@coinpaprika/mcp 1.1.0 → 1.2.0

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to the CoinPaprika MCP Server will be documented in this file.
 
+## [1.1.1] - 2026-05-05
+
+### Fixed
+- **Authorization header format** — now sends `Authorization: <key>` (bare) instead of `Authorization: Bearer <key>`. The `Bearer` prefix was rejected by the api-pro Cloudflare WAF with HTTP 403, which silently broke every authenticated request from this MCP server.
+- **Base URL routing** — when `COINPAPRIKA_API_KEY` is set, requests now route through `https://api-pro.coinpaprika.com/v1` instead of the free base. Six paid-tier tools (`getCoinOHLCVHistorical`, `getTickersHistoricalById`, `getHistoricalTickerByContract`, `getMappings`, `getChangelogIDs`, `keyInfo`) were unreachable in 1.1.0 because the free base rejected them with HTTP 402.
+
+Combined, these two bugs meant that `@coinpaprika/mcp@1.1.0` could not authenticate against the paid API at all. Upgrading to `1.1.1` is required for any user with a `COINPAPRIKA_API_KEY` set.
+
 ## [1.1.0] - 2026-04-02
 
 ### Added

package/dist/index.js

@@ -3,15 +3,20 @@ import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
 import fetch from 'node-fetch';
 import { z } from 'zod';
 
-// Base URL for CoinPaprika API
-const API_BASE_URL = 'https://api.coinpaprika.com/v1';
-
 // Server version
 const SERVER_VERSION = '1.0.0';
 
 // Optional API key from environment
 const API_KEY = process.env.COINPAPRIKA_API_KEY || '';
 
+// Base URL for CoinPaprika API.
+// Free tier uses api.coinpaprika.com; paid plans use api-pro.coinpaprika.com.
+// Same key, different host. Hitting the free host with a paid key still
+// returns data but applies free-tier limits and omits paid-tier fields.
+const API_FREE_URL = 'https://api.coinpaprika.com/v1';
+const API_PRO_URL = 'https://api-pro.coinpaprika.com/v1';
+const API_BASE_URL = API_KEY ? API_PRO_URL : API_FREE_URL;
+
 // Error code constants
 const ErrorCodes = {
   CP400_INVALID_COIN_ID: "CP400_INVALID_COIN_ID",
@@ -27,6 +32,21 @@ const ErrorCodes = {
 // Coin ID validation regex
 const COIN_ID_REGEX = /^[a-z0-9]+-[a-z0-9-]+$/;
 
+// Canonical-slug guidance shared by every tool that takes a coin id. Agents
+// kept passing ticker symbols ("BTC") or guessing slugs, then retry-looping on
+// "resource not found" (devrel#5). The slug is NOT derivable from the symbol,
+// so steer them to search / resolveId first.
+const COIN_ID_DESCRIPTION =
+  "Canonical CoinPaprika coin slug in 'symbol-name' format, e.g. 'btc-bitcoin', " +
+  "'eth-ethereum', 'ada-cardano'. Do NOT pass ticker symbols ('BTC', 'AAVE') " +
+  "or guess the slug — it is not derivable from the symbol (e.g. AAVE resolves " +
+  "to 'aave-new', which you could not guess). Call search or resolveId first to " +
+  "resolve a symbol or name to its canonical id.";
+
+// Known misspellings, surfaced in getCapabilities so MCP catalogs / tool
+// routers / agent frameworks can match fuzzy references back to us (devrel#6).
+const SERVER_ALIASES = ["coinparika", "coinpapika", "coinaprika", "coin-paprika", "coin paprika"];
+
 // Structured error response builder
 function buildErrorResponse(code, message, retryable, suggestion, correctedExample, metadata) {
   const error = {
@@ -92,7 +112,7 @@ function parseAPIError(status, statusText, endpoint) {
       ErrorCodes.CP404_NOT_FOUND,
       'Resource not found',
       false,
-      'The requested resource does not exist. Check the ID format and try again',
+      'No resource with that id exists — it may be misspelled, retired, or for a different entity. Call search or resolveId to get the current canonical id, then retry.',
       undefined,
       { endpoint }
     );
@@ -157,7 +177,9 @@ const RATE_LIMIT = 10000;
 function buildHeaders() {
   const headers = { 'content-type': 'application/json' };
   if (API_KEY) {
-    headers['Authorization'] = `Bearer ${API_KEY}`;
+    // CoinPaprika expects the bare API key. The "Bearer" prefix triggers a
+    // Cloudflare WAF block on api-pro and returns HTTP 403.
+    headers['Authorization'] = API_KEY;
   }
   return headers;
 }
@@ -253,6 +275,7 @@ async function withGuidance(exec, hint) {
 function buildCapabilitiesDocument() {
   return {
     service: "coinpaprika",
+    aliases: SERVER_ALIASES,
     version: SERVER_VERSION,
     description: "Cryptocurrency market data for 8000+ coins",
     server: {
@@ -714,6 +737,34 @@ const server = new McpServer({
   description: 'MCP server for accessing CoinPaprika cryptocurrency market data',
 });
 
