@coinrithm/mcp-trading 0.7.18 → 0.7.20

package/dist/agent/templates.js

@@ -50,37 +50,37 @@ const PRESETS = {
         modelFail: 5,
     },
 };
-const THESIS_BODY = `# Momentum Futures — strategy
-
-You operate a CoinRithm **paper-trading** futures account (50,000 virtual mUSD).
-Everything here is simulated; it is not financial advice and never touches real
-money. Edit this prose freely (any language) — it is your agent's borders.
-
-## Each cycle
-
-1. Ground yourself: read your portfolio and open positions first. Never assume
-   balances or what is already open.
-2. Scan the watchlist. A candidate is a coin whose short and medium momentum
-   agree (both up, or both down) and is not already an open position.
-3. Pick the strongest candidate and commit when the read is clear — even a
-   moderate-confidence one — sized small with a stop. Skip only when the signals
-   contradict or the data is stale; a quiet tape where your edge is still real
-   is an act, not a skip.
-4. Quote before you open. Read the liquidation price and confirm it is sane. If
-   the quote is not eligible, relay the reason and stop.
-5. Open small and protected: enter in the trend direction and set a stop-loss at
-   open. Place the take-profit a touch wider than the stop.
-6. Stay in sync: poll your trades for any stop / take-profit / liquidation that
-   fired while you were not looking, and react to what actually happened.
-
-The hard caps (leverage, margin, watchlist) live in the config blocks above and
+const THESIS_BODY = `# Momentum Futures — strategy
+
+You operate a CoinRithm **paper-trading** futures account (50,000 virtual mUSD).
+Everything here is simulated; it is not financial advice and never touches real
+money. Edit this prose freely (any language) — it is your agent's borders.
+
+## Each cycle
+
+1. Ground yourself: read your portfolio and open positions first. Never assume
+   balances or what is already open.
+2. Scan the watchlist. A candidate is a coin whose short and medium momentum
+   agree (both up, or both down) and is not already an open position.
+3. Pick the strongest candidate and commit when the read is clear — even a
+   moderate-confidence one — sized small with a stop. Skip only when the signals
+   contradict or the data is stale; a quiet tape where your edge is still real
+   is an act, not a skip.
+4. Quote before you open. Read the liquidation price and confirm it is sane. If
+   the quote is not eligible, relay the reason and stop.
+5. Open small and protected: enter in the trend direction and set a stop-loss at
+   open. Place the take-profit a touch wider than the stop.
+6. Stay in sync: poll your trades for any stop / take-profit / liquidation that
+   fired while you were not looking, and react to what actually happened.
+
+The hard caps (leverage, margin, watchlist) live in the config blocks above and
 are enforced by the runner — change them there, not in this prose.`;
-const PERSONA_STUB = `# Persona
-
-Decisive and in character. Acts on a clear read — even a moderate-confidence one
-— sized small and protected with a stop, and skips only when the read is
-contradictory or the data is stale. States its reasoning plainly in its own
-voice, and never frames paper results as real-money advice.
+const PERSONA_STUB = `# Persona
+
+Decisive and in character. Acts on a clear read — even a moderate-confidence one
+— sized small and protected with a stop, and skips only when the read is
+contradictory or the data is stale. States its reasoning plainly in its own
+voice, and never frames paper results as real-money advice.
 `;
 export function buildAgentObject(name, preset) {
     const p = PRESETS[preset];

package/dist/agent/version.d.ts

@@ -5,7 +5,7 @@ export declare const COINRITHM_API: {
     readonly kind: "coinrithm-agent-api";
     readonly baseUrl: "https://api.coinrithm.com";
     readonly mcpUrl: "https://mcp.coinrithm.com/mcp";
-    readonly openapiVersion: "1.9.0";
+    readonly openapiVersion: "1.11.0";
     readonly mcpPackage: "@coinrithm/mcp-trading";
     readonly mcpVersion: string;
 };

package/dist/agent/version.js

@@ -20,7 +20,7 @@ export const COINRITHM_API = {
     mcpUrl: "https://mcp.coinrithm.com/mcp",
     // The API CONTRACT version (openapi.yaml info.version). Versioned independently
     // from the npm package below — hand-bump this when the OpenAPI contract changes.
-    openapiVersion: "1.9.0",
+    openapiVersion: "1.11.0",
     mcpPackage: "@coinrithm/mcp-trading",
     mcpVersion: PACKAGE_VERSION,
 };

