@cloakely/mcp 0.2.0 → 0.4.0

package/README.md

@@ -6,6 +6,12 @@ An agent that trades on chain leaks its strategy with every transaction, and any
 
 **Testnet only for now** (Elysium testnet, chain `99801`). Play money only.
 
+**The easy way:** tell your agent
+
+> Read https://cloak.boblabs.tech/agent.md and set me up to trade privately.
+
+That page is written for agents. The agent sets up its own wallet and the connection, and asks you only for what it can't do itself (free testnet HYPE from the faucet). It never needs your own wallet's key.
+
 There are two ways in:
 
 | | Hosted link | Local server (this package) |
@@ -25,16 +31,18 @@ Its tools: `cloak_info`, `list_launches`, `get_launch`, `quote_bid`, `quote_swap
 
 ## Set up the local server
 
-Create a fresh wallet for the agent, fund it from the [Elysium faucet](https://elysium.kinetiq.xyz/testnet-faucet), and put its private key in a file only you can read:
+Make the agent's own wallet. It's saved in `~/.cloak-agent-key`, readable by you only, and the key is never printed:
 
 ```sh
-umask 077 && echo 0xYOUR_AGENT_KEY > ~/.cloak-agent-key
+npx -y @cloakely/mcp setup
 ```
 
+It prints the wallet's address. Fund it with free testnet HYPE from the [Elysium faucet](https://elysium.kinetiq.xyz/testnet-faucet). Running it again keeps the same wallet.
+
 **Claude Code:**
 
 ```sh
-claude mcp add cloak --env CLOAK_KEY_FILE=$HOME/.cloak-agent-key -- npx -y @cloakely/mcp
+claude mcp add cloak -- npx -y @cloakely/mcp
 ```
 
 **Claude Desktop, Cursor and other clients** (`claude_desktop_config.json`, `.cursor/mcp.json`, and so on):
@@ -42,16 +50,14 @@ claude mcp add cloak --env CLOAK_KEY_FILE=$HOME/.cloak-agent-key -- npx -y @cloa
 ```json
 {
   "mcpServers": {
-    "cloak": {
-      "command": "npx",
-      "args": ["-y", "@cloakely/mcp"],
-      "env": { "CLOAK_KEY_FILE": "/Users/you/.cloak-agent-key" }
-    }
+    "cloak": { "command": "npx", "args": ["-y", "@cloakely/mcp"] }
   }
 }
 ```
 
-Without a key, the server is **read only**: the agent can browse launches and quote bids and swaps, but can't sign anything.
+The server uses `~/.cloak-agent-key` when nothing else is set. To use another wallet, set `CLOAK_KEY_FILE` (or `CLOAK_PRIVATE_KEY`) in the server's `env`.
+
+Without a key (no `~/.cloak-agent-key` and nothing set), the server is **read only**: the agent can browse launches and quote bids and swaps, but can't sign anything.
 
 Then ask, for example:
 - "What Cloak launches are open right now?"
@@ -98,7 +104,7 @@ Amounts are in whole units (`"0.5"` HYPE). `private_send`, `withdraw` and a `pri
 
 | Variable | Default | |
 |---|---|---|
-| `CLOAK_KEY_FILE` | | File holding the agent wallet's private key (preferred) |
+| `CLOAK_KEY_FILE` | `~/.cloak-agent-key` if it exists | File holding the agent wallet's private key |
 | `CLOAK_PRIVATE_KEY` | | The key itself, if a file isn't practical |
 | `CLOAK_NETWORK` | `testnet` | `testnet`, or `custom` with `CLOAK_DEPLOYMENT_FILE` |
 | `CLOAK_MAX_HYPE_PER_TX` | `1` | HYPE value per transaction |

package/dist/config.d.ts

@@ -1,5 +1,7 @@
 import { type Chain, type Hex } from "viem";
 import { type CloakDeployment } from "@cloakely/sdk";
+/** The agent wallet's key file that `setup` creates and the server uses when no key is configured. */
+export declare const defaultKeyFile: () => string;
 /** Where the server points, and what it may do. Everything comes from environment variables (see README). */
 export interface Settings {
     network: string;
@@ -23,3 +25,8 @@ export interface Limits {
     launchesPerDay: number;
 }
 export declare function loadSettings(env?: NodeJS.ProcessEnv): Settings;
+/**
+ * `settings` with the current factory, router, batcher, migrator and vaults read from CloakConfig's registry, so a
+ * router added on-chain is used without a new release. Keeps the configured deployment if the registry can't be read.
+ */
+export declare function withLiveDeployment(settings: Settings): Promise<Settings>;

