@aibtc/mcp-server 1.76.2 → 1.77.0

package/README.md

@@ -524,6 +524,21 @@ For autonomous agents, use `pillar_direct_*` tools (no browser needed).
 | `scaffold_x402_endpoint` | Generate x402 Cloudflare Worker project |
 | `scaffold_x402_ai_endpoint` | Generate x402 AI API with OpenRouter |
 
+### TaskMarket (Work Marketplace on Base)
+Read-only discovery of onchain agent work on [TaskMarket](https://taskmarket.dev) (USDC escrow on Base). The tools are public and anonymous: no wallet, no spend.
+
+| Tool | Description |
+|------|-------------|
+| `taskmarket_search` | List/search open tasks (filters: status, phase, mode, tags, reward range) |
+| `taskmarket_get` | Full task detail + live status by task ID |
+| `taskmarket_submissions` | List a task's submissions |
+| `taskmarket_stats` | Public market/agent statistics (reputation check) |
+
+### Inbox Messaging (aibtc.com)
+| Tool | Description |
+|------|-------------|
+| `send_inbox_message_direct` | Send a paid x402 message to another agent's inbox (sBTC cost; STX gas is sponsored when the inbox offers it) |
+
 ## Usage Examples
 
 **Wallet management:**

package/dist/services/taskmarket.service.d.ts

@@ -0,0 +1,92 @@
+/**
+ * TaskMarket service — read-only discovery.
+ *
+ * TaskMarket (https://taskmarket.dev) is an onchain agent work marketplace on
+ * Base: requesters escrow USDC, workers submit deliverables, and the requester
+ * accepts a winner. This service reads the public, anonymous API (search, get,
+ * list-submissions, market-stats). It never signs or spends.
+ */
+export interface TaskmarketTask {
+    id: string;
+    requester: string;
+    description: string;
+    reward: string;
+    netReward?: string;
+    escrowTxHash?: string;
+    createdAt: string;
+    expiryTime: string;
+    status: string;
+    phase?: string;
+    tags: string[];
+    mode?: string;
+    taskVisibility?: string;
+    submissionVisibility?: string;
+    submissionCount?: number;
+    platformFeeBps?: number;
+    requesterAgentId?: string;
+}
+export interface TaskmarketSubmission {
+    id: string;
+    taskId: string;
+    workerAddress: string;
+    workerAgentId?: string;
+    submittedAt: string;
+    rejectedAt?: string | null;
+    deliverableHash?: string;
+    submitTxHash?: string;
+    artifacts?: Array<{
+        id: string;
+        fileName: string;
+        mimeType: string;
+        sizeBytes?: number;
+        storageUri?: string;
+    }>;
+}
+/** Convert base-unit reward (e.g. "2000000") to human USDC (e.g. "2"). */
+export declare function baseUnitsToUsdc(raw: string | undefined | null): string;
+/** Convert human USDC (e.g. "2") to base units (e.g. "2000000"). */
+export declare function usdcToBaseUnits(amount: string): string;
+/**
+ * List/search tasks. Public, anonymous, read-only.
+ */
+export declare function listTasks(options: {
+    status?: string;
+    phase?: string;
+    mode?: string;
+    tags?: string;
+    rewardMin?: string;
+    rewardMax?: string;
+    limit?: number;
+    signal?: AbortSignal;
+}): Promise<{
+    tasks: TaskmarketTask[];
+    hasMore: boolean;
+    nextCursor: string | null;
+}>;
+/**
+ * Get a single task with its live status. Public, anonymous, read-only.
+ */
+export declare function getTask(taskId: string, signal?: AbortSignal): Promise<TaskmarketTask>;
+/**
+ * List submissions for a task so the requester can review them for real work.
+ * Public, anonymous, read-only. Never auto-accepts or auto-rejects anything.
+ */
+export declare function listSubmissions(taskId: string, signal?: AbortSignal): Promise<TaskmarketSubmission[]>;
+export interface TaskmarketStats {
+    address?: string;
+    agentId?: string;
+    completedTasks?: number;
+    ratedTasks?: number;
+    totalStars?: number;
+    averageRating?: number;
+    [key: string]: unknown;
+}
+/**
+ * Market/agent statistics. Anonymous read of a public stats endpoint.
+ */
+export declare function getMarketStats(options: {
+    address?: string;
+    agentId?: string;
+    signal?: AbortSignal;
+}): Promise<TaskmarketStats>;
+//# sourceMappingURL=taskmarket.service.d.ts.map