package/dist/client.d.ts

@@ -41,6 +41,7 @@ export type ProvenanceReport = {
     };
 };
 export declare const API_KEY_MINT_URL = "https://www.coinrithm.com/en/settings/api-keys";
+export declare const UPSTREAM_TIMEOUT_MS = 35000;
 export declare class CoinRithmClient {
     private readonly defaultApiKey?;
     private readonly baseUrl;
@@ -89,7 +90,52 @@ export declare class CoinRithmClient {
     }): Promise<ApiResult>;
     getPublicPmCanonicalDetail(key: string): Promise<ApiResult>;
     getPublicPmVolumeHistory(): Promise<ApiResult>;
+    getPublicPmPriceHistory(source: string, slug: string, query?: {
+        interval?: string;
+    }): Promise<ApiResult>;
+    getPublicPmOrderBook(source: string, slug: string, query?: {
+        outcomeExternalMarketId?: string;
+    }): Promise<ApiResult>;
+    listPublicPmResolved(query?: {
+        limit?: number;
+        offset?: number;
+        fiat?: string;
+        source?: string;
+        minVolume?: number;
+        year?: number;
+        month?: number;
+    }): Promise<ApiResult>;
+    listPublicPmExpiring(query?: {
+        limit?: number;
+        offset?: number;
+        fiat?: string;
+        days?: number;
+        source?: string;
+    }): Promise<ApiResult>;
+    listPublicPmSurprises(query?: {
+        limit?: number;
+        offset?: number;
+        fiat?: string;
+        source?: string;
+        window?: string;
+    }): Promise<ApiResult>;
+    getPublicInstrumentMarkets(type: string, id: string, query?: {
+        horizon?: string;
+        includeShortTerm?: boolean;
+        limit?: number;
+    }): Promise<ApiResult>;
+    getPublicTradfiReferences(): Promise<ApiResult>;
+    getPublicTradfiReference(ticker: string, query?: {
+        window?: string;
+    }): Promise<ApiResult>;
     getPublicCryptoMovers(direction: "gainers" | "losers", limit?: number): Promise<ApiResult>;
+    getPublicCoin(slug: string, query?: {
+        fiat?: string;
+    }): Promise<ApiResult>;
+    getPublicCoinCandles(slug: string, query?: {
+        range?: string;
+        fiat?: string;
+    }): Promise<ApiResult>;
     whoami(apiKey?: string, agentTrace?: AgentTrace): Promise<ApiResult>;
     getPortfolio(query?: {
         fiat?: string;

