@coinrithm/mcp-trading 0.7.14 → 0.7.15

package/dist/client.js

@@ -71,6 +71,9 @@ const applyAgentTraceHeaders = (headers, trace) => {
 const traceFromBody = (body) => body && typeof body === "object" && "agentTrace" in body
     ? body.agentTrace
     : undefined;
+// Where a user mints an API key (Settings -> API Keys). Named in every
+// missing-key error so an assistant can tell its user where to go.
+export const API_KEY_MINT_URL = "https://www.coinrithm.com/en/settings/api-keys";
 export class CoinRithmClient {
     // Default key for the stdio (single-user) path. Undefined in the multi-user
     // HTTP path, where every call must pass a per-request `apiKey` override.
@@ -88,8 +91,10 @@ export class CoinRithmClient {
                 status: 401,
                 data: {
                     error: "missing_api_key",
-                    message: "No API key for this request. On the hosted MCP, send " +
-                        "`Authorization: Bearer crk_live_…` with your own key.",
+                    message: "No API key for this request. Mint a free key at " +
+                        `${API_KEY_MINT_URL}, then on the hosted MCP send ` +
+                        "`Authorization: Bearer crk_live_…`. Public data tools " +
+                        "(pm_data_*, get_arena_*, get_crypto_movers) need no key.",
                 },
             };
         }
@@ -337,6 +342,13 @@ export class CoinRithmClient {
     getCandles(coinId, query, apiKey, agentTrace) {
         return this.request("GET", `/api/agent/market/${encodeURIComponent(coinId)}/candles`, { query, apiKey, agentTrace });
     }
+    getNews(query, apiKey, agentTrace) {
+        return this.request("GET", "/api/agent/news", {
+            query,
+            apiKey,
+            agentTrace,
+        });
+    }
     discoverPmMarkets(query, apiKey, agentTrace) {
         return this.request("GET", "/api/agent/pm/discover", {
             query,
@@ -364,15 +376,15 @@ export class CoinRithmClient {
             agentTrace,
         });
     }
-    // Agent Arena (public leaderboard). The key is sent but ignored by these
-    // endpoints — they expose only public agent names + realized performance.
-    getArenaLeaderboard(query, apiKey) {
-        return this.request("GET", "/api/arena", { query, apiKey });
+    // Agent Arena (public leaderboard): public agent names + realized
+    // performance only, served keyless by the API. These used to go through
+    // the keyed path, so a keyless MCP client got a 401 for public data
+    // (21 of 44 keyless tool calls failed in 14.6h, audit 2026-09-29).
+    getArenaLeaderboard(query) {
+        return this.publicRequest("/api/arena", query);
     }
-    getArenaAgent(handle, apiKey) {
-        return this.request("GET", `/api/arena/${encodeURIComponent(handle)}`, {
-            apiKey,
-        });
+    getArenaAgent(handle) {
+        return this.publicRequest(`/api/arena/${encodeURIComponent(handle)}`);
     }
     listOpenOrders(query, apiKey, agentTrace) {
         return this.request("GET", "/api/agent/orders/open", {

package/dist/http.d.ts

@@ -2,6 +2,7 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { CoinRithmClient } from "./client.js";
 import { type CompletionLogger } from "./httpCompletion.js";
+export declare const MALFORMED_MCP_LINK: RegExp;
 export declare function createHttpApp(client: CoinRithmClient, options?: {
     completionLogger?: CompletionLogger;
     createServer?: () => McpServer;

