@candledottv/mcp 0.4.0 → 0.6.0

package/README.md

@@ -25,8 +25,10 @@ server with no `env` block at all and those three work immediately:
 ```
 
 Add `CANDLE_AGENT_API_KEY` only once you're ready to launch, trade, or report activity, see
-Environment below -- or skip env editing entirely: after `npx @candledottv/cli auth login`,
-`candle mcp` launches this server with the stored key and API URL in its environment.
+Environment below -- or skip env editing entirely: install the Candle CLI
+(`curl -fsSL https://candle.tv/install.sh | bash` or `brew install candledottv/tap/candle`), run
+`candle auth login`, and `candle mcp` launches this server with the stored key and API URL in its
+environment.
 
 `CANDLE_MCP_TOOLS` (optional) is a comma-separated allowlist of tool names; only those register.
 Unset means all eight. An unknown name fails startup with the valid names in the message, rather
@@ -59,7 +61,12 @@ tools, getting a key, funding the embedded wallet, and idempotent retries, see
 ## Environment
 
 - `CANDLE_API_URL` -- base URL of the Candle API. Defaults to `https://api.alpha.candle.tv` (the alpha deployment; production does not serve the agent API yet). Set it to
-  `http://localhost:3001` when developing against a local API.
+  `http://localhost:3001` when developing against a local API. A cleartext `http://` URL pointing
+  at a NON-loopback host is refused at startup, since every write tool sends `x-api-key`; loopback
+  (`localhost`, `127.0.0.0/8`, `::1`) needs no opt-in.
+- `CANDLE_ALLOW_INSECURE_HTTP` -- set to any non-empty value to allow an `http://` API URL to a
+  non-loopback host. For a trusted local endpoint that is not loopback, such as a devcontainer
+  reaching its host; not for anything that leaves the machine.
 - `CANDLE_AGENT_API_KEY` -- an agent API key (`cndl_live_...` / `cndl_test_...`), issued from a
   Candle account's agent settings page. Only required by `candle_launch_token`,
   `candle_report_activity`, `candle_trade`, `candle_launch_and_seed`, and `candle_swap`; the three

package/dist/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-// src/index.ts
+// src/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
@@ -9,15 +9,39 @@ import { z } from "zod";
 
 // src/client.ts
 var DEFAULT_API_URL = "https://api.alpha.candle.tv";
-function resolveConfig() {
-  const apiUrl = process.env.CANDLE_API_URL?.trim() || DEFAULT_API_URL;
-  const apiKey = process.env.CANDLE_AGENT_API_KEY?.trim() || process.env.CANDLE_API_KEY?.trim();
+function isLoopbackHost(hostname) {
+  const host = hostname.toLowerCase();
+  if (host === "localhost" || host.endsWith(".localhost"))
+    return true;
+  if (host === "::1" || host === "[::1]")
+    return true;
+  return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host);
+}
+function assertTransportSecurity(apiUrl, env) {
+  let parsed;
+  try {
+    parsed = new URL(apiUrl);
+  } catch {
+    throw new Error(`CANDLE_API_URL is not a valid URL: ${JSON.stringify(apiUrl)}`);
+  }
+  if (parsed.protocol === "https:")
+    return;
+  if (parsed.protocol !== "http:") {
+    throw new Error(`CANDLE_API_URL must be http or https, got ${parsed.protocol.replace(":", "")}`);
+  }
+  if (isLoopbackHost(parsed.hostname))
+    return;
+  if (env.CANDLE_ALLOW_INSECURE_HTTP?.trim())
+    return;
+  throw new Error(`Refusing to send credentials in the clear to ${parsed.origin}. Set CANDLE_API_URL to an https:// ` + "URL, or set CANDLE_ALLOW_INSECURE_HTTP=1 if this really is a trusted local endpoint.");