package/dist/client.js

@@ -1,3 +1,4 @@
+import { CALLER_IP_HEADER, callerIp } from "./requestContext.js";
 import { PM_PAPER_V2_BASE, } from "./pmPaperV2.js";
 // Thin HTTP client for the CoinRithm agent surface (/api/agent/*).
 //
@@ -27,12 +28,18 @@ export function log(...args) {
 function resolveBaseUrl() {
     return (process.env.COINRITHM_API_URL?.trim() || DEFAULT_BASE_URL).replace(/\/+$/, "");
 }
-// stdio path: a startup key is REQUIRED (single user).
+// stdio path (single user). The key is OPTIONAL since 2026-10-16 (audit):
+// without one the server starts in data-only mode, exactly like the hosted
+// server: keyless tools (pm_data_*, instrument_markets, tradfi_references,
+// crypto_price, get_arena_*, get_crypto_movers) work and
+// every keyed tool returns the structured missing_api_key result. Requiring a
+// key blocked the one-line `npx -y @coinrithm/mcp-trading` data install.
 export function loadConfig() {
     const apiKey = process.env.COINRITHM_API_KEY?.trim();
     if (!apiKey) {
-        throw new Error("COINRITHM_API_KEY is not set. Mint a key in CoinRithm → Settings → API Keys " +
-            "and expose it to this MCP server as the COINRITHM_API_KEY environment variable.");
+        log("no COINRITHM_API_KEY: data-only mode. Keyless data tools work; paper-trading " +
+            "tools need a key from CoinRithm → Settings → API Keys.");
+        return { baseUrl: resolveBaseUrl() };
     }
     if (!apiKey.startsWith("crk_live_")) {
         log("warning: COINRITHM_API_KEY does not start with 'crk_live_' — it will likely be rejected.");
@@ -75,6 +82,28 @@ const traceFromBody = (body) => body && typeof body === "object" && "agentTrace"
 // Where a user mints an API key (Settings -> API Keys). Named in every
 // missing-key error so an assistant can tell its user where to go.
 export const API_KEY_MINT_URL = "https://www.coinrithm.com/en/settings/api-keys";
+// Upstream ceiling for every API call (audit 2026-10-16: none existed, so a
+// hung upstream held the tool call open until undici's ~300 s default).
+// Measured before choosing it: the slowest successful hosted calls in 24 h
+// took 26-29 s (cold heavy reads), so 35 s cuts hangs without failing them.
+export const UPSTREAM_TIMEOUT_MS = 35_000;
+const upstreamFailure = (err) => {
+    const timedOut = err instanceof Error &&
+        (err.name === "TimeoutError" || err.name === "AbortError");
+    return {
+        ok: false,
+        status: 0,
+        data: timedOut
+            ? {
+                error: "upstream_timeout",
+                message: `CoinRithm API did not answer within ${UPSTREAM_TIMEOUT_MS / 1000} s. Retry shortly.`,
+            }
+            : {
+                error: "network_error",
+                message: err instanceof Error ? err.message : String(err),
+            },
+    };
+};
 export class CoinRithmClient {
     // Default key for the stdio (single-user) path. Undefined in the multi-user
     // HTTP path, where every call must pass a per-request `apiKey` override.
@@ -94,8 +123,10 @@ export class CoinRithmClient {
                     error: "missing_api_key",
                     message: "No API key for this request. Mint a free key at " +
                         `${API_KEY_MINT_URL}, then on the hosted MCP send ` +
-                        "`Authorization: Bearer crk_live_…`. Public data tools " +
-                        "(pm_data_*, get_arena_*, get_crypto_movers) need no key.",
+                        "`Authorization: Bearer crk_live_…`, or for the local server " +
+                        "set COINRITHM_API_KEY. Public data tools (pm_data_*, " +
+                        "instrument_markets, tradfi_references, crypto_price, " +
+                        "get_arena_*, get_crypto_movers) need no key.",
                 },
             };
         }
@@ -114,24 +145,21 @@ export class CoinRithmClient {
         applyAgentTraceHeaders(headers, opts.agentTrace ?? traceFromBody(opts.body));
         if (opts.body !== undefined)
             headers["Content-Type"] = "application/json";
+        const ip = callerIp();
+        if (ip)
+            headers[CALLER_IP_HEADER] = ip;
         let res;
         try {
             res = await fetch(url.toString(), {
                 method,
                 headers,
                 body: opts.body !== undefined ? JSON.stringify(opts.body) : undefined,
+                signal: AbortSignal.timeout(UPSTREAM_TIMEOUT_MS),
             });
         }
         catch (err) {
             log(`network error calling ${method} ${path}:`, err);
