@chaindaddy/mcp 0.4.2 → 0.6.0

package/README.md

@@ -57,11 +57,14 @@ Free key is enough. Connect your wallet at [chaindaddy.io/_api](https://chaindad
 a tool says so and stops before calling the API. Where the client passes your shell's environment to MCP
 servers (Claude Code does), export it in your shell instead of writing it into a file.
 
+No key at all: run `npx @chaindaddy/cli login` once on the same computer. The server uses that login (and keeps
+it refreshed) whenever `CHAINDADDY_API_KEY` is unset.
+
 ### Environment Variables
 
 | Variable | Default | Description |
 |----------|---------|-------------|
-| `CHAINDADDY_API_KEY` | — | Your `cd_live_` API key. Sent as `X-API-Key` on every call, and the Bearer credential for creator and admin calls when a tool gets no `session_token` |
+| `CHAINDADDY_API_KEY` | — | Your `cd_live_` API key. Sent as `X-API-Key` on every call, and the Bearer credential for creator and admin calls when a tool gets no `session_token`. Unset, the CLI's `chaindaddy login` is used when there is one |
 | `CHAINDADDY_IAP_KEY` | — | A `cd_iap_` store key for your app's server: one store, explicit scopes. Used by the store-scoped `iap_*` tools when no `session_token` is passed |
 | `CHAINDADDY_API_URL` | `https://api.chaindaddy.io` | Chain Daddy API endpoint. A `localhost` API needs no key |
 | `CHAINDADDY_NETWORK` | `mainnet` | A label shown in `chaindaddy://config`; it does not change which API is called |
@@ -140,7 +143,7 @@ or Developer Beta membership on the wallet that opens the store (otherwise `403
 | `iap_set_webhook`, `iap_get_webhook`, `iap_test_webhook` | The store's webhook: set it (secret shown once), read its recent deliveries, send a test event |
 
 Every write sends an `Idempotency-Key` and returns it as `idempotency_key`; retry with the same key and the
-write never applies twice. The orchestration skill is [`skills/creator-store.md`](skills/creator-store.md).
+write never applies twice. The orchestration skill is [`skills/sell-items-in-your-app`](skills/sell-items-in-your-app/SKILL.md).
 
 ```
 "Open a store for my token on Base and add a gold badge for $5"
@@ -148,6 +151,15 @@ write never applies twice. The orchestration skill is [`skills/creator-store.md`
 "Give every wallet in this list 10 credits"
 ```
 
+## Skills
+
+The server serves Chain Daddy's skills, step-by-step workflows such as `launch-a-token` and
+`sell-items-in-your-app`, as MCP prompts (one per skill) and through two read-only tools for clients that
+only call tools: `list_skills` and `read_skill`. They are the files in [`skills/`](skills), the one copy:
+the remote server (`https://api.chaindaddy.io/mcp`) serves the same text, and the
+[chaindaddy plugin](https://gitlab.com/opencrown/chaindaddy-plugins) copies them with its
+`scripts/sync-skills.sh`.
+
 ## Example Conversations
 
 ### Search and Discover

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;;;;GAMG;AAgDH,UAAU,OAAO;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,eAAO,MAAM,QAAQ,sBAA6B,CAAC;AAInD,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAU7D;AAKD,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAQ1F"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;;;;GAMG;AAkDH,UAAU,OAAO;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,eAAO,MAAM,QAAQ,sBAA6B,CAAC;AAInD,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAU7D;AAKD,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAQ1F"}

