (transfers, contract calls, swaps, protocol
+ *    deposits). When an agent has just moved value, remind it the board pays sBTC.
+ *  - ONBOARDING_TOOLS: identity registration and wallet creation/import. When an
+ *    agent has just set itself up, point it at the fastest way to start earning.
+ *
+ * Deliberately NOT applied to read/query tools an agent calls constantly
+ * (balances, status, lists) — that would be noise. Only these two groups get it.
+ *
+ * The hint is a separate text content block, static (no network call), and only
+ * added to successful results — never to errors, and never touching the tool's
+ * own JSON payload.
+ */
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+/**
+ * Tools that move or spend value. A hint is appended to their successful output.
+ */
+export declare const SPEND_TOOLS: ReadonlySet<string>;
+/**
+ * Onboarding tools. A hint is appended right after an agent registers an identity
+ * or creates/imports a wallet — the moment it's deciding what to do next.
+ */
+export declare const ONBOARDING_TOOLS: ReadonlySet<string>;
+/**
+ * Monkey-patch `server.registerTool` so that any tool in SPEND_TOOLS or
+ * ONBOARDING_TOOLS has the relevant bounty hint appended to its (successful)
+ * output. Must be called BEFORE registering the tools. No-op for every other tool.
+ *
+ * Returns a cleanup function that restores the original method, mirroring
+ * `withSkillMeta` in tools/index.ts — call it once registration is done.
+ */
+export declare function installBountyHint(server: McpServer): () => void;
+//# sourceMappingURL=bounty-hint.d.ts.map

package/dist/tools/bounty-hint.js

@@ -0,0 +1,121 @@
+/**
+ * Tools that move or spend value. A hint is appended to their successful output.
+ */
+export const SPEND_TOOLS = new Set([
+    // Core transfers / contract / swap chokepoints
+    "transfer_stx",
+    "transfer_btc",
+    "transfer_token",
+    "transfer_nft",
+    "transfer_rune",
+    "sbtc_transfer",
+    "call_contract",
+    "deploy_contract",
+    "bitflow_swap",
+    "alex_swap",
+    "lightning_pay_invoice",
+    // Stacking / PoX
+    "stack_stx",
+    "extend_stacking",
+    "dual_stacking_enroll",
+    // Zest lending
+    "zest_supply",
+    "zest_borrow",
+    "zest_repay",
+    // Pillar smart wallet (browser-handoff)
+    "pillar_supply",
+    "pillar_boost",
+    "pillar_unwind",
+    "pillar_send",
+    "pillar_fund",
+    "pillar_auto_compound",
+    // Pillar smart wallet (agent-signed direct)
+    "pillar_direct_supply",
+    "pillar_direct_boost",
+    "pillar_direct_unwind",
+    "pillar_direct_send",
+    "pillar_direct_stack_stx",
+    // JingSwap batch auction
+    "jingswap_deposit_stx",
+    "jingswap_deposit_sbtc",
+    // Styx BTC→sBTC
+    "styx_deposit",
+    // StackSpot lottery
+    "stackspot_join_pot",
+    "stackspot_start_pot",
+    // sBTC peg
+    "sbtc_deposit",
+    "sbtc_withdraw",
+    "sbtc_initiate_withdrawal",
+    // Inbox (direct sBTC send)
+    "send_inbox_message_direct",
+]);
+/**
+ * Onboarding tools. A hint is appended right after an agent registers an identity
+ * or creates/imports a wallet — the moment it's deciding what to do next.
+ */
+export const ONBOARDING_TOOLS = new Set([
+    "identity_register",
+    "wallet_create",
+    "wallet_import",
+]);
+const SPEND_HINT = "💰 Tip: the AIBTC bounty board pays sBTC for completed tasks — " +
+    "call bounty_list to see open bounties you could earn from.";
+const ONBOARDING_HINT = "💰 You're set up. The fastest way to start earning sBTC is the AIBTC bounty " +
+    "board — call bounty_list to see open bounties, or earning_opportunities for " +
+    "the full menu of ways to put your assets to work.";
+/** Resolve the hint text for a tool, or null if the tool gets no hint. */
+function hintFor(name) {
+    if (SPEND_TOOLS.has(name))
+        return SPEND_HINT;
+    if (ONBOARDING_TOOLS.has(name))
+        return ONBOARDING_HINT;
+    return null;
+}
+function appendHint(result, hint) {
+    // Never annotate an error result — the agent should see the failure cleanly.
+    if (!result || result.isError)
+        return result;
+    const content = Array.isArray(result.content) ? result.content : [];
+    return {
+        ...result,
+        content: [...content, { type: "text", text: hint }],
+    };
+}
+/**
+ * Monkey-patch `server.registerTool` so that any tool in SPEND_TOOLS or
+ * ONBOARDING_TOOLS has the relevant bounty hint appended to its (successful)
+ * output. Must be called BEFORE registering the tools. No-op for every other tool.
+ *
+ * Returns a cleanup function that restores the original method, mirroring
+ * `withSkillMeta` in tools/index.ts — call it once registration is done.
+ */
+export function installBountyHint(server) {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const original = server.registerTool;
+    const hasOwn = Object.prototype.hasOwnProperty.call(server, "registerTool");
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    server.registerTool = function (name, config, cb) {
+        const hint = hintFor(name);
+        if (!hint) {
+            return original.call(server, name, config, cb);
+        }
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const wrapped = async (...args) => {
+            const result = await cb(...args);
+            return appendHint(result, hint);
+        };
+        return original.call(server, name, config, wrapped);
+    };
+    return () => {
+        if (hasOwn) {
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            server.registerTool = original;
+        }
+        else {
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            delete server.registerTool;
+        }
+    };
+}
+//# sourceMappingURL=bounty-hint.js.map