-            return {
-                ok: false,
-                status: 0,
-                data: {
-                    error: "network_error",
-                    message: err instanceof Error ? err.message : String(err),
-                },
-            };
+            return upstreamFailure(err);
         }
         const text = await res.text();
         let data = text;
@@ -178,21 +206,19 @@ export class CoinRithmClient {
         }
         let res;
         try {
+            const ip = callerIp();
             res = await fetch(url.toString(), {
                 method: "GET",
-                headers: { Accept: "application/json" },
+                headers: {
+                    Accept: "application/json",
+                    ...(ip ? { [CALLER_IP_HEADER]: ip } : {}),
+                },
+                signal: AbortSignal.timeout(UPSTREAM_TIMEOUT_MS),
             });
         }
         catch (err) {
             log(`network error calling GET ${path}:`, err);
-            return {
-                ok: false,
-                status: 0,
-                data: {
-                    error: "network_error",
-                    message: err instanceof Error ? err.message : String(err),
-                },
-            };
+            return upstreamFailure(err);
         }
         const text = await res.text();
         let data = text;
@@ -286,6 +312,38 @@ export class CoinRithmClient {
     getPublicPmVolumeHistory() {
         return this.publicRequest("/api/prediction-markets/volume-history");
     }
+    // Native venue price history for ONE outcome (Polymarket and Kalshi; other
+    // venues answer 200 with points: []). Points are {t: epoch ms, p: 0-1}.
+    getPublicPmPriceHistory(source, slug, query) {
+        return this.publicRequest(`/api/prediction-markets/event/${encodeURIComponent(source)}/${encodeURIComponent(slug)}/price-history`, query);
+    }
+    // Live order book for the same outcome price-history describes, or the
+    // outcome named by outcomeExternalMarketId. Prices are 0-1 fractions.
+    getPublicPmOrderBook(source, slug, query) {
+        return this.publicRequest(`/api/prediction-markets/event/${encodeURIComponent(source)}/${encodeURIComponent(slug)}/orderbook`, query);
+    }
+    listPublicPmResolved(query) {
+        return this.publicRequest("/api/prediction-markets/resolved", query);
+    }
+    listPublicPmExpiring(query) {
+        return this.publicRequest("/api/prediction-markets/expiring", query);
+    }
+    listPublicPmSurprises(query) {
+        return this.publicRequest("/api/prediction-markets/surprises", query);
+    }
+    // ---- public instrument and TradFi reference data (no key required) ----
+    // Prediction-market strike ladders written on one instrument's price. The
+    // API returns 400 for any query parameter other than these three.
+    getPublicInstrumentMarkets(type, id, query) {
+        return this.publicRequest(`/api/instruments/${encodeURIComponent(type)}/${encodeURIComponent(id)}/markets`, query);
+    }
+    // The catalog accepts no query parameters (any one returns 400).
+    getPublicTradfiReferences() {
+        return this.publicRequest("/api/market/references");
+    }
+    getPublicTradfiReference(ticker, query) {
+        return this.publicRequest(`/api/market/references/${encodeURIComponent(ticker)}`, query);
+    }
     // ---- public crypto data (no key required) ----
     // Top 24h movers across the tracked coin universe (user feature request,
     // 2026-08-18: agents previously could only analyze manually-added pairs).
@@ -296,6 +354,16 @@ export class CoinRithmClient {
             ? "/api/coins/top-losers"
             : "/api/coins/top-gainers", { limit });
     }
+    // One coin's profile by slug: price in USD and `fiat`, 24h change, market
+    // cap, volume and the live-price as-of (priceUpdatedAt, priceStale).
+    // Numerics are decimal strings. An unknown slug is 404 {message}.
+    getPublicCoin(slug, query) {
+        return this.publicRequest(`/api/coins/${encodeURIComponent(slug)}`, query);
+    }
+    // OHLC bars by slug; `range` fixes lookback and resolution (1H = 60 x 1m).
+    getPublicCoinCandles(slug, query) {
+        return this.publicRequest(`/api/coins/${encodeURIComponent(slug)}/candles`, query);
+    }
     // Every method takes an optional trailing `apiKey` (the per-request key for
     // the multi-user HTTP path). When omitted, the constructor key (stdio) is used.
     // ---- reads (scope: read) ----

