@blockrun/mcp 0.7.1 → 0.7.2

package/dist/index.js

@@ -942,10 +942,10 @@ $0.001/call.`,
         body: z8.any().optional().describe("JSON body for POST queries (triggers pmQuery)")
       }
     },
-    async ({ path: path2, params, body }) => {
+    async ({ path: path3, params, body }) => {
       try {
         const llm = getClient();
-        const result = body ? await llm.pmQuery(path2, body) : await llm.pm(path2, params);
+        const result = body ? await llm.pmQuery(path3, body) : await llm.pm(path3, params);
         return {
           content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
           structuredContent: result
@@ -1042,6 +1042,93 @@ ${lines.join("\n\n")}` }],
   );
 }
 
+// src/tools/modal.ts
+import { z as z10 } from "zod";
+var MODAL_GPU_TYPES = ["T4", "L4", "A10G", "A100", "A100-80GB", "H100"];
+function registerModalTool(server) {
+  server.registerTool(
+    "blockrun_modal",
+    {
+      description: `Run isolated code in a BlockRun-hosted Modal sandbox.
+
+Use this when you need:
+- a disposable remote container
+- GPU access
+- a clean environment that will not affect the local machine
+- a safer place to run untrusted or heavy code
+
+Prefer local tools for normal repo work. Modal is best for isolation or remote execution.
+
+Pricing:
+- create: $0.01
+- exec/status/terminate: $0.001 each`,
+      inputSchema: {
+        action: z10.enum(["create", "exec", "status", "terminate"]).describe(
+          "Sandbox action to perform"
+        ),
+        sandbox_id: z10.string().optional().describe("Sandbox ID returned by a previous create"),
+        command: z10.array(z10.string()).optional().describe('Command array for exec, for example ["python", "-c", "print(2+2)"]'),
+        image: z10.string().optional().describe("Container image for create (default: python:3.11)"),
+        timeout: z10.number().optional().describe("Timeout in seconds for create or exec"),
+        cpu: z10.number().optional().describe("CPU cores for create"),
+        memory: z10.number().optional().describe("Memory in MB for create"),
+        gpu: z10.enum(MODAL_GPU_TYPES).optional().describe("Optional GPU type for create"),
+        setup_commands: z10.array(z10.string()).optional().describe("Shell commands to run during sandbox setup")
+      }
+    },
+    async ({ action, sandbox_id, command, image, timeout, cpu, memory, gpu, setup_commands }) => {
+      try {
+        const llm = getClient();
+        const req = llm;
+        let result;
+        switch (action) {
+          case "create":
+            result = await req.requestWithPaymentRaw("/v1/modal/sandbox/create", {
+              image,
+              timeout,
+              cpu,
+              memory,
+              gpu,
+              setup_commands
+            });
+            break;
+          case "exec":
+            if (!sandbox_id) throw new Error("sandbox_id required for exec action");
+            if (!command?.length) throw new Error("command array required for exec action");
+            result = await req.requestWithPaymentRaw("/v1/modal/sandbox/exec", {
+              sandbox_id,
+              command,
+              timeout
+            });
+            break;
+          case "status":
+            if (!sandbox_id) throw new Error("sandbox_id required for status action");
+            result = await req.requestWithPaymentRaw("/v1/modal/sandbox/status", { sandbox_id });
+            break;
+          case "terminate":
+            if (!sandbox_id) throw new Error("sandbox_id required for terminate action");
+            result = await req.requestWithPaymentRaw("/v1/modal/sandbox/terminate", {
+              sandbox_id
+            });
+            break;
+          default:
+            throw new Error(`Unknown action: ${String(action)}`);
+        }
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+          structuredContent: result
+        };
+      } catch (err) {
+        const errMsg = err instanceof Error ? err.message : String(err);
+        return {
+          content: [{ type: "text", text: formatError(errMsg) }],
+          isError: true
+        };
+      }
+    }
+  );
+}
+
 // src/mcp-handler.ts
 function initializeMcpServer(server) {
   const budget = { limit: null, spent: 0, calls: 0, agents: /* @__PURE__ */ new Map() };
@@ -1055,6 +1142,7 @@ function initializeMcpServer(server) {
   registerExaTool(server);
   registerMarketsTool(server);
   registerDexTool(server);
+  registerModalTool(server);
   server.registerResource(
     "wallet",
     "blockrun://wallet",
@@ -1090,8 +1178,90 @@ function initializeMcpServer(server) {
   );
 }
 
