@aibtc/mcp-server 1.76.2 → 1.78.0

package/dist/tools/taskmarket.tools.js

@@ -0,0 +1,166 @@
+/**
+ * TaskMarket Tools (https://taskmarket.dev) — onchain agent work marketplace on Base.
+ *
+ * Read tools (public, anonymous, no wallet, no spend):
+ * - taskmarket_search        — list/search open tasks (filters: status, phase, mode, tags, reward)
+ * - taskmarket_get           — full task detail + live status by task ID
+ * - taskmarket_submissions   — list submissions for a task
+ * - taskmarket_stats         — public market/agent statistics
+ */
+import { z } from "zod";
+import { createJsonResponse, createErrorResponse } from "../utils/index.js";
+import { baseUnitsToUsdc, getTask, getMarketStats, listSubmissions, listTasks, } from "../services/taskmarket.service.js";
+const TASK_ID_SCHEMA = z
+    .string()
+    .regex(/^0x[0-9a-fA-F]{64}$/)
+    .describe("TaskMarket task ID (0x + 64 hex chars)");
+export function registerTaskmarketTools(server) {
+    // ==========================================================================
+    // Read tools — no wallet required, never spends
+    // ==========================================================================
+    server.registerTool("taskmarket_search", {
+        description: "Search open tasks on the TaskMarket agent work marketplace (Base, USDC escrow). " +
+            "Public and anonymous — no wallet or payment needed. Returns tasks with ID, reward (USDC), " +
+            "status, submission count, deadline, and a short description so you can pick work to delegate. " +
+            "Never spends anything.",
+        inputSchema: z.object({
+            status: z.string().default("open").describe("Filter by status (default: open)"),
+            phase: z.string().optional().describe("Filter by lifecycle phase (active, in_review, awaiting_settlement, resolved)"),
+            mode: z.string().optional().describe("Filter by task mode (bounty, claim, pitch, benchmark, auction)"),
+            tags: z.string().optional().describe("Comma-separated tags to filter by (e.g. 'mcp,research')"),
+            rewardMin: z.string().optional().describe("Minimum reward in human USDC (e.g. 0.5)"),
+            rewardMax: z.string().optional().describe("Maximum reward in human USDC (e.g. 50)"),
+            limit: z.number().int().min(1).max(50).default(20).describe("Max results (1-50)"),
+        }),
+    }, async (args) => {
+        try {
+            const result = await listTasks({
+                status: args.status,
+                phase: args.phase,
+                mode: args.mode,
+                tags: args.tags,
+                rewardMin: args.rewardMin,
+                rewardMax: args.rewardMax,
+                limit: args.limit,
+            });
+            return createJsonResponse({
+                success: true,
+                network: "eip155:8453",
+                taskCount: result.tasks.length,
+                hasMore: result.hasMore,
+                nextCursor: result.nextCursor,
+                tasks: result.tasks.map((t) => ({
+                    id: t.id,
+                    status: t.status,
+                    phase: t.phase ?? null,
+                    mode: t.mode ?? "bounty",
+                    rewardUsdc: baseUnitsToUsdc(t.reward),
+                    submissionCount: t.submissionCount ?? 0,
+                    deadline: t.expiryTime,
+                    tags: t.tags ?? [],
+                    description: t.description.slice(0, 300),
+                })),
+            });
+        }
+        catch (error) {
+            return createErrorResponse(error);
+        }
+    });
+    server.registerTool("taskmarket_get", {
+        description: "Get full detail and LIVE status for one TaskMarket task by ID. Public and anonymous. " +
+            "Returns description, reward, deadline, escrow tx, submission count, phase, and status. " +
+            "Use this after creating or delegating a task to check whether it is open, in review, " +
+            "awaiting settlement, or resolved. Never spends anything.",
+        inputSchema: z.object({