package/dist/http.d.ts

@@ -2,8 +2,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { CoinRithmClient } from "./client.js";
 import { type CompletionLogger } from "./httpCompletion.js";
+import { type McpLimitOptions } from "./httpLimits.js";
+import { type DrainState } from "./httpShutdown.js";
 export declare const MALFORMED_MCP_LINK: RegExp;
 export declare function createHttpApp(client: CoinRithmClient, options?: {
     completionLogger?: CompletionLogger;
     createServer?: () => McpServer;
+    limits?: McpLimitOptions;
+    drain?: DrainState;
 }): import("express-serve-static-core").Express;

package/dist/http.js

@@ -43,12 +43,17 @@ import { CoinRithmClient, bearerFromHeader, loadHttpConfig, log, } from "./clien
 import { registerTools } from "./tools.js";
 import { SERVER_VERSION } from "./version.js";
 import { observeHttpCompletion, } from "./httpCompletion.js";
+import { createMcpAdmission } from "./httpLimits.js";
+import { installGracefulShutdown } from "./httpShutdown.js";
+import { runWithCaller } from "./requestContext.js";
 // "/mcp" immediately followed by the markdown "](" of a pasted link, literal or
 // percent-encoded. Anything else under /mcp is not this family.
 export const MALFORMED_MCP_LINK = /^\/mcp(?:\]|%5d)(?:\(|%28)/i;
 // Factory permits isolated localhost SDK tests without opening a listener on import.
 export function createHttpApp(client, options = {}) {
     const app = express();
+    // Behind Cloudflare and Traefik (audit 2026-10-16: no limit existed).
+    const admission = createMcpAdmission(options.limits);
     const completions = new WeakMap();
     app.use((req, res, next) => {
         if (req.method === "POST" && /^\/mcp\/?$/i.test(req.path)) {
@@ -60,11 +65,16 @@ export function createHttpApp(client, options = {}) {
     // Lightweight, unauthenticated liveness probe (handy for Coolify/uptime checks).
     // Keep `/healthz` as the deployment contract and expose `/health` as a
     // compatibility alias for agents and generic uptime monitors.
+    // While a stop signal drains the process it answers 503, so the proxy and
+    // the image HEALTHCHECK stop sending new work here (httpShutdown.ts).
     app.get(["/health", "/healthz"], (_req, res) => {
-        res.json({
-            ok: true,
+        const draining = options.drain?.draining === true;
+        res.status(draining ? 503 : 200).json({
+            ok: !draining,
             service: "coinrithm-mcp",
             transport: "streamable-http",
+            version: SERVER_VERSION,
+            ...(draining ? { draining: true } : {}),
         });
     });
     // Self-describing landing for humans and validate-before-recommend agents.
@@ -75,7 +85,7 @@ export function createHttpApp(client, options = {}) {
         res.json({
             service: "CoinRithm MCP",
             version: SERVER_VERSION,
-            description: "Model Context Protocol server for CoinRithm: keyless prediction-market data tools across 12 venues (pm_data_*), keyless crypto movers and Agent Arena reads, plus crypto market context and paper-trading tools (spot, futures, prediction markets) with a crk_live_ API key. Opt-in PM paper v2 and spot reference tools are off unless the server enables them. Paper only, never real money.",
+            description: "Model Context Protocol server for CoinRithm: keyless prediction-market data tools across 12 venues (pm_data_*), keyless strike ladders (instrument_markets), TradFi reference prices (tradfi_references), crypto prices (crypto_price), crypto movers and Agent Arena reads, plus crypto market context and paper-trading tools (spot, futures, prediction markets) with a crk_live_ API key. Opt-in PM paper v2 and spot reference tools are off unless the server enables them. Paper only, never real money.",
             endpoint: {
                 url: "https://mcp.coinrithm.com/mcp",
                 method: "POST",
@@ -129,7 +139,7 @@ export function createHttpApp(client, options = {}) {
             message: "This is a POST-only streamable-HTTP MCP endpoint. Connect with an MCP client, or GET / for service info.",
         });
     });
-    app.post(["/mcp", MALFORMED_MCP_LINK], async (req, res) => {
+    app.post(["/mcp", MALFORMED_MCP_LINK], admission, async (req, res) => {
         // Per-request auth: read THIS caller's key from the Authorization header,
         // or from Smithery's non-reserved forwarding header.
         // It is optional at the transport layer so registries can initialize the
@@ -162,7 +172,9 @@ export function createHttpApp(client, options = {}) {
             completions.get(res)?.attach(transport);
             // The transport reads req.headers (→ extra.requestInfo) and req.auth
             // (→ extra.authInfo); tools.ts picks up the caller's key from there.
-            await transport.handleRequest(req, res, req.body);
+            // Upstream calls made while handling it carry the caller's own
+            // address (requestContext.ts), not the container's.
+            await runWithCaller(req.headers["cf-connecting-ip"], () => transport.handleRequest(req, res, req.body));
         }
         catch (err) {
             log("http request error:", err);
@@ -180,12 +192,14 @@ export function createHttpApp(client, options = {}) {
 async function main() {
     const config = loadHttpConfig(); // no global key — keys arrive per request
     const client = new CoinRithmClient(config); // constructed WITHOUT a default key
-    const app = createHttpApp(client);
+    const drain = { draining: false };
+    const app = createHttpApp(client, { drain });
     const port = Number(process.env.PORT) || 8787;
-    app.listen(port, () => {
+    const listener = app.listen(port, () => {
         log(`HTTP MCP listening on :${port}/mcp (multi-user, per-request key). ` +
             `upstream=${config.baseUrl}. Paper only.`);
     });
+    installGracefulShutdown(listener, { state: drain, log });
 }
 if (process.argv[1] &&
     import.meta.url === pathToFileURL(process.argv[1]).href) {