+// devrel#5 parity: validate coin/currency id format BEFORE the handler runs,
+// returning the structured CP400_INVALID_COIN_ID guidance (matches the hosted
+// MCP). Wrapping server.tool centralizes this for every id-bearing tool
+// (coinId / baseCurrencyId / quoteCurrencyId) instead of repeating it in each
+// handler — so a ticker symbol like "BTC" gets actionable guidance to call
+// search/resolveId instead of a bare upstream 404.
+const _registerTool = server.tool.bind(server);
+server.tool = (...regArgs) => {
+  const handler = regArgs[regArgs.length - 1];
+  const schema = regArgs.length >= 4 && regArgs[2] && typeof regArgs[2] === 'object' ? regArgs[2] : null;
+  if (typeof handler === 'function' && schema) {
+    const idFields = ['coinId', 'baseCurrencyId', 'quoteCurrencyId'].filter((f) => f in schema);
+    if (idFields.length > 0) {
+      regArgs[regArgs.length - 1] = async (args, ...rest) => {
+        for (const f of idFields) {
+          const v = args && args[f];
+          if (typeof v === 'string') {
+            const err = validateCoinId(v);
+            if (err) return formatMcpError(err);
+          }
+        }
+        return handler(args, ...rest);
+      };
+    }
+  }
+  return _registerTool(...regArgs);
+};
+
 // ─── Tool 1: status ───
 server.tool(
   'status',
@@ -794,7 +845,7 @@ server.tool(
   'getCoinOHLCVLatest',
   'OHLCV last full day',
   {
-    coinId: z.string().describe("Coin ID in format: symbol-name (e.g., btc-bitcoin)"),
+    coinId: z.string().describe(COIN_ID_DESCRIPTION),
     quote: z.string().optional().default('usd').describe("Quote currency (default: usd)")
   },
   async ({ coinId, quote = 'usd' }) => {
@@ -812,7 +863,7 @@ server.tool(
   'getCoinOHLCVToday',
   'OHLCV today',
   {
-    coinId: z.string().describe("Coin ID in format: symbol-name (e.g., btc-bitcoin)"),
+    coinId: z.string().describe(COIN_ID_DESCRIPTION),
     quote: z.string().optional().default('usd').describe("Quote currency (default: usd)")
   },
   async ({ coinId, quote = 'usd' }) => {
@@ -830,7 +881,7 @@ server.tool(
   'getCoinOHLCVHistorical',
   'OHLCV historical (plan-dependent)',
   {
-    coinId: z.string().describe("Coin ID in format: symbol-name (e.g., btc-bitcoin)"),
+    coinId: z.string().describe(COIN_ID_DESCRIPTION),
     start: z.string().describe("Start date (ISO 8601 or yyyy-mm-dd)"),
     end: z.string().optional().describe("End date (ISO 8601 or yyyy-mm-dd)"),
     limit: z.number().optional().default(50).describe("Number of data points (default: 50, max: 250)"),
@@ -851,7 +902,7 @@ server.tool(
 server.tool(
   'getCoinById',
   'Coin details (descriptive info)',
-  { coinId: z.string().describe("Coin ID in format: symbol-name (e.g., btc-bitcoin)") },
+  { coinId: z.string().describe(COIN_ID_DESCRIPTION) },
   async ({ coinId }) => {
     try {
       const response = await fetchFromAPI(`/coins/${encodeURIComponent(coinId)}`);
@@ -867,7 +918,7 @@ server.tool(
   'getCoinEvents',
   'Events for a coin',
   {
-    coinId: z.string().describe("Coin ID in format: symbol-name (e.g., btc-bitcoin)"),
+    coinId: z.string().describe(COIN_ID_DESCRIPTION),
     limit: z.number().optional().default(50).describe("Number of events to return (default: 50, max: 250)")
   },
   async ({ coinId, limit = 50 }) => {