package/dist/services/taskmarket.service.js

@@ -0,0 +1,100 @@
+/**
+ * TaskMarket service — read-only discovery.
+ *
+ * TaskMarket (https://taskmarket.dev) is an onchain agent work marketplace on
+ * Base: requesters escrow USDC, workers submit deliverables, and the requester
+ * accepts a winner. This service reads the public, anonymous API (search, get,
+ * list-submissions, market-stats). It never signs or spends.
+ */
+const TASKMARKET_API_URL = process.env.TASKMARKET_API_URL || "https://api.taskmarket.dev";
+/** Bound every read so a hung TaskMarket API cannot hold a tool call open. */
+const READ_TIMEOUT_MS = 15_000;
+/** Convert base-unit reward (e.g. "2000000") to human USDC (e.g. "2"). */
+export function baseUnitsToUsdc(raw) {
+    if (!raw || !/^\d+$/.test(raw))
+        return "0";
+    const padded = raw.padStart(7, "0");
+    const whole = padded.slice(0, padded.length - 6) || "0";
+    const frac = padded.slice(padded.length - 6).replace(/0+$/, "");
+    return frac ? `${whole}.${frac}` : whole;
+}
+/** Convert human USDC (e.g. "2") to base units (e.g. "2000000"). */
+export function usdcToBaseUnits(amount) {
+    if (!/^\d+(\.\d+)?$/.test(amount)) {
+        throw new Error(`Invalid USDC amount: "${amount}"`);
+    }
+    const [whole, frac = ""] = amount.split(".");
+    if (frac.length > 6) {
+        throw new Error(`USDC amount has more than 6 decimals: "${amount}"`);
+    }
+    const wholeInt = BigInt(whole || "0");
+    const fracPadded = frac.padEnd(6, "0");
+    const fracInt = fracPadded ? BigInt(fracPadded) : 0n;
+    return (wholeInt * 1000000n + fracInt).toString();
+}
+async function apiGet(path, signal) {
+    const response = await fetch(`${TASKMARKET_API_URL}${path}`, {
+        signal: signal ?? AbortSignal.timeout(READ_TIMEOUT_MS),
+        headers: { accept: "application/json" },
+    });
+    if (!response.ok) {
+        const text = await response.text().catch(() => "Unknown error");
+        throw new Error(`TaskMarket API error ${response.status}: ${text}`);
+    }
+    const json = (await response.json());
+    return (json.data ?? json);
+}
+/**
+ * List/search tasks. Public, anonymous, read-only.
+ */
+export async function listTasks(options) {
+    const params = new URLSearchParams();
+    if (options.status)
+        params.set("status", options.status);
+    if (options.phase)
+        params.set("phase", options.phase);
+    if (options.mode)
+        params.set("mode", options.mode);
+    if (options.tags)
+        params.set("tags", options.tags);
+    if (options.rewardMin)
+        params.set("minReward", usdcToBaseUnits(options.rewardMin));
+    if (options.rewardMax)
+        params.set("maxReward", usdcToBaseUnits(options.rewardMax));
+    params.set("limit", String(options.limit ?? 20));
+    const result = await apiGet(`/api/tasks?${params.toString()}`, options.signal);
+    return {
+        tasks: result.tasks ?? [],
+        hasMore: result.hasMore ?? false,
+        nextCursor: result.nextCursor ?? null,
+    };
+}
+/**
+ * Get a single task with its live status. Public, anonymous, read-only.
+ */
+export async function getTask(taskId, signal) {
+    return apiGet(`/api/tasks/${taskId}`, signal);
+}
+/**
+ * List submissions for a task so the requester can review them for real work.
+ * Public, anonymous, read-only. Never auto-accepts or auto-rejects anything.
+ */
+export async function listSubmissions(taskId, signal) {
+    const result = await apiGet(`/api/tasks/${taskId}/submissions`, signal);
+    if (Array.isArray(result))
+        return result;
+    return (result.submissions ?? []);
+}
+/**
+ * Market/agent statistics. Anonymous read of a public stats endpoint.
+ */
+export async function getMarketStats(options) {
+    const params = new URLSearchParams();
+    if (options.address)
+        params.set("address", options.address);
+    if (options.agentId)
+        params.set("agentId", options.agentId);
+    const query = params.toString();
+    return apiGet(`/api/agents/stats${query ? `?${query}` : ""}`, options.signal);
+}
+//# sourceMappingURL=taskmarket.service.js.map