package/dist/http.js

@@ -34,6 +34,7 @@
 // Transport is stateless: a fresh McpServer + transport per request, which is
 // the correct isolation model for a multi-user, per-request-keyed surface — no
 // session state is shared between users.
+import { SERVER_INSTRUCTIONS } from "./instructions.js";
 import express from "express";
 import { pathToFileURL } from "node:url";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -42,6 +43,9 @@ import { CoinRithmClient, bearerFromHeader, loadHttpConfig, log, } from "./clien
 import { registerTools } from "./tools.js";
 import { SERVER_VERSION } from "./version.js";
 import { observeHttpCompletion, } from "./httpCompletion.js";
+// "/mcp" immediately followed by the markdown "](" of a pasted link, literal or
+// percent-encoded. Anything else under /mcp is not this family.
+export const MALFORMED_MCP_LINK = /^\/mcp(?:\]|%5d)(?:\(|%28)/i;
 // Factory permits isolated localhost SDK tests without opening a listener on import.
 export function createHttpApp(client, options = {}) {
     const app = express();
@@ -108,13 +112,24 @@ export function createHttpApp(client, options = {}) {
     app.get("/robots.txt", (_req, res) => {
         res.type("text/plain").send("User-agent: *\nDisallow: /\n");
     });
+    // Recover one observed malformed URL family. A markdown link to this
+    // endpoint circulates with its "](https://…)" suffix pasted into the path,
+    // e.g. GET /mcp](https:/mcp.coinrithm.com/mcp): 408 such requests on
+    // 2026-09-25, all Claude-User web fetches that received Express's default
+    // 404. GET/HEAD go to the service descriptor. POST is served as MCP below:
+    // on 2026-09-26, 127 Claude-User connector POSTs in 6 h hit the same path
+    // and got 404, so a user who pasted that URL into a connector could never
+    // initialize. Every other unknown path behaves as before.
+    app.get(MALFORMED_MCP_LINK, (_req, res) => {
+        res.redirect(302, "/");
+    });
     app.get("/mcp", (_req, res) => {
         res.status(405).json({
             error: "method_not_allowed",
             message: "This is a POST-only streamable-HTTP MCP endpoint. Connect with an MCP client, or GET / for service info.",
         });
     });
-    app.post("/mcp", async (req, res) => {
+    app.post(["/mcp", MALFORMED_MCP_LINK], async (req, res) => {
         // Per-request auth: read THIS caller's key from the Authorization header,
         // or from Smithery's non-reserved forwarding header.
         // It is optional at the transport layer so registries can initialize the
@@ -132,7 +147,7 @@ export function createHttpApp(client, options = {}) {
             new McpServer({
                 name: "coinrithm-trading",
                 version: SERVER_VERSION,
-            });
+            }, { instructions: SERVER_INSTRUCTIONS });
         if (!options.createServer)
             registerTools(server, client);
         const transport = new StreamableHTTPServerTransport({

package/dist/httpCompletion.d.ts

@@ -1,6 +1,6 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
-export declare const COMPLETION_TOOL_NAMES: readonly ["whoami", "get_portfolio", "get_wallet", "list_open_orders", "get_positions", "resolve_symbol", "get_equity_curve", "get_my_trades", "get_market_context", "get_candles", "discover_pm_markets", "get_performance", "get_agent_ledger", "export_agent_ledger", "export_run_evidence", "get_arena_leaderboard", "get_arena_agent", "futures_quote", "pm_quote", "spot_quote", "place_spot_order", "cancel_spot_order", "open_futures_position", "set_futures_sl_tp", "close_futures_position", "open_pm_position", "report_pm_opportunity", "pm_data_overview", "pm_data_sources", "pm_data_sources_health", "pm_data_events", "pm_data_event", "pm_data_whales", "pm_data_whale_wallets", "pm_data_whale_wallet", "pm_data_disagreements", "pm_data_calibration", "pm_data_canonical", "pm_data_volume_history", "get_crypto_movers"];
+export declare const COMPLETION_TOOL_NAMES: readonly ["whoami", "get_portfolio", "get_wallet", "list_open_orders", "get_positions", "resolve_symbol", "get_equity_curve", "get_my_trades", "get_market_context", "get_candles", "get_news", "discover_pm_markets", "get_performance", "get_agent_ledger", "export_agent_ledger", "export_run_evidence", "get_arena_leaderboard", "get_arena_agent", "futures_quote", "pm_quote", "spot_quote", "place_spot_order", "cancel_spot_order", "open_futures_position", "set_futures_sl_tp", "close_futures_position", "open_pm_position", "report_pm_opportunity", "pm_data_overview", "pm_data_sources", "pm_data_sources_health", "pm_data_events", "pm_data_event", "pm_data_whales", "pm_data_whale_wallets", "pm_data_whale_wallet", "pm_data_disagreements", "pm_data_calibration", "pm_data_canonical", "pm_data_volume_history", "get_crypto_movers"];
 type Operation = "initialize" | "tools_list" | "tools_call" | "notification" | "other" | "invalid";
 type Outcome = "result" | "tool_error" | "protocol_error" | "no_response" | "not_applicable";
 type ToolName = (typeof COMPLETION_TOOL_NAMES)[number] | "unknown" | null;