package/dist/config.js

@@ -1,8 +1,10 @@
-import { readFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { defineChain, parseEther, parseUnits } from "viem";
-import { deploymentFor, elysiumTestnet } from "@cloakely/sdk";
+import { createPublicClient, defineChain, http, parseEther, parseUnits } from "viem";
+import { deploymentFor, elysiumTestnet, liveDeployment } from "@cloakely/sdk";
+/** The agent wallet's key file that `setup` creates and the server uses when no key is configured. */
+export const defaultKeyFile = () => join(homedir(), ".cloak-agent-key");
 const NETWORKS = {
     testnet: { chain: elysiumTestnet },
 };
@@ -24,7 +26,14 @@ export function loadSettings(env = process.env) {
         rpcUrl = f.rpcUrl;
         chain = defineChain({ id: f.chainId, name: `Cloak custom (${f.chainId})`, nativeCurrency: { name: "HYPE", symbol: "HYPE", decimals: 18 }, rpcUrls: { default: { http: [rpcUrl] } }, testnet: true });
         launchesFromBlock = BigInt(f.launchesFromBlock ?? 0);
-        deployment = { ...f, version: f.version ?? 0, factoryBlock: launchesFromBlock, routerBlock: BigInt(f.routerBlock), assets: f.assets?.map((a) => ({ ...a, fromBlock: BigInt(a.fromBlock) })) };
+        deployment = {
+            ...f,
+            version: f.version ?? 0,
+            factoryBlock: launchesFromBlock,
+            routerBlock: BigInt(f.routerBlock),
+            vaultsBlock: f.vaultsBlock === undefined ? undefined : BigInt(f.vaultsBlock),
+            assets: f.assets?.map((a) => ({ ...a, fromBlock: BigInt(a.fromBlock) })),
+        };
     }
     else {
         const n = NETWORKS[network];
@@ -42,6 +51,9 @@ export function loadSettings(env = process.env) {
     let key = env.CLOAK_PRIVATE_KEY?.trim();
     if (!key && env.CLOAK_KEY_FILE)
         key = readFileSync(env.CLOAK_KEY_FILE, "utf8").trim();
+    // the wallet `npx @cloakely/mcp setup` made, when nothing else is configured
+    else if (!key && existsSync(defaultKeyFile()))
+        key = readFileSync(defaultKeyFile(), "utf8").trim();
     if (key && !key.startsWith("0x"))
         key = `0x${key}`;
     if (key && !/^0x[0-9a-fA-F]{64}$/.test(key))
@@ -71,3 +83,13 @@ export function loadSettings(env = process.env) {
         },
     };
 }
+/**
+ * `settings` with the current factory, router, batcher, migrator and vaults read from CloakConfig's registry, so a
+ * router added on-chain is used without a new release. Keeps the configured deployment if the registry can't be read.
+ */
+export async function withLiveDeployment(settings) {
+    const pub = createPublicClient({ chain: settings.chain, transport: http(settings.rpcUrl, { retryCount: 3, timeout: 15_000 }) });
+    const deployment = await liveDeployment(pub, settings.deployment).catch(() => settings.deployment);
+    const moved = deployment.factory.toLowerCase() !== settings.deployment.factory.toLowerCase();
+    return { ...settings, deployment, launchesFromBlock: moved ? deployment.factoryBlock : settings.launchesFromBlock };
+}