package/dist/tools/endpoint.tools.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { createApiClient, API_URL, probeEndpoint, formatPaymentAmount, checkSufficientBalance, generateDedupKey, checkDedupCache, recordTransaction, NETWORK } from "../services/x402.service.js";
+import { createApiClient, API_URL, probeEndpoint, formatPaymentAmount, checkSufficientBalance, generateDedupKey, checkDedupCache, recordTransaction, X402_DEDUP_TTL_MS, NETWORK } from "../services/x402.service.js";
 import { ALL_ENDPOINTS, searchEndpoints, formatEndpointsTable, getEndpointsBySource, getCategories, } from "../endpoints/registry.js";
 import { createJsonResponse, createErrorResponse } from "../utils/index.js";
 import { X402_HEADERS } from "../utils/x402-protocol.js";
@@ -270,6 +270,9 @@ For aibtc.com inbox messages, use send_inbox_message_direct instead — it signs
         },
     }, async ({ method, url, path, apiUrl, params, data, autoApprove, asset }) => {
         let fullUrl = "";
+        // Hoisted so the catch can record a broadcast payment for dedup — a
+        // failed settlement still spends real funds (#630).
+        let dedupKey = null;
         try {
             const parsed = parseEndpointUrl({ url, path, apiUrl, params });
             fullUrl = parsed.fullUrl;
@@ -281,14 +284,27 @@ For aibtc.com inbox messages, use send_inbox_message_direct instead — it signs
             // autoApprove=true: check dedup cache before any network request, then execute
             // with a single request. Balance validation happens inside the onBeforePayment
             // callback when the interceptor receives the 402, eliminating the separate probe.
-            const dedupKey = generateDedupKey(method, fullUrl, params, data);
-            const existingTxid = checkDedupCache(dedupKey);
+            dedupKey = generateDedupKey(method, fullUrl, params, data);
+            const existingTxid = await checkDedupCache(dedupKey);
             if (existingTxid) {
+                const windowSeconds = Math.round(X402_DEDUP_TTL_MS / 1000);
+                const pending = existingTxid.startsWith("pending:");
                 return createJsonResponse({
                     endpoint: `${method} ${fullUrl}`,
-                    message: 'Request already processed within the last 60 seconds. This prevents accidental duplicate payments.',
-                    txid: existingTxid,
-                    note: 'Wait 60s or use different endpoint/params to force a new transaction.',
+                    // Deliberately says "broadcast", not "paid": the entry is written
+                    // whenever a payment was signed and broadcast, including when
+                    // settlement then reported an error. Claiming it succeeded would
+                    // be wrong in exactly the cases the caller most needs to check.
+                    message: `An identical request already broadcast a payment within the last ${windowSeconds} seconds. This prevents accidental duplicate payments.`,
+                    // A prior attempt whose txid was never observable is recorded with a
+                    // synthetic marker. Report it as null rather than leaking the marker,
+                    // which is not a chain txid and must not be treated as one.
+                    txid: pending ? null : existingTxid,
+                    ...(pending && {
+                        txidNote: "The earlier payment was broadcast but its txid was not observable in the response. " +
+                            "Query get_account_transactions to find the settled txid before paying again.",