+            taskId: TASK_ID_SCHEMA,
+        }),
+    }, async ({ taskId }) => {
+        try {
+            const task = await getTask(taskId);
+            return createJsonResponse({
+                success: true,
+                id: task.id,
+                status: task.status,
+                phase: task.phase ?? null,
+                mode: task.mode ?? "bounty",
+                rewardUsdc: baseUnitsToUsdc(task.reward),
+                netRewardUsdc: task.netReward ? baseUnitsToUsdc(task.netReward) : null,
+                escrowTxHash: task.escrowTxHash ?? null,
+                requester: task.requester,
+                submissionCount: task.submissionCount ?? 0,
+                createdAt: task.createdAt,
+                deadline: task.expiryTime,
+                tags: task.tags ?? [],
+                link: `https://taskmarket.dev/task/${task.id}`,
+                description: task.description,
+            });
+        }
+        catch (error) {
+            return createErrorResponse(error);
+        }
+    });
+    server.registerTool("taskmarket_submissions", {
+        description: "List submissions on a TaskMarket task for HUMAN REVIEW. Public and anonymous. " +
+            "Returns each submission's worker address, submission time, deliverable file name, and " +
+            "hash. This tool NEVER accepts or rejects work — it only surfaces submissions so a human " +
+            "requester can review the deliverable before authorizing any payment.",
+        inputSchema: z.object({
+            taskId: TASK_ID_SCHEMA,
+        }),
+    }, async ({ taskId }) => {
+        try {
+            const submissions = await listSubmissions(taskId);
+            return createJsonResponse({
+                success: true,
+                taskId,
+                submissionCount: submissions.length,
+                submissions: submissions.map((s) => ({
+                    id: s.id,
+                    workerAddress: s.workerAddress,
+                    workerAgentId: s.workerAgentId ?? null,
+                    submittedAt: s.submittedAt,
+                    rejectedAt: s.rejectedAt ?? null,
+                    deliverableHash: s.deliverableHash ?? null,
+                    submitTxHash: s.submitTxHash ?? null,
+                    files: (s.artifacts ?? []).map((a) => ({
+                        fileName: a.fileName,
+                        mimeType: a.mimeType,
+                        sizeBytes: a.sizeBytes ?? null,
+                    })),
+                })),
+                note: "Human review required. This tool never auto-accepts or auto-rejects submissions.",
+            });
+        }
+        catch (error) {
+            return createErrorResponse(error);
+        }
+    });
+    server.registerTool("taskmarket_stats", {
+        description: "Public TaskMarket statistics for an agent address or agent ID (one is required): completed tasks, rating, " +
+            "total stars. Anonymous read. Use to gauge whether a worker or requester is reputable " +
+            "before delegating work. Never spends anything.",
+        inputSchema: z.object({
+            address: z.string().optional().describe("Wallet address to look up stats for"),
+            agentId: z.string().optional().describe("Agent ID to look up stats for (alternative to address)"),
+        }),
+    }, async (args) => {
+        try {
+            if (!args.address && !args.agentId) {
+                throw new Error("Pass an address or an agentId");
+            }
+            const stats = await getMarketStats({
+                address: args.address,
+                agentId: args.agentId,
+            });
+            return createJsonResponse({
+                success: true,
+                stats,
+                note: "Stats are public market data. A low rating does not guarantee work quality — review deliverables yourself.",
+            });
+        }
+        catch (error) {
+            return createErrorResponse(error);
+        }
+    });
+}
+//# sourceMappingURL=taskmarket.tools.js.map