+}
+function resolveConfig(env = process.env) {
+  const apiUrl = env.CANDLE_API_URL?.trim() || DEFAULT_API_URL;
+  assertTransportSecurity(apiUrl, env);
+  const apiKey = env.CANDLE_AGENT_API_KEY?.trim() || env.CANDLE_API_KEY?.trim();
   return apiKey ? { apiUrl, apiKey } : { apiUrl };
 }
 
-// src/orchestrate.ts
-import { randomUUID } from "node:crypto";
-
 // src/convert.ts
 var QUOTE_DECIMALS = {
   sol: 9,
@@ -61,6 +85,7 @@ function percentOfBalance(balanceRaw, percent) {
 }
 
 // src/orchestrate.ts
+import { randomUUID } from "node:crypto";
 function requireApiKey(cfg) {
   if (!cfg.apiKey) {
     throw new Error("CANDLE_AGENT_API_KEY is required for this tool. Set it in the environment or MCP client config.");
@@ -135,7 +160,7 @@ async function postJson(url, apiKey, payload, doFetch) {
   }
 }
 async function readMarket(mint, cfg, doFetch, extra) {
-  const res = await doFetch(`${base(cfg)}/api/v1/markets/${chainForMint(mint)}/${mint}`, {
+  const res = await doFetch(`${base(cfg)}/api/v1/markets/${chainForMint(mint)}/${encodeURIComponent(mint)}`, {
     method: "GET",
     headers: headers()
   });
@@ -210,7 +235,7 @@ async function executeTrade(args, cfg, doFetch) {
       if (!address) {
         return errText(`percent sells need an embedded ${chain === "hood" ? "EVM" : "Solana"} wallet, and this account has none`, { clientTradeId });
       }
-      const balRes = await doFetch(`${base(cfg)}/api/v1/tokens/${args.mint}/balance/${address}`, {
+      const balRes = await doFetch(`${base(cfg)}/api/v1/tokens/${encodeURIComponent(args.mint)}/balance/${encodeURIComponent(address)}`, {
         method: "GET",
         headers: headers()
       });
@@ -274,7 +299,9 @@ async function executeLaunchAndSeed(args, cfg, doFetch) {
   let market = null;
   let note;
   try {
-    const marketRes = await doFetch(`${base(cfg)}/api/v1/markets/${launch.chain ?? "solana"}/${launch.mint}`, {
+    if (launch.mint === undefined)
+      throw new Error("the launch response carried no mint");
+    const marketRes = await doFetch(`${base(cfg)}/api/v1/markets/${encodeURIComponent(launch.chain ?? "solana")}/${encodeURIComponent(launch.mint)}`, {
       method: "GET",
       headers: headers()
     });
@@ -356,6 +383,48 @@ async function executeSweep(args, cfg, doFetch) {
     ...transferred === 0 && failed > 0 ? { isError: true } : {}
   };
 }
+async function resolveToken(args, cfg, doFetch) {
+  const chain = chainForMint(args.mint);
+  const read = await readMarket(args.mint, cfg, doFetch, { mint: args.mint, chain });
+  if ("err" in read)
+    return read.err;
+  return { text: JSON.stringify({ success: true, chain, mint: args.mint, market: read.market }, null, 2) };
+}
+async function executionStatus(cfg, doFetch) {
+  const apiKey = requireApiKey(cfg);
+  const get = async (path) => {
+    const res = await doFetch(`${base(cfg)}${path}`, { method: "GET", headers: headers(apiKey) });
+    const text = await res.text();
+    let body;
+    try {
+      body = JSON.parse(text);
+    } catch {
+      body = text;
+    }
+    return { ok: res.ok, status: res.status, body };
+  };
+  const [wallets, tier, limits] = await Promise.all([
+    get("/api/v1/agent/wallets/embedded"),
+    get("/api/v1/agent/tier"),
+    get("/api/v1/agent/keys/self/limits")
+  ]);
+  const unreadable = [
+    ["wallets", wallets],
+    ["tier", tier],
+    ["limits", limits]
+  ].filter(([, r]) => !r.ok);
+  return {
+    text: JSON.stringify({
+      success: true,
