@coinpaprika/mcp 1.0.0 → 1.1.1

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 All notable changes to the CoinPaprika MCP Server will be documented in this file.
 
+## [1.1.1] - 2026-05-05
+
+### Fixed
+- **Authorization header format** — now sends `Authorization: <key>` (bare) instead of `Authorization: Bearer <key>`. The `Bearer` prefix was rejected by the api-pro Cloudflare WAF with HTTP 403, which silently broke every authenticated request from this MCP server.
+- **Base URL routing** — when `COINPAPRIKA_API_KEY` is set, requests now route through `https://api-pro.coinpaprika.com/v1` instead of the free base. Six paid-tier tools (`getCoinOHLCVHistorical`, `getTickersHistoricalById`, `getHistoricalTickerByContract`, `getMappings`, `getChangelogIDs`, `keyInfo`) were unreachable in 1.1.0 because the free base rejected them with HTTP 402.
+
+Combined, these two bugs meant that `@coinpaprika/mcp@1.1.0` could not authenticate against the paid API at all. Upgrading to `1.1.1` is required for any user with a `COINPAPRIKA_API_KEY` set.
+
+## [1.1.0] - 2026-04-02
+
+### Added
+- Dockerfile for containerized deployment
+- Smoke test suite (`npm test`) verifying server initialization, tool listing, and live API calls
+- Test script for CI/CD integration
+
+### Changed
+- Bumped version to 1.1.0
+- Updated HOSTED-MCP-SPEC.md to reflect hosted/self-hosted tool parity
+
+### Fixed
+- Hosted MCP server at mcp.coinpaprika.com now exposes `getCapabilities` tool (was missing, only available in self-hosted). Both versions now have 30 identical tools.
+
 ## [1.0.0] - 2026-03-19
 
 ### Added

package/dist/index.js

@@ -3,15 +3,20 @@ import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
 import fetch from 'node-fetch';
 import { z } from 'zod';
 
-// Base URL for CoinPaprika API
-const API_BASE_URL = 'https://api.coinpaprika.com/v1';
-
 // Server version
 const SERVER_VERSION = '1.0.0';
 
 // Optional API key from environment
 const API_KEY = process.env.COINPAPRIKA_API_KEY || '';
 
+// Base URL for CoinPaprika API.
+// Free tier uses api.coinpaprika.com; paid plans use api-pro.coinpaprika.com.
+// Same key, different host. Hitting the free host with a paid key still
+// returns data but applies free-tier limits and omits paid-tier fields.
+const API_FREE_URL = 'https://api.coinpaprika.com/v1';
+const API_PRO_URL = 'https://api-pro.coinpaprika.com/v1';
+const API_BASE_URL = API_KEY ? API_PRO_URL : API_FREE_URL;
+
 // Error code constants
 const ErrorCodes = {
   CP400_INVALID_COIN_ID: "CP400_INVALID_COIN_ID",
@@ -157,7 +162,9 @@ const RATE_LIMIT = 10000;
 function buildHeaders() {
   const headers = { 'content-type': 'application/json' };
   if (API_KEY) {
-    headers['Authorization'] = `Bearer ${API_KEY}`;
+    // CoinPaprika expects the bare API key. The "Bearer" prefix triggers a
+    // Cloudflare WAF block on api-pro and returns HTTP 403.
+    headers['Authorization'] = API_KEY;
   }
   return headers;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coinpaprika/mcp",
-  "version": "1.0.0",
+  "version": "1.1.1",
   "description": "A Model Context Protocol server for CoinPaprika cryptocurrency market data — prices, tickers, exchanges, and more",
   "main": "dist/index.js",
   "type": "module",
@@ -16,7 +16,8 @@
   "scripts": {
     "build": "mkdir -p dist && cp -r src/* dist/ && chmod +x dist/bin.js",
     "prepublishOnly": "npm run build",
-    "start": "node src/index.js"
+    "start": "node src/index.js",
+    "test": "node test/smoke.js"
   },
   "keywords": [
     "mcp",