@candledottv/mcp 0.4.0 → 0.5.0

package/README.md

@@ -25,8 +25,10 @@ server with no `env` block at all and those three work immediately:
 ```
 
 Add `CANDLE_AGENT_API_KEY` only once you're ready to launch, trade, or report activity, see
-Environment below -- or skip env editing entirely: after `npx @candledottv/cli auth login`,
-`candle mcp` launches this server with the stored key and API URL in its environment.
+Environment below -- or skip env editing entirely: install the Candle CLI
+(`curl -fsSL https://candle.tv/install.sh | bash` or `brew install candledottv/tap/candle`), run
+`candle auth login`, and `candle mcp` launches this server with the stored key and API URL in its
+environment.
 
 `CANDLE_MCP_TOOLS` (optional) is a comma-separated allowlist of tool names; only those register.
 Unset means all eight. An unknown name fails startup with the valid names in the message, rather
@@ -59,7 +61,12 @@ tools, getting a key, funding the embedded wallet, and idempotent retries, see
 ## Environment
 
 - `CANDLE_API_URL` -- base URL of the Candle API. Defaults to `https://api.alpha.candle.tv` (the alpha deployment; production does not serve the agent API yet). Set it to
-  `http://localhost:3001` when developing against a local API.
+  `http://localhost:3001` when developing against a local API. A cleartext `http://` URL pointing
+  at a NON-loopback host is refused at startup, since every write tool sends `x-api-key`; loopback
+  (`localhost`, `127.0.0.0/8`, `::1`) needs no opt-in.
+- `CANDLE_ALLOW_INSECURE_HTTP` -- set to any non-empty value to allow an `http://` API URL to a
+  non-loopback host. For a trusted local endpoint that is not loopback, such as a devcontainer
+  reaching its host; not for anything that leaves the machine.
 - `CANDLE_AGENT_API_KEY` -- an agent API key (`cndl_live_...` / `cndl_test_...`), issued from a
   Candle account's agent settings page. Only required by `candle_launch_token`,
   `candle_report_activity`, `candle_trade`, `candle_launch_and_seed`, and `candle_swap`; the three

package/dist/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-// src/index.ts
+// src/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
@@ -9,9 +9,36 @@ import { z } from "zod";
 
 // src/client.ts
 var DEFAULT_API_URL = "https://api.alpha.candle.tv";
-function resolveConfig() {
-  const apiUrl = process.env.CANDLE_API_URL?.trim() || DEFAULT_API_URL;
-  const apiKey = process.env.CANDLE_AGENT_API_KEY?.trim() || process.env.CANDLE_API_KEY?.trim();
+function isLoopbackHost(hostname) {
+  const host = hostname.toLowerCase();
+  if (host === "localhost" || host.endsWith(".localhost"))
+    return true;
+  if (host === "::1" || host === "[::1]")
+    return true;
+  return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host);
+}
+function assertTransportSecurity(apiUrl, env) {
+  let parsed;
+  try {
+    parsed = new URL(apiUrl);
+  } catch {
+    throw new Error(`CANDLE_API_URL is not a valid URL: ${JSON.stringify(apiUrl)}`);
+  }
+  if (parsed.protocol === "https:")
+    return;
+  if (parsed.protocol !== "http:") {
+    throw new Error(`CANDLE_API_URL must be http or https, got ${parsed.protocol.replace(":", "")}`);
+  }
+  if (isLoopbackHost(parsed.hostname))
+    return;
+  if (env.CANDLE_ALLOW_INSECURE_HTTP?.trim())
+    return;
+  throw new Error(`Refusing to send credentials in the clear to ${parsed.origin}. Set CANDLE_API_URL to an https:// ` + "URL, or set CANDLE_ALLOW_INSECURE_HTTP=1 if this really is a trusted local endpoint.");
+}
+function resolveConfig(env = process.env) {
+  const apiUrl = env.CANDLE_API_URL?.trim() || DEFAULT_API_URL;
+  assertTransportSecurity(apiUrl, env);
+  const apiKey = env.CANDLE_AGENT_API_KEY?.trim() || env.CANDLE_API_KEY?.trim();
   return apiKey ? { apiUrl, apiKey } : { apiUrl };
 }
 
@@ -135,7 +162,7 @@ async function postJson(url, apiKey, payload, doFetch) {
   }
 }
 async function readMarket(mint, cfg, doFetch, extra) {
-  const res = await doFetch(`${base(cfg)}/api/v1/markets/${chainForMint(mint)}/${mint}`, {
+  const res = await doFetch(`${base(cfg)}/api/v1/markets/${chainForMint(mint)}/${encodeURIComponent(mint)}`, {