+      ready: unreadable.length === 0 ? true : undefined,
+      unreadable: unreadable.length > 0 ? unreadable.map(([name]) => name) : undefined,
+      wallets: wallets.body,
+      tier: tier.body,
+      limits: limits.body
+    }, null, 2),
+    ...unreadable.length > 0 ? { isError: true } : {}
+  };
+}
 
 // src/tools.ts
 var TOOL_NAMES = [
@@ -369,7 +438,11 @@ var TOOL_NAMES = [
   "candle_launch_and_seed",
   "candle_swap",
   "candle_transfer",
-  "candle_sweep"
+  "candle_sweep",
+  "candle_get_wallets",
+  "candle_resolve_token",
+  "candle_execution_status",
+  "candle_get_operation"
 ];
 function resolveToolAllowlist(env) {
   const raw = env.CANDLE_MCP_TOOLS?.trim();
@@ -394,6 +467,25 @@ function jsonHeaders(apiKey) {
     headers2["x-api-key"] = apiKey;
   return headers2;
 }
+function swapBody(args) {
+  const { amount, amountRaw, ...rest } = args;
+  const hasAmount = typeof amount === "string" && amount.length > 0;
+  const hasRaw = typeof amountRaw === "string" && amountRaw.length > 0;
+  if (hasAmount && hasRaw) {
+    throw new Error("Pass exactly one of amount or amountRaw, not both.");
+  }
+  if (!hasAmount && !hasRaw) {
+    throw new Error('Pass an amount, e.g. amount: "0.5".');
+  }
+  if (hasRaw)
+    return { ...rest, amountRaw };
+  const from = String(rest.from ?? "").toLowerCase();
+  const decimals = QUOTE_DECIMALS[from];
+  if (decimals === undefined) {
+    throw new Error(`Unknown decimals for base asset "${from}". Pass amountRaw instead.`);
+  }
+  return { ...rest, amountRaw: decimalToRaw(amount, decimals) };
+}
 function buildRequest(name, args, cfg) {
   const base2 = cfg.apiUrl.replace(/\/$/, "");
   switch (name) {
@@ -408,12 +500,15 @@ function buildRequest(name, args, cfg) {
     }
     case "candle_get_market": {
       const { chain, mint } = args;
-      return { url: `${base2}/api/v1/markets/${chain}/${mint}`, init: { method: "GET", headers: jsonHeaders() } };
+      return {
+        url: `${base2}/api/v1/markets/${encodeURIComponent(chain)}/${encodeURIComponent(mint)}`,
+        init: { method: "GET", headers: jsonHeaders() }
+      };
     }
     case "candle_token_forensics": {
       const { chain, mint } = args;
       return {
-        url: `${base2}/api/v1/markets/${chain}/${mint}/forensics`,
+        url: `${base2}/api/v1/markets/${encodeURIComponent(chain)}/${encodeURIComponent(mint)}/forensics`,
         init: { method: "GET", headers: jsonHeaders() }
       };
     }
@@ -434,13 +529,29 @@ function buildRequest(name, args, cfg) {
     }
     case "candle_get_agent_profile": {
       const { idOrWallet } = args;
-      return { url: `${base2}/api/v1/users/${idOrWallet}/agent`, init: { method: "GET", headers: jsonHeaders() } };
+      return {
+        url: `${base2}/api/v1/users/${encodeURIComponent(idOrWallet)}/agent`,
+        init: { method: "GET", headers: jsonHeaders() }
+      };
     }
     case "candle_swap": {
       const apiKey = requireApiKey2(cfg);
       return {
         url: `${base2}/api/v1/agent/swap`,
-        init: { method: "POST", headers: jsonHeaders(apiKey), body: JSON.stringify(args) }
+        init: { method: "POST", headers: jsonHeaders(apiKey), body: JSON.stringify(swapBody(args)) }
+      };
+    }
+    case "candle_get_operation": {
+      const apiKey = requireApiKey2(cfg);
+      const { clientId, kind } = args;
+      const path = kind === "launch" ? `/api/v1/launch/headless/jobs/${encodeURIComponent(clientId)}` : `/api/v1/trade/agent/jobs/${encodeURIComponent(clientId)}`;