package/dist/httpCompletion.js

@@ -13,6 +13,7 @@ export const COMPLETION_TOOL_NAMES = [
     "get_my_trades",
     "get_market_context",
     "get_candles",
+    "get_news",
     "discover_pm_markets",
     "get_performance",
     "get_agent_ledger",

package/dist/index.js

@@ -10,6 +10,7 @@
 //   COINRITHM_API_URL  (optional)  base URL; defaults to https://api.coinrithm.com
 //
 // stdout is the JSON-RPC channel — we log ONLY to stderr.
+import { SERVER_INSTRUCTIONS } from "./instructions.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CoinRithmClient, loadConfig, log } from "./client.js";
@@ -21,7 +22,7 @@ async function main() {
     const server = new McpServer({
         name: "coinrithm-trading",
         version: SERVER_VERSION,
-    });
+    }, { instructions: SERVER_INSTRUCTIONS });
     registerTools(server, client);
     const transport = new StdioServerTransport();
     await server.connect(transport);

package/dist/instructions.d.ts

@@ -0,0 +1 @@
+export declare const SERVER_INSTRUCTIONS: string;

package/dist/instructions.js

@@ -0,0 +1,16 @@
+import { API_KEY_MINT_URL } from "./client.js";
+import { PAPER_NOTE } from "./tools.js";
+// Sent once in the MCP `initialize` result. Guidance that used to be repeated
+// on every tool description lives here, so the tool list stays small enough to
+// fit an assistant's context (tools/list was 114,668 bytes with the ~512-char
+// paper disclaimer on 25 tools, audit 2026-09-29).
+export const SERVER_INSTRUCTIONS = [
+    "CoinRithm MCP: crypto and prediction-market data from 12 venues, plus paper trading.",
+    "Start keyless: the pm_data_* tools, get_arena_leaderboard, get_arena_agent and get_crypto_movers need no API key.",
+    "pm_data_events returns open markets by default; pass status=closed or status=all for history.",
+    `Tools that read or act on an account need a key. The user mints one at ${API_KEY_MINT_URL}; start with a read-only key.`,
+    "Every tool returns { httpStatus, ok, ledgerEventId, ledgerStatus, body }: httpStatus is CoinRithm's HTTP status (0 = network error), ok means 2xx, body is the parsed response.",
+    "Always quote before a paper write (spot_quote, futures_quote or pm_quote), then open with that quote.",
+    "Prediction-market probabilities are venue prices, not CoinRithm forecasts. referenceProbability is a cross-venue consensus with a disagreement band (spreadPoints).",
+    PAPER_NOTE,
+].join("\n");

package/dist/tools.d.ts

@@ -1,6 +1,7 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { CoinRithmClient } from "./client.js";
 export declare const PAPER_NOTE: string;
+export declare const PAPER_NOTE_SHORT: string;
 /**
  * Keep keyless discovery calls small enough for an agent context window.
  * Full event evidence remains available from pm_data_event.