package/dist/tools/inbox-x402.tools.js

@@ -169,6 +169,8 @@ export function registerInboxX402Tools(server) {
                     privateKey: account.privateKey,
                     network: NETWORK,
                 };
+                // x402-stacks is CJS, so its AxiosInstance comes from axios' .d.cts
+                // types; ours comes from .d.ts. Same runtime object, different type.
                 const api = wrapAxiosWithPayment(axios.create({ timeout: 120_000 }), stacksAccount);
                 try {
                     response = await api.post(inboxUrl, body, {

package/dist/tools/index.js

@@ -52,6 +52,7 @@ import { registerInboxTools } from "./inbox.tools.js";
 import { registerInboxX402Tools } from "./inbox-x402.tools.js";
 import { registerArxivResearchTools } from "./arxiv-research.tools.js";
 import { registerEarningTools } from "./earning.tools.js";
+import { registerTaskmarketTools } from "./taskmarket.tools.js";
 import { getSkillForTool } from "./skill-mappings.js";
 import { isToolSelected } from "./profiles.js";
 /**
@@ -214,6 +215,8 @@ export function registerAllTools(server, selection) {
     inGroup("dev", registerArxivResearchTools);
     // Earning Opportunities (static "how to put your assets to work" menu)
     inGroup("earn", registerEarningTools);
+    // TaskMarket (onchain agent work marketplace on Base — read-only discovery + gated create)
+    inGroup("earn", registerTaskmarketTools);
     restoreRegisterTool();
 }
 //# sourceMappingURL=index.js.map

package/dist/tools/taskmarket.tools.d.ts

@@ -0,0 +1,12 @@
+/**
+ * TaskMarket Tools (https://taskmarket.dev) — onchain agent work marketplace on Base.
+ *
+ * Read tools (public, anonymous, no wallet, no spend):
+ * - taskmarket_search        — list/search open tasks (filters: status, phase, mode, tags, reward)
+ * - taskmarket_get           — full task detail + live status by task ID
+ * - taskmarket_submissions   — list submissions for a task
+ * - taskmarket_stats         — public market/agent statistics
+ */
+import { McpServer } from "@modelcontextprotocol/server";
+export declare function registerTaskmarketTools(server: McpServer): void;
+//# sourceMappingURL=taskmarket.tools.d.ts.map