@@ -888,7 +939,7 @@ server.tool(
   'getCoinExchanges',
   'Exchanges for a coin',
   {
-    coinId: z.string().describe("Coin ID in format: symbol-name (e.g., btc-bitcoin)"),
+    coinId: z.string().describe(COIN_ID_DESCRIPTION),
     limit: z.number().optional().default(50).describe("Number of exchanges to return (default: 50, max: 250)")
   },
   async ({ coinId, limit = 50 }) => {
@@ -909,7 +960,7 @@ server.tool(
   'getCoinMarkets',
   'Markets for a coin',
   {
-    coinId: z.string().describe("Coin ID in format: symbol-name (e.g., btc-bitcoin)"),
+    coinId: z.string().describe(COIN_ID_DESCRIPTION),
     quotes: z.string().optional().describe("Comma-separated quote currencies"),
     limit: z.number().optional().default(50).describe("Number of markets to return (default: 50, max: 250)")
   },
@@ -932,7 +983,7 @@ server.tool(
   'getTickersById',
   'Ticker for a specific coin',
   {
-    coinId: z.string().describe("Coin ID in format: symbol-name (e.g., btc-bitcoin)"),
+    coinId: z.string().describe(COIN_ID_DESCRIPTION),
     quotes: z.string().optional().describe("Comma-separated quote currencies")
   },
   async ({ coinId, quotes }) => {
@@ -951,7 +1002,7 @@ server.tool(
   'getTickersHistoricalById',
   'Historical ticks for a coin (plan dependent)',
   {
-    coinId: z.string().describe("Coin ID in format: symbol-name (e.g., btc-bitcoin)"),
+    coinId: z.string().describe(COIN_ID_DESCRIPTION),
     start: z.string().describe("Start date (ISO 8601 or yyyy-mm-dd)"),
     end: z.string().optional().describe("End date"),
     limit: z.number().optional().default(50).describe("Number of data points (default: 50, max: 250)"),
@@ -1221,8 +1272,8 @@ server.tool(
   'priceConverter',
   'Convert base -> quote',
   {
-    baseCurrencyId: z.string().describe("Base currency ID (e.g., btc-bitcoin)"),
-    quoteCurrencyId: z.string().describe("Quote currency ID (e.g., usd-us-dollars)"),
+    baseCurrencyId: z.string().describe("Required. Source CoinPaprika coin slug (e.g., 'btc-bitcoin'). Full slugs only; ticker symbols like 'BTC' are rejected upstream. Call search or resolveId first."),
+    quoteCurrencyId: z.string().describe("Required. Target CoinPaprika coin slug (e.g., 'usd-us-dollars', 'eth-ethereum'). Full slugs only; ticker symbols like 'USD' are rejected upstream."),
     amount: z.number().optional().default(0).describe("Amount to convert (default: 0)")
   },
   async ({ baseCurrencyId, quoteCurrencyId, amount = 0 }) => {
@@ -1273,7 +1324,10 @@ server.tool(
   },
   async (params) => {
     const qs = new URLSearchParams();
-    for (const [k, v] of Object.entries(params)) {
+    // Allowlist the upstream-recognized mapping params only — never forward
+    // MCP-only or unexpected fields, which the upstream rejects with a 400.
+    for (const k of ['coinpaprika', 'coinmarketcap', 'coingecko', 'cryptocompare', 'isin', 'dti']) {
+      const v = params[k];
       if (v) qs.set(k, String(v));
     }
     return withGuidance(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coinpaprika/mcp",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "A Model Context Protocol server for CoinPaprika cryptocurrency market data — prices, tickers, exchanges, and more",
   "main": "dist/index.js",
   "type": "module",