package/build/index.js

@@ -14,6 +14,8 @@ import { createRequire } from "node:module";
 import { SiweMessage } from "siwe";
 import nacl from "tweetnacl";
 import bs58 from "bs58";
+import { CLI_LOGIN, hasCliLogin, loginFetch } from "./login.js";
+import { loadSkills } from "./skills.js";
 // Configuration
 const API_URL = process.env.CHAINDADDY_API_URL || "https://api.chaindaddy.io";
 // A recommender service you run yourself. The hosted API has none, so with
@@ -64,22 +66,26 @@ export function requireSessionJWT(session_token) {
     }
     return { session, jwt: session.jwt };
 }
-const NO_API_KEY_MESSAGE = "NO_API_KEY: CHAINDADDY_API_KEY is not set, and the Chain Daddy API answers callers outside chaindaddy.io " +
-    "only with an API key. Get a free one: connect your wallet at https://chaindaddy.io/_api and click " +
+const NO_API_KEY_MESSAGE = "NO_API_KEY: CHAINDADDY_API_KEY is not set and this computer is not signed in, and the Chain Daddy API " +
+    "answers callers outside chaindaddy.io only with either. Easiest: run `npx @chaindaddy/cli login` once " +
+    "on this computer, then restart this server. Or get a free key: connect your wallet at https://chaindaddy.io/_api and click " +
     "Generate API Key (a developer-program member can also run `chaindaddy app key create`). Then set " +
     "CHAINDADDY_API_KEY=cd_live_… where this server starts. For read-only search, token and health lookups " +
     "with no key, connect the remote server https://api.chaindaddy.io/mcp instead.";
 // Paths the API serves with no key (pkg/middleware/origin.go PublicPaths).
 const KEYLESS_PATHS = ["/api/v2/tokenlist", "/api/v2/iap", "/api/v2/heartbeat/oracle"];
-// Headers for a call to the API: X-API-Key when it is set. With no key, a call
-// that needs one fails here with what to do, rather than as a bare 401. A local
-// API (dev mode, localhost) needs no key.
+// Headers for a call to the API: X-API-Key when it is set, else the CLI's
+// stored `chaindaddy login` (the bearer marker loginFetch swaps for DPoP). With
+// neither, a call that needs one fails here with what to do, rather than as a
+// bare 401. A local API (dev mode, localhost) needs no key.
 function apiHeaders(endpoint, baseUrl = API_URL) {
     const headers = {};
     if (API_KEY) {
         headers["X-API-Key"] = API_KEY;
         return headers;
     }
+    if (hasCliLogin(baseUrl))
+        return { Authorization: `Bearer ${CLI_LOGIN}` };
     const path = endpoint.split("?")[0];
     const keyless = KEYLESS_PATHS.some((p) => path === p || path.startsWith(`${p}/`));
     const local = /^https?:\/\/(localhost|127\.0\.0\.1|\[::1\])(:|\/|$)/.test(baseUrl);
@@ -101,7 +107,7 @@ async function apiCall(endpoint, options = {}) {
     Object.assign(headers, options.headers);
     if (options.jwt)
         headers["Authorization"] = `Bearer ${options.jwt}`;
-    const response = await fetch(url, { headers });
+    const response = await loginFetch(API_URL, url, { headers });
     if (!response.ok)
         throw await apiError(response);
     return response.json();
@@ -116,7 +122,7 @@ async function apiPost(endpoint, body, headers = {}, options = {}) {
     };
     if (options.jwt)
         finalHeaders["Authorization"] = `Bearer ${options.jwt}`;
-    const response = await fetch(url, {
+    const response = await loginFetch(API_URL, url, {
         method: "POST",
         headers: finalHeaders,
         body: JSON.stringify(body),
@@ -129,7 +135,7 @@ async function apiPost(endpoint, body, headers = {}, options = {}) {
 // so it's a mandatory option rather than `optional: jwt?`.
 async function apiPut(endpoint, body, options) {
     const url = `${API_URL}${endpoint}`;
-    const response = await fetch(url, {
+    const response = await loginFetch(API_URL, url, {
         method: "PUT",
         headers: {
             ...apiHeaders(endpoint),
@@ -145,7 +151,7 @@ async function apiPut(endpoint, body, options) {
 // Helper for DELETE requests
 async function apiDelete(endpoint, headers = {}) {
     const url = `${API_URL}${endpoint}`;
-    const response = await fetch(url, {
