@caravo/mcp 0.1.25 → 0.1.27

package/dist/index.js

@@ -195,7 +195,7 @@ async function apiPost(path, body) {
         process.stderr.write(`[caravo] API key request failed (${r.status}), falling back to x402\n`);
         const x402Opts = {
             method: "POST",
-            headers: { "Content-Type": "application/json" },
+            headers: baseHeaders(), // Keep Authorization for user attribution on x402 fallback
             body: JSON.stringify(body),
         };
         return safeParseJson(await fetchWithX402(url, x402Opts, wallet));
@@ -246,6 +246,35 @@ function stripDangerousFields(input) {
     }
     return cleaned;
 }
+/**
+ * Resolve local file paths in tool input to base64.
+ * Detects file:// URIs and absolute paths with image extensions.
+ * Runs locally so base64 never enters the LLM context.
+ */
+function resolveLocalFiles(input) {
+    const result = { ...input };
+    for (const [key, value] of Object.entries(result)) {
+        if (typeof value !== "string")
+            continue;
+        const filePath = toLocalPath(value);
+        if (!filePath)
+            continue;
+        if (!existsSync(filePath)) {
+            throw new Error(`Local file not found: ${filePath}`);
+        }
+        result[key] = readFileSync(filePath).toString("base64");
+    }
+    return result;
+}
+function toLocalPath(value) {
+    if (value.startsWith("file:///"))
+        return value.slice(7);
+    if (value.startsWith("file://"))
+        return value.slice(7);
+    if (/^\//.test(value) && /\.(png|jpe?g|gif|webp|bmp|svg|tiff?)$/i.test(value))
+        return value;
+    return null;
+}
 // ─── Favorites registration ────────────────────────────────────────────────────
 // Track registered fav tool handles for dynamic add/remove
 const registeredFavTools = new Map();
@@ -342,7 +371,8 @@ function buildPostExecPrompt(execId, toolId) {
 function makeFavToolHandler(tool) {
     return async (args) => {
         // Extract dry_run before passing remaining args to the API
-        const { dry_run, ...toolInput } = args;
+        const { dry_run, ...rawInput } = args;
+        const toolInput = resolveLocalFiles(rawInput);
         if (dry_run) {
             return dryRunProbe(tool.id, toolInput);
         }
@@ -571,6 +601,7 @@ function registerAllTools(server) {
     server.registerTool("use_tool", {
         description: "Execute any marketplace tool by ID. Use get_tool_info first to see the required input schema. " +
             "Paid tools auto-pay via x402 (wallet) or API key balance. " +
+            "File upload tip: For tools that accept file input, you can pass a local file path (e.g., /path/to/photo.jpg) or file:// URI — it will be auto-converted to base64. Prefer passing a URL when available. " +
             "After using a tool, check existing reviews first — upvote one if it matches your experience, or write a new review if none captures your feedback.",
         inputSchema: {
             tool_id: z.string().describe("The tool ID or slug to execute (e.g., 'black-forest-labs/flux.1-schnell' or 'alice/imagen-4')"),
@@ -587,7 +618,7 @@ function registerAllTools(server) {
                 isError: true,
             };
         }
-        const cleanInput = stripDangerousFields(input);
+        const cleanInput = resolveLocalFiles(stripDangerousFields(input));
         // Dry-run mode: probe cost without executing or paying
         if (dry_run) {
             return dryRunProbe(tool_id.trim(), cleanInput);
@@ -893,7 +924,9 @@ function registerAllTools(server) {
             "Removes the saved API key and unregisters all favorited tools from this session.",
         inputSchema: {},
     }, async () => {
-        if (!API_KEY) {
+        // Check both in-memory key and config file (key may have been set by CLI login after MCP started)
+        const configKey = loadConfig().api_key;
+        if (!API_KEY && !configKey) {
             return {
                 content: [{ type: "text", text: "Not logged in — already using x402 wallet payments." }],
             };
@@ -902,9 +935,11 @@ function registerAllTools(server) {
         API_KEY = undefined;
         // 2. Remove key from config file
         try {
-            const config = loadConfig();
-            delete config.api_key;
-            saveConfig(config);
+            if (configKey) {
+                const config = loadConfig();
+                delete config.api_key;
+                saveConfig(config);
+            }
         }
         catch {
             // config file may not exist — that's fine

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@caravo/mcp",
-  "version": "0.1.25",
+  "version": "0.1.27",
   "description": "The API marketplace built for autonomous AI agents. Search, execute, and pay for 200+ tools at $0.001–0.05 per call.",
   "type": "module",
   "bin": {