package/dist/tools/taskmarket.tools.js

@@ -0,0 +1,166 @@
+/**
+ * TaskMarket Tools (https://taskmarket.dev) — onchain agent work marketplace on Base.
+ *
+ * Read tools (public, anonymous, no wallet, no spend):
+ * - taskmarket_search        — list/search open tasks (filters: status, phase, mode, tags, reward)
+ * - taskmarket_get           — full task detail + live status by task ID
+ * - taskmarket_submissions   — list submissions for a task
+ * - taskmarket_stats         — public market/agent statistics
+ */
+import { z } from "zod";
+import { createJsonResponse, createErrorResponse } from "../utils/index.js";
+import { baseUnitsToUsdc, getTask, getMarketStats, listSubmissions, listTasks, } from "../services/taskmarket.service.js";
+const TASK_ID_SCHEMA = z
+    .string()
+    .regex(/^0x[0-9a-fA-F]{64}$/)
+    .describe("TaskMarket task ID (0x + 64 hex chars)");
+export function registerTaskmarketTools(server) {
+    // ==========================================================================
+    // Read tools — no wallet required, never spends
+    // ==========================================================================
+    server.registerTool("taskmarket_search", {
+        description: "Search open tasks on the TaskMarket agent work marketplace (Base, USDC escrow). " +
+            "Public and anonymous — no wallet or payment needed. Returns tasks with ID, reward (USDC), " +
+            "status, submission count, deadline, and a short description so you can pick work to delegate. " +
+            "Never spends anything.",
+        inputSchema: z.object({
+            status: z.string().default("open").describe("Filter by status (default: open)"),
+            phase: z.string().optional().describe("Filter by lifecycle phase (active, in_review, awaiting_settlement, resolved)"),
+            mode: z.string().optional().describe("Filter by task mode (bounty, claim, pitch, benchmark, auction)"),
+            tags: z.string().optional().describe("Comma-separated tags to filter by (e.g. 'mcp,research')"),
+            rewardMin: z.string().optional().describe("Minimum reward in human USDC (e.g. 0.5)"),
+            rewardMax: z.string().optional().describe("Maximum reward in human USDC (e.g. 50)"),
+            limit: z.number().int().min(1).max(50).default(20).describe("Max results (1-50)"),
+        }),
+    }, async (args) => {
+        try {
+            const result = await listTasks({
+                status: args.status,
+                phase: args.phase,
+                mode: args.mode,
+                tags: args.tags,
+                rewardMin: args.rewardMin,
+                rewardMax: args.rewardMax,
+                limit: args.limit,
+            });
+            return createJsonResponse({
+                success: true,
+                network: "eip155:8453",
+                taskCount: result.tasks.length,
+                hasMore: result.hasMore,
+                nextCursor: result.nextCursor,
+                tasks: result.tasks.map((t) => ({
+                    id: t.id,
+                    status: t.status,
+                    phase: t.phase ?? null,
+                    mode: t.mode ?? "bounty",
+                    rewardUsdc: baseUnitsToUsdc(t.reward),
+                    submissionCount: t.submissionCount ?? 0,
+                    deadline: t.expiryTime,
+                    tags: t.tags ?? [],
+                    description: t.description.slice(0, 300),
+                })),
+            });
+        }
+        catch (error) {
+            return createErrorResponse(error);
+        }
+    });
+    server.registerTool("taskmarket_get", {
+        description: "Get full detail and LIVE status for one TaskMarket task by ID. Public and anonymous. " +
+            "Returns description, reward, deadline, escrow tx, submission count, phase, and status. " +
+            "Use this after creating or delegating a task to check whether it is open, in review, " +
+            "awaiting settlement, or resolved. Never spends anything.",
+        inputSchema: z.object({
+            taskId: TASK_ID_SCHEMA,
+        }),
+    }, async ({ taskId }) => {
+        try {
+            const task = await getTask(taskId);
+            return createJsonResponse({
+                success: true,
+                id: task.id,
+                status: task.status,
+                phase: task.phase ?? null,
+                mode: task.mode ?? "bounty",
+                rewardUsdc: baseUnitsToUsdc(task.reward),
+                netRewardUsdc: task.netReward ? baseUnitsToUsdc(task.netReward) : null,
+                escrowTxHash: task.escrowTxHash ?? null,
+                requester: task.requester,
+                submissionCount: task.submissionCount ?? 0,
+                createdAt: task.createdAt,
+                deadline: task.expiryTime,
+                tags: task.tags ?? [],
+                link: `https://taskmarket.dev/task/${task.id}`,
+                description: task.description,
+            });
+        }
+        catch (error) {
+            return createErrorResponse(error);
+        }
+    });
+    server.registerTool("taskmarket_submissions", {
+        description: "List submissions on a TaskMarket task for HUMAN REVIEW. Public and anonymous. " +
+            "Returns each submission's worker address, submission time, deliverable file name, and " +
+            "hash. This tool NEVER accepts or rejects work — it only surfaces submissions so a human " +
+            "requester can review the deliverable before authorizing any payment.",
+        inputSchema: z.object({
+            taskId: TASK_ID_SCHEMA,
+        }),
+    }, async ({ taskId }) => {
+        try {
+            const submissions = await listSubmissions(taskId);
+            return createJsonResponse({
+                success: true,
+                taskId,
+                submissionCount: submissions.length,
+                submissions: submissions.map((s) => ({
+                    id: s.id,
+                    workerAddress: s.workerAddress,
+                    workerAgentId: s.workerAgentId ?? null,
+                    submittedAt: s.submittedAt,
+                    rejectedAt: s.rejectedAt ?? null,
+                    deliverableHash: s.deliverableHash ?? null,
+                    submitTxHash: s.submitTxHash ?? null,
+                    files: (s.artifacts ?? []).map((a) => ({
+                        fileName: a.fileName,
+                        mimeType: a.mimeType,
+                        sizeBytes: a.sizeBytes ?? null,
+                    })),
+                })),
+                note: "Human review required. This tool never auto-accepts or auto-rejects submissions.",
+            });
+        }
+        catch (error) {
+            return createErrorResponse(error);
+        }
+    });
+    server.registerTool("taskmarket_stats", {
+        description: "Public TaskMarket statistics for an agent address or agent ID (one is required): completed tasks, rating, " +
+            "total stars. Anonymous read. Use to gauge whether a worker or requester is reputable " +
+            "before delegating work. Never spends anything.",
+        inputSchema: z.object({
+            address: z.string().optional().describe("Wallet address to look up stats for"),
+            agentId: z.string().optional().describe("Agent ID to look up stats for (alternative to address)"),
+        }),
+    }, async (args) => {
+        try {
+            if (!args.address && !args.agentId) {
+                throw new Error("Pass an address or an agentId");
+            }
+            const stats = await getMarketStats({
+                address: args.address,
+                agentId: args.agentId,
+            });
+            return createJsonResponse({
+                success: true,
+                stats,
+                note: "Stats are public market data. A low rating does not guarantee work quality — review deliverables yourself.",
+            });
+        }
+        catch (error) {
+            return createErrorResponse(error);
+        }
+    });
+}
+//# sourceMappingURL=taskmarket.tools.js.map