package/dist/http.js

@@ -1,5 +1,5 @@
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
-import { loadSettings } from "./config.js";
+import { loadSettings, withLiveDeployment } from "./config.js";
 import { createCloakServer } from "./server.js";
 /**
  * The hosted MCP endpoint as a web-standard handler (Request in, Response out), for any serverless runtime.
@@ -39,6 +39,8 @@ function limited(ip) {
     return h.n > REQUESTS_PER_MINUTE ? Math.ceil((h.start + 60_000 - now) / 1000) : 0;
 }
 let settings;
+let settingsAt = 0;
+const SETTINGS_TTL = 10 * 60_000; // re-read the registry every 10 minutes
 /** `settings` defaults to Elysium testnet, without a key (tests pass their own). */
 export async function handleMcpRequest(req, opts = {}) {
     if (req.method === "OPTIONS")
@@ -75,7 +77,11 @@ export async function handleMcpRequest(req, opts = {}) {
     headers.delete("transfer-encoding");
     const forward = new Request(req.url, { method: "POST", headers });
     // never a key here, whatever the environment says
-    const s = opts.settings ?? (settings ??= loadSettings({ CLOAK_NETWORK: "testnet", CLOAK_RPC_URL: process.env.CLOAK_RPC_URL, CLOAK_RELAYER_URL: process.env.CLOAK_RELAYER_URL }));
+    if (!opts.settings && (!settings || Date.now() - settingsAt > SETTINGS_TTL)) {
+        settingsAt = Date.now();
+        settings = withLiveDeployment(loadSettings({ CLOAK_NETWORK: "testnet", CLOAK_RPC_URL: process.env.CLOAK_RPC_URL, CLOAK_RELAYER_URL: process.env.CLOAK_RELAYER_URL }));
+    }
+    const s = opts.settings ?? (await settings);
     const server = createCloakServer(s, { hosted: true });
     const transport = new WebStandardStreamableHTTPServerTransport({ sessionIdGenerator: undefined, enableJsonResponse: true });
     try {

package/dist/index.js

@@ -1,9 +1,19 @@
 #!/usr/bin/env node
-// Cloak's MCP server over stdio: `npx @cloakely/mcp`. Configuration is environment variables only (see README).
+// Cloak's MCP server over stdio: `npx @cloakely/mcp`. Configuration is environment variables (see README).
+// `npx @cloakely/mcp setup` makes the agent's wallet in ~/.cloak-agent-key, which the server then uses by default.
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { createCloakServer, loadSettings, VERSION } from "./server.js";
+import { withLiveDeployment } from "./config.js";
+import { setup } from "./setup.js";
+if (process.argv[2] === "setup") {
+    // make the agent's wallet and print what's left to do (see https://cloak.boblabs.tech/agent.md)
+    await setup().then(() => process.exit(0), (e) => {
+        console.error(`cloak-mcp setup: ${e.message}`);
+        process.exit(1);
+    });
+}
 try {
-    const settings = loadSettings();
+    const settings = await withLiveDeployment(loadSettings());
     const server = createCloakServer(settings);
     await server.connect(new StdioServerTransport());
     // stdout carries the protocol, so anything for humans goes to stderr

package/dist/server.d.ts

@@ -3,7 +3,7 @@ import { type Prover } from "@cloakely/sdk";
 import type { Settings } from "./config.js";
 export { loadSettings, type Settings, type Limits } from "./config.js";
 export { Spending } from "./limits.js";
-export declare const VERSION = "0.2.0";
+export declare const VERSION = "0.4.0";
 export declare const HOSTED_URL = "https://cloak.boblabs.tech/mcp";
 /** Turn an SDK or chain error into one plain sentence an agent can act on. */
 export declare function explain(e: unknown): string;

package/dist/server.js

@@ -4,15 +4,15 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 import { createPublicClient, createWalletClient, erc20Abi, formatEther, formatUnits, http, isAddress, parseEther, parseUnits, zeroAddress, } from "viem";
 import { privateKeyToAccount } from "viem/accounts";
-import { Cloak, CloakPrivate, cloakPairAbi, createProver, loadProver, privateRouterAbi, relayerSubmitter, shieldedPoolAbi, } from "@cloakely/sdk";
+import { Cloak, CloakPrivate, cloakAuctionAbi, cloakPairAbi, cloakVaultsAbi, createProver, loadProver, privateRouterAbi, relayerSubmitter, shieldedPoolAbi, } from "@cloakely/sdk";
 import { Spending } from "./limits.js";
 export { loadSettings } from "./config.js";
 export { Spending } from "./limits.js";
-export const VERSION = "0.2.0";
+export const VERSION = "0.4.0";
 export const HOSTED_URL = "https://cloak.boblabs.tech/mcp";
 const INSTRUCTIONS = `Cloak: sealed-bid token launches and private trading on Kinetiq's Elysium (HYPE is the gas and base currency).
 