+                    }),
+                    note: `The earlier payment may have settled even if it reported an error — verify it before retrying. Wait ${windowSeconds}s or vary the endpoint/params to force a new transaction.`,
                 });
             }
             const api = await createApiClient(parsed.baseUrl, {
@@ -321,7 +337,7 @@ For aibtc.com inbox messages, use send_inbox_message_direct instead — it signs
             // observable, using a synthetic pending marker that cannot be
             // confused for a real chain txid.
             if (paymentAttempted) {
-                recordTransaction(dedupKey, txid ?? `pending:${dedupKey}`);
+                await recordTransaction(dedupKey, txid ?? `pending:${dedupKey}`);
             }
             // Build the txid response fields per the behavior matrix:
             //   payment attempted + observable txid → { txid: "0x..." }
@@ -352,9 +368,20 @@ For aibtc.com inbox messages, use send_inbox_message_direct instead — it signs
             // interceptor in x402.service.ts) and return it so the agent can verify.
             const axiosError = error;
             const canonicalStatus = axiosError.x402PaymentStatus;
+            // The presence of this header means the interceptor signed and
+            // broadcast a payment. That spends real funds whether or not
+            // settlement succeeded, so record it for dedup before returning any
+            // error — otherwise an identical retry passes the dedup guard and pays
+            // a second time for an invoice already settled on chain (#630).
+            // Mirrors the success path, including the synthetic pending marker
+            // used when the txid is not yet observable.
+            const paymentSigHeader = axiosError.config?.headers?.[X402_HEADERS.PAYMENT_SIGNATURE];
+            if (paymentSigHeader && dedupKey) {
+                const broadcastTxid = extractTxidFromPaymentSignature(paymentSigHeader);
+                await recordTransaction(dedupKey, broadcastTxid ?? `pending:${dedupKey}`);
+            }
             if (canonicalStatus) {
                 const baseError = formatEndpointError(error, label);
-                const paymentSigHeader = axiosError.config?.headers?.[X402_HEADERS.PAYMENT_SIGNATURE];
                 const fallbackTxid = paymentSigHeader
                     ? extractTxidFromPaymentSignature(paymentSigHeader)
                     : null;
@@ -382,7 +409,6 @@ For aibtc.com inbox messages, use send_inbox_message_direct instead — it signs
                     content: [{ type: "text", text }],
                 };
             }
-            const paymentSigHeader = axiosError.config?.headers?.[X402_HEADERS.PAYMENT_SIGNATURE];
             if (paymentSigHeader) {
                 const txid = extractTxidFromPaymentSignature(paymentSigHeader);
                 const fallbackPaymentId = extractPaymentIdFromPaymentSignature(paymentSigHeader);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aibtc/mcp-server",
-  "version": "1.64.2",
+  "version": "1.65.1",
   "description": "Bitcoin-native MCP server for AI agents: BTC/STX wallets, DeFi yield, sBTC peg, NFTs, and x402 payments.",
   "mcpName": "io.github.aibtcdev/mcp-server",
   "type": "module",

package/skill/SKILL.md

@@ -4,7 +4,7 @@ description: Bitcoin L1 wallet for agents - check balances, send BTC, manage UTX
 license: MIT
 metadata:
   author: aibtcdev
-  version: 1.64.2 # x-release-please-version
+  version: 1.65.1 # x-release-please-version
   npm: "@aibtc/mcp-server"
   github: https://github.com/aibtcdev/aibtc-mcp-server
 ---