+    const response = await loginFetch(API_URL, url, {
         method: "DELETE",
         headers: {
             ...apiHeaders(endpoint),
@@ -184,9 +190,12 @@ function iapBearer(auth, session_token) {
         return IAP_KEY;
     if (API_KEY)
         return API_KEY;
+    // No key: the Chain Daddy CLI's `chaindaddy login`, when it is stored here.
+    if (hasCliLogin(API_URL))
+        return CLI_LOGIN;
     throw new IapError("NO_CREDENTIALS", auth === "store"
-        ? "Pass session_token, or set CHAINDADDY_IAP_KEY (a store key) or CHAINDADDY_API_KEY (a cd_live_ key)"
-        : "Pass session_token, or set CHAINDADDY_API_KEY (a cd_live_ key)", 401);
+        ? "Pass session_token, run `chaindaddy login`, or set CHAINDADDY_IAP_KEY (a store key) or CHAINDADDY_API_KEY (a cd_live_ key)"
+        : "Pass session_token, run `chaindaddy login`, or set CHAINDADDY_API_KEY (a cd_live_ key)", 401);
 }
 async function iapRequest(method, path, opts) {
     const headers = { Accept: "application/json" };
@@ -204,7 +213,7 @@ async function iapRequest(method, path, opts) {
     }
     if (opts.body !== undefined)
         headers["Content-Type"] = "application/json";
-    const response = await fetch(`${API_URL}/api/v2/iap${path}`, {
+    const response = await loginFetch(API_URL, `${API_URL}/api/v2/iap${path}`, {
         method,
         headers,
         body: opts.body === undefined ? undefined : JSON.stringify(opts.body),
@@ -269,6 +278,10 @@ const VERSION = createRequire(import.meta.url)("../package.json").version;
 const server = new McpServer({
     name: "chaindaddy",
     version: VERSION,
+}, {
+    instructions: "Chain Daddy is a registry of verified token pages: each token's ticker on each chain can carry one registration, held by the wallet that proved it created or controls the token. " +
+        "These tools search tickers, launch or import a token, and run its creator store. " +
+        "Step-by-step workflows (launching or checking a token, exporting a listing, selling items, sign-in, verifying receipts, Crown Apps) are this server's prompts, and list_skills / read_skill read the same skills: read the matching one before such a task.",
 });
 // ============================================================================
 // TOOLS
@@ -1105,9 +1118,10 @@ server.registerTool("get_recommendations", {
 // value, so we only include keys the caller actually passed.
 server.registerTool("update_profile", {
     title: "Update token page profile",
-    description: "Update crown profile metadata via PUT /api/v2/registration/{id}/profile. Requires a session bound to a backend JWT (run authenticate first) and the session wallet must own or manage the crown.\n\nParams: crown_id (string), description (string?), tags (string[]?), category ('meme'|'gaming'|'defi'|'nft'|'social'|'utility'?) [NOT FORWARDED — no backend route exposes category on the profile endpoint], website (string?), socials ({twitter?, telegram?, discord?}?), logo_url (string?), session_token (string)\nReturns: {updated_fields: string[]}\nErrors: NO_SESSION, SESSION_EXPIRED, NO_JWT, NOT_OWNER, NO_FIELDS, API_ERROR",
+    description: "Update crown profile metadata via PUT /api/v2/registration/{id}/profile?chain={chain}. Requires a session bound to a backend JWT (run authenticate first) and the session wallet must own or manage the crown on that chain.\n\nParams: crown_id (string), chain (string; required, a token id names a different crown on every chain), description (string?), tags (string[]?), category ('meme'|'gaming'|'defi'|'nft'|'social'|'utility'?) [NOT FORWARDED — no backend route exposes category on the profile endpoint], website (string?), socials ({twitter?, telegram?, discord?}?), logo_url (string?), session_token (string)\nReturns: {updated_fields: string[]}\nErrors: NO_SESSION, SESSION_EXPIRED, NO_JWT, NOT_OWNER, NO_FIELDS, API_ERROR",
     inputSchema: {
         crown_id: z.string().describe("Crown ID (token ID)"),
+        chain: z.string().describe("Chain of the crown (e.g. 'base', 'arbitrum', 'solana'). Required: a token id names a different crown on every chain, and the role check and write happen on this one."),