-Launches: create_launch starts a sealed-bid auction. place_sealed_bid commits a bid that nobody can read until bidding closes; bids then open by themselves (the keeper reveals them from the drand beacon), so there is nothing to come back for. Everyone who wins pays one clearing price. After settlement, claim pays out tokens and refunds (the keeper usually pushes claims already), and enable_private_trading opens a private vault for the token if nobody has yet.
+Launches: create_launch starts a sealed-bid auction. place_sealed_bid commits a bid that nobody can read until bidding closes; bids then open by themselves (the keeper reveals them from the drand beacon), so there is nothing to come back for. Everyone who wins pays one clearing price. After settlement, claim puts won tokens straight into the private balance (and refunds into the wallet); the keeper opens each launch's private vault at settlement, and pushes bids nobody claimed to wallets publicly about an hour later. enable_private_trading opens a private vault for an older launch if nobody has yet.
 
 Private balances: shield moves HYPE or USDC from the wallet into a private balance (the one public step). private_swap, batch_order, private_send and withdraw then run from that balance: each is proven on this machine and sent by a relayer, so the wallet never appears on chain. batch_order also hides trade size. withdraw lands funds at a normal address, ideally a fresh one. Amounts are in whole units ("0.5" HYPE), and send, sell and withdraw accept "max".
 