+      return { url: `${base2}${path}`, init: { method: "GET", headers: jsonHeaders(apiKey) } };
+    }
+    case "candle_get_wallets": {
+      const apiKey = requireApiKey2(cfg);
+      return {
+        url: `${base2}/api/v1/agent/wallets/embedded`,
+        init: { method: "GET", headers: jsonHeaders(apiKey) }
       };
     }
     case "candle_transfer": {
@@ -497,10 +608,18 @@ var reportActivityShape = {
 var getAgentProfileShape = {
   idOrWallet: z.string().describe("Candle username or wallet address")
 };
+var getOperationShape = {
+  clientId: z.string().describe("The clientTradeId or clientLaunchId the write used, or that the tool echoed back to you"),
+  kind: z.enum(["trade", "launch"]).describe("Which rail the id belongs to. Required: ids are caller-chosen strings with no shape to dispatch on")
+};
+var resolveTokenShape = {
+  mint: z.string().describe("Token mint (Solana, base58) or contract address (Hood, 0x-prefixed)")
+};
 var swapShape = {
   from: z.enum(["SOL", "USDC", "CNDL", "ETH", "USDG"]).describe("Base asset to spend"),
   to: z.enum(["SOL", "USDC", "CNDL", "ETH", "USDG"]).describe("Base asset to receive; must differ from `from`"),
-  amountRaw: z.string().describe("Raw base units of `from` to spend, as a positive integer string"),
+  amount: z.string().optional().describe('Decimal amount of `from` to spend, e.g. "0.5". Preferred. Pass exactly one of amount or amountRaw.'),
+  amountRaw: z.string().optional().describe("Raw base units of `from`, as a positive integer string. Kept for callers that already " + "compute raw units; new callers should use `amount`."),
   maxSlippageBps: z.number().optional().describe("Slippage bound in bps, 0-10000. Server defaults to 100 (1%)"),
   clientSwapId: z.string().optional().describe("Optional dedup key. Only coalesces a duplicate that arrives while the first call is still " + "in flight; one arriving after it settled will swap again")
 };
@@ -533,7 +652,7 @@ var sweepShape = {
   mints: z.array(z.string()).optional().describe("Extra token mints/contracts to sweep besides the chain's base assets (own-wallet destinations only).")
 };
 function registerTools(server, env = process.env) {
-  const cfg = resolveConfig();
+  const cfg = resolveConfig(env);
   const allowed = resolveToolAllowlist(env);
   const register = (name, ...rest) => {
     if (!allowed.has(name))
@@ -570,9 +689,52 @@ function registerTools(server, env = process.env) {
     description: "Read a Candle user's public agent profile: whether agent features are enabled and launch counts.",
     inputSchema: getAgentProfileShape
   }, async (args) => callAndRelay("candle_get_agent_profile", args, cfg));
+  register("candle_get_operation", {
+    title: "What happened to a write",
+    description: "Look up a trade or launch by the id its write used, and find out whether it landed. " + `Reads only; moves nothing.
+
+` + "Call this after a timeout, after a restart, or any time you hold an id and do not know " + `the outcome. Do NOT re-send the write to find out.
+
+` + `Four answers, four different next moves:
+` + "- `confirmed`/`failed`: it is over. `signature` proves the first, `errorCode` explains " + `the second.
+` + "- `built`/`submitted`: still in flight. Wait and ask again.\n" + "- 404 (`JOB_NOT_FOUND`): Candle never saw this id, so the write never reached the rail " + "and nothing moved. The original request is safe to send again exactly as it was. This " + `is a definite answer, not a failure to retry.