         description: z.string().optional().describe("Token/project description"),
         tags: z.array(z.string()).optional().describe("Descriptive tags (e.g., ['meme', 'dog', 'community'])"),
         category: z.enum(["meme", "gaming", "defi", "nft", "social", "utility"]).optional().describe("Project category. ACCEPTED but NOT forwarded — the profile endpoint does not expose this field today; the input is preserved here for API stability."),
@@ -1121,7 +1135,7 @@ server.registerTool("update_profile", {
         session_token: z.string().describe("Session token from authenticate (must have been issued post-JWT-bridge, i.e. after fix/mcp-siwe-jwt-bridge)"),
     },
     annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
-}, async ({ crown_id, description, tags, category, website, socials, logo_url, session_token }) => {
+}, async ({ crown_id, chain, description, tags, category, website, socials, logo_url, session_token }) => {
     void category;
     try {
         const { jwt } = requireSessionJWT(session_token);
@@ -1151,7 +1165,7 @@ server.registerTool("update_profile", {
                 isError: true,
             };
         }
-        await apiPut(`/api/v2/registration/${encodeURIComponent(crown_id)}/profile`, payload, { jwt });
+        await apiPut(`/api/v2/registration/${encodeURIComponent(crown_id)}/profile?chain=${encodeURIComponent(chain)}`, payload, { jwt });
         return {
             content: [{ type: "text", text: JSON.stringify({
                         updated_fields: Object.keys(payload),
@@ -1743,6 +1757,13 @@ const iapSkuFields = {
     rule: iapRule.nullable(),
     maxSupply: z.number().int().positive().nullable(),
     maxPerWallet: z.number().int().positive().nullable(),
+    maxAppSpend: z
+        .number()
+        .int()
+        .positive()
+        .max(1_000_000)
+        .nullable()
+        .describe("Consumables only: lets Crown Apps on the token page spend this item for the wallet that holds it (the `iap-consume` app action, no server), at most this many per request. null (the default): no app can, only a store key with iap_consume. Leave it null for anything redeemed for a prize or off-platform value"),
     saleStartsAt: z.string().nullable(),
     saleEndsAt: z.string().nullable(),
     status: z.enum(["draft", "active", "archived"]),
@@ -1857,7 +1878,7 @@ server.registerTool("iap_list_skus", {
 }, async ({ store_id, session_token }) => iapRead(`/stores/${enc(store_id)}/skus`, "store", session_token));
 server.registerTool("iap_create_sku", {
     title: "Create a store item",
-    description: "Create a SKU. Types: consumable (a balance: coins, boosts), non_consumable (owned once: skins, cars), timed (expiry extended by durationSeconds × quantity: season pass), unlock (never sold; held while `rule` holds). No price = reward-only. Price in base units (`price`) or in dollars (`priceUsdMicros`, with optional per-unit `minPrice`/`maxPrice` bounds in base units), never both. `currency` is what the buyer pays in: 'token' (default; recommended with priceUsdMicros — a steady dollar price, paid in the creator's token), 'native' or 'usdc'. GET /api/v2/iap/config lists each chain's currencies. `grants` makes a bundle. `splits` pays up to 2 more wallets (3 on a launchpad token) a share of each sale. New SKUs are drafts unless status is 'active'. Store key scope: catalog:write.\n\nParams: store_id, sku ({sku, type, name, currency?, price?, priceUsdMicros?, minPrice?, maxPrice?, grants?, splits?, durationSeconds?, rule?, maxSupply?, maxPerWallet?, saleStartsAt?, saleEndsAt?, status?, metadata?, description?, imageUrl?, sortOrder?}), session_token?, idempotency_key?\nReturns: {ok, idempotency_key, sku: Sku}\nErrors: NO_CREDENTIALS, IAP_PLAN_REQUIRED, HTTP_400 (validation), HTTP_409 (sku key taken)",