@@ -98,8 +98,9 @@ export function createCloakServer(settings, opts = {}) {
         if (!wallet)
             throw new Error("No wallet configured: set CLOAK_KEY_FILE (or CLOAK_PRIVATE_KEY) to use private balances.");
         privP ??= (async () => {
-            const keys = await CloakPrivate.keysFromWallet(wallet, { chainId: settings.chain.id, router: d.router, verify: true });
-            const p = new CloakPrivate(pub, d.router, keys, prover, submit, d.routerBlock, d.batcher, d.migrator);
+            const keys = await CloakPrivate.keysFromWallet(wallet, { chainId: settings.chain.id, verify: true });
+            // notes are scanned from the permanent vaults' first block, whichever router is current
+            const p = new CloakPrivate(pub, d.router, keys, prover, submit, d.vaultsBlock ?? d.routerBlock, d.batcher, d.migrator);
             for (const a of d.assets ?? [])
                 p.addAsset(a);
             return p;
@@ -130,6 +131,9 @@ export function createCloakServer(settings, opts = {}) {
             symbols.set(k, await pub.readContract({ address: token, abi: erc20Abi, functionName: "symbol" }).catch(() => "?"));
         return symbols.get(k);
     }
+    async function decimalsOf(token) {
+        return Number(await pub.readContract({ address: token, abi: erc20Abi, functionName: "decimals" }).catch(() => 18));
+    }
     /** Every asset with a private vault: HYPE, USDC-like assets, and every launch token with a private market. */
     async function vaults() {
         const c = { address: d.router, abi: privateRouterAbi };
@@ -137,14 +141,20 @@ export function createCloakServer(settings, opts = {}) {
         const out = [{ kind: "hype", symbol: "HYPE", token: d.whype, pool: d.hypePool, decimals: 18 }];
         for (const a of d.assets ?? [])
             out.push({ kind: "asset", symbol: a.symbol, token: a.token, pool: a.pool, decimals: a.decimals });
-        const toks = await Promise.all(Array.from({ length: Number(n) - 1 }, (_, i) => pub.readContract({ ...c, functionName: "tokens", args: [BigInt(i + 1)] })));
+        const toks = await Promise.all(Array.from({ length: Number(n) }, (_, i) => pub.readContract({ ...c, functionName: "tokens", args: [BigInt(i)] })));
         for (const token of toks) {
+            if (out.some((a) => a.token.toLowerCase() === token.toLowerCase()))
+                continue; // HYPE, or an asset already listed
             const [pool, pair, symbol] = await Promise.all([
                 pub.readContract({ ...c, functionName: "poolOf", args: [token] }),
                 pub.readContract({ ...c, functionName: "pairOf", args: [token] }),
                 symbolOf(token),
             ]);
-            out.push({ kind: "token", symbol, token, pool, pair, decimals: 18 });
+            // a vault without a launch pair holds an existing token (USDC): an asset, not a market
+            if (pair === zeroAddress)
+                out.push({ kind: "asset", symbol, token, pool, decimals: await decimalsOf(token) });
+            else
+                out.push({ kind: "token", symbol, token, pool, pair, decimals: 18 });
         }
         return out;
     }
@@ -383,14 +393,14 @@ export function createCloakServer(settings, opts = {}) {
         }));
         server.registerTool("connect_full_agent", { title: "Connect a full agent", description: "How to let an agent launch, bid and trade privately: the local Cloak MCP server, which signs on your own machine under spending limits.", inputSchema: {}, annotations: READ }, safe(async () => ({
             why: "This hosted server never holds keys, so it can read and plan but not sign. Launching, bidding and private trading run in the local server, on the machine that holds the agent's wallet. Its proofs are made there too, so nobody else, Cloak included, can see or move the funds.",
+            easiest: "If you can run terminal commands, read https://cloak.boblabs.tech/agent.md and follow it: it sets everything up and says what to ask the person. If you can't (a chat app), tell the person to open that link in Claude Code, Claude Desktop or Cursor and ask the agent there to follow it.",
             steps: [
-                "Make a fresh wallet just for the agent and fund it with testnet HYPE from https://elysium.kinetiq.xyz/testnet-faucet",
-                "Save its private key to a file only you can read, for example ~/.cloak-agent-key",
-                "Claude Code: claude mcp add cloak --env CLOAK_KEY_FILE=$HOME/.cloak-agent-key -- npx -y @cloakely/mcp",
-                'Other clients: { "mcpServers": { "cloak": { "command": "npx", "args": ["-y", "@cloakely/mcp"], "env": { "CLOAK_KEY_FILE": "/path/to/key" } } } }',
+                "npx -y @cloakely/mcp setup (makes the agent's own wallet in ~/.cloak-agent-key and prints its address; the key is never printed)",
+                "Claude Code: claude mcp add cloak -- npx -y @cloakely/mcp. Other clients: { \"mcpServers\": { \"cloak\": { \"command\": \"npx\", \"args\": [\"-y\", \"@cloakely/mcp\"] } } }",
+                "The person gets free testnet HYPE for the agent's address at https://elysium.kinetiq.xyz/testnet-faucet",
             ],
             safety: "Spending limits per transaction and per day (1 HYPE and 10 HYPE by default, set with CLOAK_MAX_HYPE_PER_TX and CLOAK_MAX_HYPE_PER_DAY), dry_run on every action, testnet by default. Never paste a key into a chat or into this hosted server.",
-            docs: "https://github.com/NECOKIZZ/Cloak/tree/main/packages/mcp",
+            docs: "https://cloak.boblabs.tech/agent.md",
         })));
         return server;
     }
@@ -479,29 +489,55 @@ export function createCloakServer(settings, opts = {}) {
             bids: bids.map((b) => ({ id: b.id, deposit: hype(b.deposit), opened: b.revealed, claimed: b.claimed, ...(s.settled ? { tokensWon: formatEther(b.tokens), refund: hype(b.refund), penalty: hype(b.penalty) } : {}) })),
         };
     }));
-    server.registerTool("claim", { title: "Claim tokens and refunds", description: "After bids open, settle the launch if nobody has yet, then claim the wallet's tokens and refunds. Cloak's keeper usually pushes claims already.", inputSchema: { auction: addr, dry_run: dry }, annotations: WRITE }, safe(async ({ auction, dry_run }) => {