     method: "GET",
     headers: headers()
   });
@@ -210,7 +237,7 @@ async function executeTrade(args, cfg, doFetch) {
       if (!address) {
         return errText(`percent sells need an embedded ${chain === "hood" ? "EVM" : "Solana"} wallet, and this account has none`, { clientTradeId });
       }
-      const balRes = await doFetch(`${base(cfg)}/api/v1/tokens/${args.mint}/balance/${address}`, {
+      const balRes = await doFetch(`${base(cfg)}/api/v1/tokens/${encodeURIComponent(args.mint)}/balance/${encodeURIComponent(address)}`, {
         method: "GET",
         headers: headers()
       });
@@ -274,7 +301,9 @@ async function executeLaunchAndSeed(args, cfg, doFetch) {
   let market = null;
   let note;
   try {
-    const marketRes = await doFetch(`${base(cfg)}/api/v1/markets/${launch.chain ?? "solana"}/${launch.mint}`, {
+    if (launch.mint === undefined)
+      throw new Error("the launch response carried no mint");
+    const marketRes = await doFetch(`${base(cfg)}/api/v1/markets/${encodeURIComponent(launch.chain ?? "solana")}/${encodeURIComponent(launch.mint)}`, {
       method: "GET",
       headers: headers()
     });
@@ -408,12 +437,15 @@ function buildRequest(name, args, cfg) {
     }
     case "candle_get_market": {
       const { chain, mint } = args;
-      return { url: `${base2}/api/v1/markets/${chain}/${mint}`, init: { method: "GET", headers: jsonHeaders() } };
+      return {
+        url: `${base2}/api/v1/markets/${encodeURIComponent(chain)}/${encodeURIComponent(mint)}`,
+        init: { method: "GET", headers: jsonHeaders() }
+      };
     }
     case "candle_token_forensics": {
       const { chain, mint } = args;
       return {
-        url: `${base2}/api/v1/markets/${chain}/${mint}/forensics`,
+        url: `${base2}/api/v1/markets/${encodeURIComponent(chain)}/${encodeURIComponent(mint)}/forensics`,
         init: { method: "GET", headers: jsonHeaders() }
       };
     }
@@ -434,7 +466,10 @@ function buildRequest(name, args, cfg) {
     }
     case "candle_get_agent_profile": {
       const { idOrWallet } = args;
-      return { url: `${base2}/api/v1/users/${idOrWallet}/agent`, init: { method: "GET", headers: jsonHeaders() } };
+      return {
+        url: `${base2}/api/v1/users/${encodeURIComponent(idOrWallet)}/agent`,
+        init: { method: "GET", headers: jsonHeaders() }
+      };
     }
     case "candle_swap": {
       const apiKey = requireApiKey2(cfg);
@@ -533,7 +568,7 @@ var sweepShape = {
   mints: z.array(z.string()).optional().describe("Extra token mints/contracts to sweep besides the chain's base assets (own-wallet destinations only).")
 };
 function registerTools(server, env = process.env) {
-  const cfg = resolveConfig();
+  const cfg = resolveConfig(env);
   const allowed = resolveToolAllowlist(env);
   const register = (name, ...rest) => {
     if (!allowed.has(name))
@@ -607,10 +642,25 @@ function registerTools(server, env = process.env) {
 }
 
 // src/version.ts
-var SERVER_VERSION = "0.4.0";
+var SERVER_VERSION = "0.5.0";
+
+// src/server.ts
+function createCandleMcpServer(env = process.env) {
+  const server = new McpServer({ name: "candle-mcp", version: SERVER_VERSION });
+  registerTools(server, env);
+  return server;
+}
+async function runStdioServer(env = process.env, transport = new StdioServerTransport) {
+  const server = createCandleMcpServer(env);
+  await server.connect(transport);
+  await new Promise((resolve) => {
+    const sdkOnClose = transport.onclose;
+    transport.onclose = () => {
+      sdkOnClose?.();
+      resolve();
+    };
+  });
+}
 
 // src/index.ts
-var server = new McpServer({ name: "candle-mcp", version: SERVER_VERSION });
-registerTools(server);
-var transport = new StdioServerTransport;
-await server.connect(transport);
+await runStdioServer();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@candledottv/mcp",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "MCP server for the Candle agent rail: launch tokens, read markets, report activity",
   "type": "module",
   "license": "MIT",