+    description: "Create a SKU. Types: consumable (a balance: coins, boosts), non_consumable (owned once: skins, cars), timed (expiry extended by durationSeconds × quantity: season pass), unlock (never sold; held while `rule` holds). No price = reward-only. Price in base units (`price`) or in dollars (`priceUsdMicros`, with optional per-unit `minPrice`/`maxPrice` bounds in base units), never both. `currency` is what the buyer pays in: 'token' (default; recommended with priceUsdMicros — a steady dollar price, paid in the creator's token), 'native' or 'usdc'. GET /api/v2/iap/config lists each chain's currencies. `grants` makes a bundle. `splits` pays up to 2 more wallets (3 on a launchpad token) a share of each sale. New SKUs are drafts unless status is 'active'. Store key scope: catalog:write.\n\nParams: store_id, sku ({sku, type, name, currency?, price?, priceUsdMicros?, minPrice?, maxPrice?, grants?, splits?, durationSeconds?, rule?, maxSupply?, maxPerWallet?, maxAppSpend?, saleStartsAt?, saleEndsAt?, status?, metadata?, description?, imageUrl?, sortOrder?}), session_token?, idempotency_key?\nReturns: {ok, idempotency_key, sku: Sku}\nErrors: NO_CREDENTIALS, IAP_PLAN_REQUIRED, HTTP_400 (validation), HTTP_409 (sku key taken)",
     inputSchema: { store_id: iapStoreId, sku: iapSkuInput, session_token: iapSessionToken, idempotency_key: iapIdempotencyKey },
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
 }, async ({ store_id, sku, session_token, idempotency_key }) => iapWrite("sku", "POST", `/stores/${enc(store_id)}/skus`, sku, "store", session_token, idempotency_key));
@@ -2139,6 +2160,48 @@ server.resource("chaindaddy://tools", "How the tools fit together: sign-in, crow
         }],
 }));
 // ============================================================================
+// SKILLS
+// ============================================================================
+// Chain Daddy's Agent Skills (the package's skills/ directory, the same files
+// the remote server embeds and the plugin copies) are served as prompts, one
+// per skill, and through two read-only tools for clients that only call tools.
+const SKILLS = loadSkills();
+for (const skill of SKILLS) {
+    server.registerPrompt(skill.name, { title: skill.title, description: skill.description }, () => ({
+        description: skill.description,
+        messages: [{ role: "user", content: { type: "text", text: skill.body } }],
+    }));
+}
+server.registerTool("list_skills", {
+    title: "List the skills",
+    description: "List Chain Daddy's skills: step-by-step workflows for launching or finding a token, checking its health, exporting a listing, selling items for it, signing users in, verifying receipts and building Crown Apps. Read one with read_skill before doing that task. The same skills are this server's prompts.",
+    inputSchema: {},
+    outputSchema: { skills: z.array(z.object({ name: z.string(), title: z.string(), description: z.string() })) },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+}, async () => ({
+    content: [{
+            type: "text",
+            text: "Chain Daddy skills (read one with read_skill):\n" +
+                SKILLS.map((s) => `\n- ${s.name} (${s.title}): ${s.description}`).join(""),
+        }],
+    structuredContent: { skills: SKILLS.map(({ name, title, description }) => ({ name, title, description })) },
+}));
+server.registerTool("read_skill", {
+    title: "Read a skill",
+    description: "Read one Chain Daddy skill in full, as Markdown: the workflow, the tools it uses and the rules it keeps. Pass a name from list_skills, and follow it for that task.",
+    inputSchema: { name: z.string().describe("A skill name from list_skills.") },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+}, async ({ name }) => {
+    const skill = SKILLS.find((s) => s.name === name.trim());
+    if (!skill) {
+        return {
+            content: [{ type: "text", text: `no skill is named ${JSON.stringify(name)}; the skills are: ${SKILLS.map((s) => s.name).join(", ")}` }],
+            isError: true,
+        };
+    }
+    return { content: [{ type: "text", text: skill.body }] };
+});
+// ============================================================================
 // START SERVER
 // ============================================================================
 async function main() {