+    server.registerTool("claim", {
+        title: "Claim tokens and refunds",
+        description: "After bids open, settle the launch if nobody has yet, then claim the wallet's tokens and refunds. Won tokens go straight into the private balance (privately: true, the default) when the launch supports it, so later trades can't be linked to the bid; refunds go to the wallet. Cloak's keeper pushes unclaimed bids to wallets publicly about an hour after bidding closes.",
+        inputSchema: { auction: addr, privately: z.boolean().optional().describe("Claim won tokens into the private balance (default true where supported)"), dry_run: dry },
+        annotations: WRITE,
+    }, safe(async ({ auction, privately, dry_run }) => {
         const { account } = needWallet();
         let s = await cloak.getAuction(auction);
         if (s.phase === "commit" || s.phase === "reveal")
             throw new Error(`${s.tokenSymbol} can't settle yet: bids are ${s.phase === "commit" ? "still being placed" : "still opening"} until ${iso(s.phase === "commit" ? s.commitEnd : s.revealEnd)}.`);
         const bids = await cloak.bidsOf(s.address, account.address, await bidsFrom(s.address));
         const open = bids.filter((b) => !b.claimed);
+        // private claims: launches from this deployment's factory, once their private vault is open
+        const canPrivate = async () => privately !== false && !s.failed && (await bidsFrom(s.address)) === settings.launchesFromBlock && (await privateTradingOn(s.token));
         if (isDry(dry_run))
-            return { dryRun: true, wouldSettle: !s.settled, wouldClaim: open.map((b) => b.id) };
+            return { dryRun: true, wouldSettle: !s.settled, wouldClaim: open.map((b) => b.id), privately: s.settled ? await canPrivate() : privately !== false };
         return exclusive(async () => {
             const txs = [];
             if (!s.settled) {
                 txs.push(link(await cloak.settle(s.address)));
                 s = await cloak.getAuction(s.address);
             }
-            if (open.length)
-                txs.push(link(await cloak.claim(s.address, open.map((b) => b.id))));
+            const priv8 = await canPrivate();
+            const won = [];
+            let publicWhy;
+            if (priv8) {
+                const p = await priv();
+                for (const b of open.filter((x) => x.tokens > 0n)) {
+                    // a deposit limit can refuse a large claim; that bid is then claimed to the wallet instead
+                    const ok = await pub
+                        .simulateContract({ address: s.address, abi: cloakAuctionAbi, functionName: "claimPrivate", args: [b.id, 1n, 1n, "0x"], account: account.address })
+                        .then(() => true, (e) => ((publicWhy = explain(e)), false));
+                    if (!ok)
+                        continue;
+                    txs.push(link((await p.claimPrivately(wallet, s.address, b.id)).txHash));
+                    won.push(b);
+                }
+            }
+            const rest = open.filter((b) => !won.includes(b));
+            if (rest.length)
+                txs.push(link(await cloak.claim(s.address, rest.map((b) => b.id))));
             const after = await cloak.bidsOf(s.address, account.address, await bidsFrom(s.address));
             return {
                 launch: s.tokenSymbol,
                 settled: s.settled,
                 ...(s.failed ? { failed: "No demand was revealed, so every bid was refunded in full." } : { clearingPrice: `${formatEther(s.clearingPrice)} HYPE per token` }),
                 claimed: open.length ? open.map((b) => b.id) : "nothing left to claim (already paid out)",
+                ...(won.length ? { claimedPrivately: won.map((b) => b.id), privateBalance: "won tokens are in the private balance (private_balance)" } : {}),
+                ...(publicWhy ? { claimedToWallet: `some won tokens went to the wallet instead of the private balance: ${publicWhy}` } : {}),
                 tokensWon: formatEther(after.reduce((a, b) => a + b.tokens, 0n)),
                 refunds: hype(after.reduce((a, b) => a + b.refund, 0n)),
                 txs,
@@ -515,17 +551,14 @@ export function createCloakServer(settings, opts = {}) {
             throw new Error(`${s.tokenSymbol} needs to settle successfully first (phase: ${s.phase}).`);
         if (await privateTradingOn(s.token))
             return { alreadyOn: true, token: s.token };
-        const all = await cloak.listLaunches();
-        const idx = all.findIndex((l) => l.auction.toLowerCase() === s.address.toLowerCase());
-        if (idx < 0)
+        const l = (await cloak.listLaunches()).find((x) => x.auction.toLowerCase() === s.address.toLowerCase());
+        if (!l)
             throw new Error("This launch isn't from a Cloak factory, so it can't get a private vault.");
-        // earlier deployments' launches go through the router's list of earlier factories, in the order they're listed
-        const legacy = !!all[idx].legacy;
-        const index = BigInt(legacy ? idx - all.filter((l) => !l.legacy).length : idx);
+        const vaults = d.vaults ?? (await pub.readContract({ address: d.router, abi: privateRouterAbi, functionName: "vaults" }));
         if (isDry(dry_run))
-            return { dryRun: true, wouldEnable: s.tokenSymbol, launchIndex: index, earlierDeployment: legacy };
+            return { dryRun: true, wouldEnable: s.tokenSymbol, factory: l.factory, launchIndex: l.index };
         return exclusive(async () => {
-            const h = await wallet.writeContract({ address: d.router, abi: privateRouterAbi, functionName: legacy ? "createLegacyPool" : "createPool", args: [index] });
+            const h = await wallet.writeContract({ address: vaults, abi: cloakVaultsAbi, functionName: "createPool", args: [l.factory, l.index] });
             await receipt(h);
             return { enabled: true, token: s.token, vault: await pub.readContract({ address: d.router, abi: privateRouterAbi, functionName: "poolOf", args: [s.token] }), tx: link(h) };
         });