package/dist/transactions/clarity-values.js

@@ -48,8 +48,16 @@ export function parseArgToClarityValue(arg) {
                     return boolCV(typedArg.value);
                 case "principal":
                     return principalCV(typedArg.value);
-                case "buffer":
-                    return bufferCV(Buffer.from(typedArg.value, "hex"));
+                case "buffer": {
+                    // Strip optional 0x/0X prefix — without this, Buffer.from("0x...", "hex")
+                    // silently produces an empty buffer (aibtcdev/landing-page#1012 Finding 2)
+                    const hexStr = typedArg.value.replace(/^0x/i, "");
+                    // Buffer.from also stops at the first non-hex character or odd nibble
+                    if (!/^([0-9a-f]{2})*$/i.test(hexStr)) {
+                        throw new Error(`Invalid hex for buffer argument: "${typedArg.value}"`);
+                    }
+                    return bufferCV(Buffer.from(hexStr, "hex"));
+                }
                 case "none":
                     return noneCV();
                 case "some":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aibtc/mcp-server",
-  "version": "1.76.2",
+  "version": "1.77.0",
   "description": "Bitcoin-native MCP server for AI agents: BTC/STX wallets, DeFi yield, sBTC peg, NFTs, and x402 payments.",
   "mcpName": "io.github.aibtcdev/mcp-server",
   "type": "module",
@@ -48,7 +48,7 @@
   "homepage": "https://github.com/aibtcdev/aibtc-mcp-server#readme",
   "license": "MIT",
   "dependencies": {
-    "@aibtc/tx-schemas": "^0.7.0",
+    "@aibtc/tx-schemas": "^1.1.0",
     "@bitflowlabs/core-sdk": "^3.0.0",
     "@buildonspark/spark-sdk": "^0.7.14",
     "@faktoryfun/styx-sdk": "^1.3.5",
@@ -66,7 +66,7 @@
     "@stacks/transactions": "^7.6.0",
     "@stacks/wallet-sdk": "^7.2.0",
     "alex-sdk": "^3.2.1",
-    "axios": "^1.17.0",
+    "axios": "^1.20.0",
     "light-bolt11-decoder": "^3.2.0",
     "micro-ordinals": "^0.3.0",
     "nostr-tools": "^2.23.3",
@@ -75,7 +75,7 @@
     "tslib": "^2.8.1",
     "ws": "^8.21.0",
     "x402-stacks": "^2.1.0",
-    "zod": "^4.6.5"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "@types/node": "^22.19.13",
@@ -84,10 +84,10 @@
     "postcss": "^8.5.18",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.12"
   },
   "overrides": {
     "lodash": "^4.18.0",
-    "axios": "^1.17.0"
+    "axios": "^1.20.0"
   }
 }