+// src/utils/key-leak-scanner.ts
+import fs2 from "fs";
+import path2 from "path";
+import os2 from "os";
+function looksLikeRawPrivateKey(value) {
+  if (typeof value !== "string") return false;
+  if (/^0x[0-9a-fA-F]{64}$/.test(value)) return true;
+  if (value.length >= 80 && value.length <= 100 && /^[1-9A-HJ-NP-Za-km-z]+$/.test(value)) return true;
+  return false;
+}
+function walk(obj, file, jsonPath, out) {
+  if (obj === null || typeof obj !== "object") return;
+  if (Array.isArray(obj)) {
+    obj.forEach((v, i) => walk(v, file, `${jsonPath}[${i}]`, out));
+    return;
+  }
+  for (const [k, v] of Object.entries(obj)) {
+    const next = jsonPath ? `${jsonPath}.${k}` : k;
+    if (/wallet[-_ ]?key|private[-_ ]?key|secret/i.test(k) && looksLikeRawPrivateKey(v)) {
+      out.push({ file, path: next });
+    } else if (looksLikeRawPrivateKey(v)) {
+      out.push({ file, path: next });
+    }
+    walk(v, file, next, out);
+  }
+}
+function scanFile(file) {
+  try {
+    if (!fs2.existsSync(file)) return [];
+    const raw = fs2.readFileSync(file, "utf-8");
+    const data = JSON.parse(raw);
+    const out = [];
+    walk(data, file, "", out);
+    return out;
+  } catch {
+    return [];
+  }
+}
+function warnOnLeakedKeys() {
+  const home = os2.homedir();
+  const candidates = [
+    path2.join(home, ".claude.json"),
+    path2.join(home, "Library", "Application Support", "Claude", "claude_desktop_config.json"),
+    path2.join(home, ".config", "claude", "claude_desktop_config.json"),
+    path2.join(home, "AppData", "Roaming", "Claude", "claude_desktop_config.json")
+  ];
+  const findings = [];
+  for (const f of candidates) findings.push(...scanFile(f));
+  if (findings.length === 0) return false;
+  const bar = "\u2550".repeat(72);
+  console.error("");
+  console.error(`\x1B[31m${bar}`);
+  console.error("  \u{1F6A8} WALLET PRIVATE KEY DETECTED IN CONFIG FILE");
+  console.error(bar + "\x1B[0m");
+  console.error("");
+  console.error("  Your config contains what looks like a raw wallet private key.");
+  console.error("  Private keys should NEVER be stored in these files \u2014 they get");
+  console.error("  backed up to iCloud / Dropbox / Time Machine, synced across");
+  console.error("  machines, and readable by anything that can read your config.");
+  console.error("");
+  console.error("  Found in:");
+  for (const f of findings) {
+    console.error(`    \xB7 ${f.file}`);
+    console.error(`      at: ${f.path}`);
+  }
+  console.error("");
+  console.error("  RECOMMENDED ACTIONS:");
+  console.error("    1. Treat this key as compromised. Rotate your wallet:");
+  console.error("       - Create a new wallet");
+  console.error("       - Transfer remaining USDC to the new address");
+  console.error("       - Retire the old key");
+  console.error("    2. Remove the X-Wallet-Key entries from your config.");
+  console.error("    3. Reconnect using the local package (signs locally, key");
+  console.error("       never leaves your machine):");
+  console.error("         claude mcp remove blockrun");
+  console.error("         claude mcp add blockrun npx -y @blockrun/mcp@latest");
+  console.error("");
+  console.error("  Details: https://github.com/BlockRunAI/blockrun-mcp-server/issues/1");
+  console.error("");
+  return true;
+}
+
 // src/index.ts
-var VERSION = "0.6.8";
+var VERSION = "0.7.2";
 async function checkForUpdate() {
   try {
     const resp = await fetch("https://registry.npmjs.org/@blockrun/mcp/latest", {
@@ -1106,6 +1276,7 @@ async function checkForUpdate() {
   }
 }
 async function main() {
+  warnOnLeakedKeys();
   const server = new McpServer({
     name: "blockrun-mcp",
     version: VERSION

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blockrun/mcp",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "mcpName": "io.github.BlockRunAI/blockrun-mcp",
   "description": "BlockRun MCP Server - Give your AI agent web search, deep research, prediction markets, crypto data, X/Twitter intelligence. Paid via x402 micropayments.",
   "type": "module",