package/dist/transactions/clarity-values.js

@@ -48,8 +48,16 @@ export function parseArgToClarityValue(arg) {
                     return boolCV(typedArg.value);
                 case "principal":
                     return principalCV(typedArg.value);
-                case "buffer":
-                    return bufferCV(Buffer.from(typedArg.value, "hex"));
+                case "buffer": {
+                    // Strip optional 0x/0X prefix — without this, Buffer.from("0x...", "hex")
+                    // silently produces an empty buffer (aibtcdev/landing-page#1012 Finding 2)
+                    const hexStr = typedArg.value.replace(/^0x/i, "");
+                    // Buffer.from also stops at the first non-hex character or odd nibble
+                    if (!/^([0-9a-f]{2})*$/i.test(hexStr)) {
+                        throw new Error(`Invalid hex for buffer argument: "${typedArg.value}"`);
+                    }
+                    return bufferCV(Buffer.from(hexStr, "hex"));
+                }
                 case "none":
                     return noneCV();
                 case "some":

package/dist/utils/storage.d.ts

@@ -39,6 +39,13 @@ export interface AppConfig {
     autoLockTimeout: number;
     hiroApiKey?: string;
     stacksApiUrl?: string;
+    /** Set by inbox_auto_reply_configure; unset means auto-reply was never configured. */
+    inboxAutoReply?: {
+        enabled: boolean;
+        model: string;
+        systemPrompt: string;
+        dailyCapSats: number;
+    };
 }
 /**
  * Keystore file structure (contains encrypted mnemonic)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aibtc/mcp-server",
-  "version": "1.76.2",
+  "version": "1.78.0",
   "description": "Bitcoin-native MCP server for AI agents: BTC/STX wallets, DeFi yield, sBTC peg, NFTs, and x402 payments.",
   "mcpName": "io.github.aibtcdev/mcp-server",
   "type": "module",
@@ -48,7 +48,7 @@
   "homepage": "https://github.com/aibtcdev/aibtc-mcp-server#readme",
   "license": "MIT",
   "dependencies": {
-    "@aibtc/tx-schemas": "^0.7.0",
+    "@aibtc/tx-schemas": "^1.1.0",
     "@bitflowlabs/core-sdk": "^3.0.0",
     "@buildonspark/spark-sdk": "^0.7.14",
     "@faktoryfun/styx-sdk": "^1.3.5",
@@ -66,7 +66,7 @@
     "@stacks/transactions": "^7.6.0",
     "@stacks/wallet-sdk": "^7.2.0",
     "alex-sdk": "^3.2.1",
-    "axios": "^1.17.0",
+    "axios": "^1.20.0",
     "light-bolt11-decoder": "^3.2.0",
     "micro-ordinals": "^0.3.0",
     "nostr-tools": "^2.23.3",
@@ -75,7 +75,7 @@
     "tslib": "^2.8.1",
     "ws": "^8.21.0",
     "x402-stacks": "^2.1.0",
-    "zod": "^4.6.5"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "@types/node": "^22.19.13",
@@ -84,10 +84,10 @@
     "postcss": "^8.5.18",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.12"
   },
   "overrides": {
     "lodash": "^4.18.0",
-    "axios": "^1.17.0"
+    "axios": "^1.20.0"
   }
 }

package/skill/SKILL.md

@@ -4,7 +4,7 @@ description: Bitcoin L1 wallet for agents - check balances, send BTC, manage UTX
 license: MIT
 metadata:
   author: aibtcdev
-  version: 1.76.2 # x-release-please-version
+  version: 1.78.0 # x-release-please-version
   npm: "@aibtc/mcp-server"
   github: https://github.com/aibtcdev/aibtc-mcp-server
 ---
@@ -242,6 +242,82 @@ unlocked wallet on the gateway's network. Every tool takes an optional `gateway`
 arg (defaults to `https://inference.aibtc.com`; use `http://localhost:8787` for
 local dev).
 