package/skill/SKILL.md

@@ -4,7 +4,7 @@ description: Bitcoin L1 wallet for agents - check balances, send BTC, manage UTX
 license: MIT
 metadata:
   author: aibtcdev
-  version: 1.76.2 # x-release-please-version
+  version: 1.77.0 # x-release-please-version
   npm: "@aibtc/mcp-server"
   github: https://github.com/aibtcdev/aibtc-mcp-server
 ---
@@ -242,6 +242,20 @@ unlocked wallet on the gateway's network. Every tool takes an optional `gateway`
 arg (defaults to `https://inference.aibtc.com`; use `http://localhost:8787` for
 local dev).
 
+### TaskMarket (onchain work marketplace on Base)
+
+Browse the [TaskMarket](https://taskmarket.dev) agent work marketplace (USDC
+escrow on Base). The tools are public and anonymous: no wallet, no spend.
+
+| Tool | Description | Signed |
+|------|-------------|:------:|
+| `taskmarket_search` | List/search open tasks (filters, reward range) | — |
+| `taskmarket_get` | Full task detail + live status + link | — |
+| `taskmarket_submissions` | List a task's submissions | — |
+| `taskmarket_stats` | Public agent/market stats (reputation check) | — |
+
+See: [references/taskmarket.md](references/taskmarket.md)
+
 ### Prediction Market + Legions (elsalvadorstakesbtc.com)
 
 A market on one bit of Bitcoin history — did twenty frozen El Salvador reserve

package/skill/references/taskmarket.md

@@ -0,0 +1,26 @@
+# TaskMarket (onchain work marketplace on Base)
+
+TaskMarket (https://taskmarket.dev) is an onchain agent work marketplace on
+Base. Requesters escrow USDC, workers submit deliverables, and the requester
+reviews submissions and accepts a winner. This server exposes TaskMarket
+through MCP tools.
+
+## What works here
+
+| Tool | Type | Notes |
+|------|------|-------|
+| `taskmarket_search` | read | Public, anonymous. Filters: status, phase, mode, tags, reward range. |
+| `taskmarket_get` | read | Public, anonymous. Full detail + live status + link. |
+| `taskmarket_submissions` | read | Public, anonymous. Lists submissions; never accepts or rejects work. |
+| `taskmarket_stats` | read | Public, anonymous. Agent/market stats for reputation checks. |
+
+## Review submissions
+
+`taskmarket_submissions` lists a task's submissions (worker address, agent ID,
+deliverable files, hashes). This tool never accepts or rejects work.
+
+## Safety
+
+- Every tool is a read against the public API. Nothing signs, spends or
+  needs a wallet.
+- No private keys, seeds, tokens, or cookies are requested, stored, or logged.