+
+` + "Amounts come back RAW, deliberately: the answer you need after a timeout is the outcome, " + "and you already know what you asked for.",
+    inputSchema: getOperationShape
+  }, async (args) => callAndRelay("candle_get_operation", args, cfg));
+  register("candle_get_wallets", {
+    title: "List the wallets Candle executes with",
+    description: "The account's EMBEDDED wallets, one per chain, with their delegation state. These are " + "the wallets candle_trade, candle_swap and candle_transfer spend from, so this is how an " + "agent finds its own funding addresses. Reads only; moves nothing. Not the same as the " + "account's LINKED wallets, which are the owner's own wallets and are not spent from here. " + "Balances are not included: read a specific one with the market and balance endpoints.",
+    inputSchema: {}
+  }, async () => callAndRelay("candle_get_wallets", {}, cfg));
+  register("candle_resolve_token", {
+    title: "Resolve a contract address to a token",
+    description: "Turn a bare contract address or mint into Candle's market for it: chain, symbol, " + "decimals, quote asset, and whether Candle can trade it. Start here when a human gives " + "you an address and nothing else. The chain is read off the address's own shape and is " + "not guessed, so it does not need to be supplied. Reads only; moves nothing. A 404 means " + "Candle has no market for that address, which is an answer, not a failure to retry.",
+    inputSchema: resolveTokenShape
+  }, async (args) => {
+    const result = await resolveToken(args, cfg, fetch);
+    return { content: [{ type: "text", text: result.text }], ...result.isError ? { isError: true } : {} };
+  });
+  register("candle_execution_status", {
+    title: "Can this key execute right now",
+    description: "One call before trading: the embedded wallets to spend from, the tier that decides what " + "may be traded, and this key's own spend limits. Reads only; moves nothing. Call it when " + "a run starts, or after an authorization error, rather than inferring readiness from a " + "failed trade. If a read could not be completed the tool says which one and does NOT " + "claim the account is unready: an unreachable endpoint and a missing tier are different " + "problems with different fixes.",
+    inputSchema: {}
+  }, async () => {
+    const result = await executionStatus(cfg, fetch);
+    return { content: [{ type: "text", text: result.text }], ...result.isError ? { isError: true } : {} };
+  });
   register("candle_swap", {
     title: "Convert between base assets",
-    description: "Convert one base asset into another through the account's own embedded wallets. MOVES " + "REAL FUNDS. A pair spanning the Solana side (SOL/USDC/CNDL) and the Hood side (ETH/USDG) " + "routes through the bridge, so this is how a Hood wallet gets funded before launching or " + "trading on hood. Amounts are RAW base units, not decimal. Test-environment keys are " + "refused: every leg settles on a live venue.",
+    description: "Convert one base asset into another through the account's own embedded wallets. MOVES " + `REAL FUNDS.
+
+` + "SOL, USDC and CNDL are on Solana. ETH and USDG are on Hood. A pair drawn from ONE of " + "those groups settles on that chain in a single transaction. A pair spanning both is a " + `BRIDGE, and this is how a Hood wallet gets funded before launching or trading there.
+
+` + `A bridge behaves differently and the difference matters:
+` + `- It is several transactions, not one, and it takes time rather than settling on the call.
+` + "- A confirmed source transaction is NOT proof the destination was credited. Read the " + "returned status before treating the funds as arrived; the response carries the venue's " + `own status URLs for the cross-chain fill.
+` + "- Do NOT re-send after a timeout. `clientSwapId` only coalesces a duplicate that arrives " + "while the first call is still in flight; once the first has settled, a second call with " + `the same id bridges AGAIN. If a bridge times out, check its status rather than retrying.
+
+` + 'Amounts are decimal (`amount`, e.g. "0.5"); `amountRaw` still accepts raw base units for ' + "callers that already compute them. Test-environment keys are refused: every leg settles " + "on a live venue.",
     inputSchema: swapShape
   }, async (args) => callAndRelay("candle_swap", args, cfg));
   register("candle_transfer", {
@@ -607,10 +769,25 @@ function registerTools(server, env = process.env) {
 }
 
 // src/version.ts
-var SERVER_VERSION = "0.4.0";
+var SERVER_VERSION = "0.6.0";
+
+// src/server.ts
+function createCandleMcpServer(env = process.env) {
+  const server = new McpServer({ name: "candle-mcp", version: SERVER_VERSION });
+  registerTools(server, env);
+  return server;
+}
+async function runStdioServer(env = process.env, transport = new StdioServerTransport) {
+  const server = createCandleMcpServer(env);
+  await server.connect(transport);
+  await new Promise((resolve) => {
+    const sdkOnClose = transport.onclose;
+    transport.onclose = () => {
+      sdkOnClose?.();
+      resolve();
+    };
+  });
+}
 
 // src/index.ts
-var server = new McpServer({ name: "candle-mcp", version: SERVER_VERSION });
-registerTools(server);
-var transport = new StdioServerTransport;
-await server.connect(transport);
+await runStdioServer();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@candledottv/mcp",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "MCP server for the Candle agent rail: launch tokens, read markets, report activity",
   "type": "module",
   "license": "MIT",