package/dist/setup.d.ts

@@ -0,0 +1 @@
+export declare function setup(): Promise<void>;

package/dist/setup.js

@@ -0,0 +1,41 @@
+// `npx -y @cloakely/mcp setup`: make the agent's own wallet (once) and say what's left to do, in words an agent can pass
+// on to a person. Written for agents following https://cloak.boblabs.tech/agent.md. The key is never printed.
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { createPublicClient, formatEther, http } from "viem";
+import { generatePrivateKey, privateKeyToAccount } from "viem/accounts";
+import { elysiumTestnet } from "@cloakely/sdk";
+import { defaultKeyFile } from "./config.js";
+const FAUCET = "https://elysium.kinetiq.xyz/testnet-faucet";
+export async function setup() {
+    const file = process.env.CLOAK_KEY_FILE || defaultKeyFile();
+    let made = false;
+    if (!existsSync(file)) {
+        // owner-only from the start; `wx` refuses to overwrite a file that appeared in between
+        writeFileSync(file, `${generatePrivateKey()}\n`, { mode: 0o600, flag: "wx" });
+        made = true;
+    }
+    let key = readFileSync(file, "utf8").trim();
+    if (!key.startsWith("0x"))
+        key = `0x${key}`;
+    if (!/^0x[0-9a-fA-F]{64}$/.test(key))
+        throw new Error(`${file} doesn't hold a private key. Move it aside and run setup again.`);
+    const address = privateKeyToAccount(key).address;
+    const pub = createPublicClient({ chain: elysiumTestnet, transport: http(undefined, { timeout: 15_000 }) });
+    const balance = await pub.getBalance({ address }).catch(() => undefined);
+    const funded = balance !== undefined && balance > 0n;
+    const out = {
+        status: made ? "Made a new wallet for the agent." : "The agent's wallet already exists. Kept it.",
+        agentWallet: address,
+        keyFile: `${file} (readable by this user only, never printed and never sent anywhere)`,
+        network: "Elysium testnet (play money only)",
+        balance: balance === undefined ? "couldn't read it right now" : `${formatEther(balance)} HYPE`,
+        next: [
+            "Add the Cloak MCP server to this app if it isn't there yet. Claude Code: claude mcp add cloak -- npx -y @cloakely/mcp. Any other app: an MCP server with command npx and args -y @cloakely/mcp. It uses this wallet without any settings.",
+            funded
+                ? "The wallet has HYPE, so it's ready."
+                : `Ask the person to get free testnet HYPE for ${address} at ${FAUCET}. Copy the address for them exactly. Agents can't use the faucet themselves.`,
+            "Tell the person to restart the app or start a new chat so the Cloak tools load, then call cloak_info to check.",
+        ],
+    };
+    console.log(JSON.stringify(out, null, 2));
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cloakely/mcp",
   "mcpName": "io.github.NECOKIZZ/cloak",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "Cloak's MCP server: let an AI agent launch tokens with sealed bids and trade them privately on Elysium, with spending limits, testnet by default and a local signer.",
   "keywords": [
     "mcp",
@@ -47,7 +47,7 @@
     "@modelcontextprotocol/sdk": "1.32.1",
     "viem": "2.21.54",
     "zod": "4.6.7",
-    "@cloakely/sdk": "^0.3.0"
+    "@cloakely/sdk": "^0.4.0"
   },
   "devDependencies": {
     "@types/node": "22.10.2",