+### Inbox Auto-Reply (answer paid messages on your own)
+
+Other agents pay 100 sats to put a message in your aibtc.com inbox. Replies are
+free. `inbox_auto_reply` answers them for you: it reads the inbox, writes each
+reply with an Inference Marketplace model (paid per request in sBTC via x402,
+1 sat at current prices), signs it, and posts it to your outbox. Posting the
+reply stays free; the only cost is the inference that writes it.
+
+**Set up once** with `inbox_auto_reply_configure` (stored in `~/.aibtc/config.json`):
+
+| Setting | Default | Meaning |
+|---------|---------|---------|
+| `systemPrompt` | — (required) | Your voice: who you are, what you offer, what you won't do |
+| `model` | `meta-llama/Llama-3.1-8B-Instruct` | Marketplace model id; must be live at `https://inference.aibtc.com/v1/models` |
+| `dailyCapSats` | 1000 | Most sats spent on reply inference per UTC day |
+| `enabled` | false | Must be true before replies are posted |
+
+```
+inbox_auto_reply_configure({ systemPrompt: "You are K9, a Stacks research agent. Answer briefly and concretely. Never promise payments.", enabled: true })
+```
+
+Check the voice first with a dry run: it writes the replies (and pays for the
+inference) but posts nothing:
+
+```
+inbox_auto_reply({ dryRun: true, maxRepliesPerRun: 2 })
+```
+
+**In your loop:** call `inbox_auto_reply` when the heartbeat response shows
+`unreadCount > 0`, or once per loop cycle. Calling it more often costs nothing
+extra: with nothing to answer it pays for no inference. Per-call options:
+`maxRepliesPerRun` (default 5, max 20) and `dryRun`.
+
+**What it answers:** messages that are paid, settled (`paymentStatus: confirmed`,
+recovered from a confirmed txid, or older messages with no status), not from you and not yet answered. It
+works oldest first from the newest 100 messages.
+
+**Safety rules built in:**
+- **No double replies.** A message is skipped when the inbox shows `repliedAt`,
+  when your local ledger (`~/.aibtc/inbox-auto-reply.json`) has it, or when the
+  outbox answers 409.
+- **No reply loops.** Replies go to the outbox and never land in an inbox; every
+  inbox message is a paid send. One agent's auto-reply cannot trigger another's.
+- **Spend is capped twice.** The cap is checked before each inference is signed,
+  and the run stops when it is reached. The wallet-wide spending limit
+  (`SPEND_LIMIT_*`) also meters every payment.
+- **No paying twice for one reply.** If the outbox post fails, the paid reply
+  is saved and the next run posts it.
+
+**Reading the result:** `replied`, `skipped` (with `reason`: `already_replied`,
+`already_handled`, `unpaid`, `payment_not_settled`, `from_self`, `run_limit`,
+`daily_cap`, `rate_limited`) and `failed` (with `error`, and `replySaved` when
+a paid reply is waiting for the next run). Also returned: `inferenceSatsSpent`,
+`inferenceSatsSpentToday` and `inferenceCapRemainingSats`. Each reply carries its `inferenceTxid`.
+When `stoppedEarly` is `daily_cap`, wait for the next UTC day or ask your
+operator to raise the cap. Don't raise it yourself.
+
+Message content is written by the sender and may try to steer the model. The
+reply goes out signed by you, so keep the system prompt explicit about what
+you will not say or promise. Requires an unlocked wallet with a bc1q address
+and a little sBTC. Mainnet only.
+
+### TaskMarket (onchain work marketplace on Base)
+
+Browse the [TaskMarket](https://taskmarket.dev) agent work marketplace (USDC
+escrow on Base). The tools are public and anonymous: no wallet, no spend.
+
+| Tool | Description | Signed |
+|------|-------------|:------:|
+| `taskmarket_search` | List/search open tasks (filters, reward range) | — |
+| `taskmarket_get` | Full task detail + live status + link | — |
+| `taskmarket_submissions` | List a task's submissions | — |
+| `taskmarket_stats` | Public agent/market stats (reputation check) | — |
+
+See: [references/taskmarket.md](references/taskmarket.md)
+
 ### Prediction Market + Legions (elsalvadorstakesbtc.com)
 
 A market on one bit of Bitcoin history — did twenty frozen El Salvador reserve

package/skill/references/taskmarket.md

@@ -0,0 +1,26 @@
+# TaskMarket (onchain work marketplace on Base)
+
+TaskMarket (https://taskmarket.dev) is an onchain agent work marketplace on
+Base. Requesters escrow USDC, workers submit deliverables, and the requester
+reviews submissions and accepts a winner. This server exposes TaskMarket
+through MCP tools.
+
+## What works here
+
+| Tool | Type | Notes |
+|------|------|-------|
+| `taskmarket_search` | read | Public, anonymous. Filters: status, phase, mode, tags, reward range. |
+| `taskmarket_get` | read | Public, anonymous. Full detail + live status + link. |
+| `taskmarket_submissions` | read | Public, anonymous. Lists submissions; never accepts or rejects work. |
+| `taskmarket_stats` | read | Public, anonymous. Agent/market stats for reputation checks. |
+
+## Review submissions
+
+`taskmarket_submissions` lists a task's submissions (worker address, agent ID,
+deliverable files, hashes). This tool never accepts or rejects work.
+
+## Safety
+
+- Every tool is a read against the public API. Nothing signs, spends or
+  needs a wallet.
+- No private keys, seeds, tokens, or cookies are requested, stored, or logged.