package/dist/httpCompletion.d.ts

@@ -1,6 +1,6 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
-export declare const COMPLETION_TOOL_NAMES: readonly ["whoami", "get_portfolio", "get_wallet", "list_open_orders", "get_positions", "resolve_symbol", "get_equity_curve", "get_my_trades", "get_market_context", "get_candles", "get_news", "discover_pm_markets", "get_performance", "get_agent_ledger", "export_agent_ledger", "export_run_evidence", "get_arena_leaderboard", "get_arena_agent", "futures_quote", "pm_quote", "spot_quote", "place_spot_order", "cancel_spot_order", "open_futures_position", "set_futures_sl_tp", "close_futures_position", "open_pm_position", "report_pm_opportunity", "pm_data_overview", "pm_data_sources", "pm_data_sources_health", "pm_data_events", "pm_data_event", "pm_data_whales", "pm_data_whale_wallets", "pm_data_whale_wallet", "pm_data_disagreements", "pm_data_calibration", "pm_data_canonical", "pm_data_volume_history", "get_crypto_movers"];
+export declare const COMPLETION_TOOL_NAMES: readonly ["whoami", "get_portfolio", "get_wallet", "list_open_orders", "get_positions", "resolve_symbol", "get_equity_curve", "get_my_trades", "get_market_context", "get_candles", "get_news", "discover_pm_markets", "get_performance", "get_agent_ledger", "export_agent_ledger", "export_run_evidence", "get_arena_leaderboard", "get_arena_agent", "futures_quote", "pm_quote", "spot_quote", "place_spot_order", "cancel_spot_order", "open_futures_position", "set_futures_sl_tp", "close_futures_position", "open_pm_position", "report_pm_opportunity", "pm_data_overview", "pm_data_sources", "pm_data_sources_health", "pm_data_events", "pm_data_event", "pm_data_whales", "pm_data_whale_wallets", "pm_data_whale_wallet", "pm_data_disagreements", "pm_data_calibration", "pm_data_canonical", "pm_data_volume_history", "pm_data_price_history", "pm_data_orderbook", "pm_data_resolved", "pm_data_expiring", "pm_data_surprises", "get_crypto_movers", "instrument_markets", "tradfi_references", "crypto_price"];
 type Operation = "initialize" | "tools_list" | "tools_call" | "notification" | "other" | "invalid";
 type Outcome = "result" | "tool_error" | "protocol_error" | "no_response" | "not_applicable";
 type ToolName = (typeof COMPLETION_TOOL_NAMES)[number] | "unknown" | null;

package/dist/httpCompletion.js

@@ -43,7 +43,15 @@ export const COMPLETION_TOOL_NAMES = [
     "pm_data_calibration",
     "pm_data_canonical",
     "pm_data_volume_history",
+    "pm_data_price_history",
+    "pm_data_orderbook",
+    "pm_data_resolved",
+    "pm_data_expiring",
+    "pm_data_surprises",
     "get_crypto_movers",
+    "instrument_markets",
+    "tradfi_references",
+    "crypto_price",
 ];
 const toolNames = new Set(COMPLETION_TOOL_NAMES);
 const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value)

package/dist/httpLimits.d.ts

@@ -0,0 +1,10 @@
+import type { NextFunction, Request, Response } from "express";
+export type McpLimitOptions = {
+    perClientPerMinute?: number;
+    maxInFlight?: number;
+    now?: () => number;
+};
+export declare const DEFAULT_PER_CLIENT_PER_MINUTE = 120;
+export declare const DEFAULT_MAX_IN_FLIGHT = 64;
+export declare function clientKey(req: Request): string;
+export declare function createMcpAdmission(options?: McpLimitOptions): (req: Request, res: Response, next: NextFunction) => void;

package/dist/httpLimits.js

@@ -0,0 +1,76 @@
+// Admission limits for the hosted multi-user MCP (POST /mcp).
+//
+// Audit 2026-10-16: POST /mcp had no rate limit and no concurrency cap, and
+// keyless pm_data_* tools reach the internal API directly (past Cloudflare),
+// so one anonymous client could drive unbounded load into the single-host API.
+// Measured before choosing the numbers (container logs, 24 h to 2026-10-16
+// 01:30 UTC): 3,861 requests, peak about 16 per minute across ALL clients.
+// A per-client allowance of 120 per minute (the API's own per-key baseline)
+// leaves ordinary agents untouched; the in-flight cap bounds a burst.
+//
+// In-memory and per-process on purpose: the service runs as one container.
+// No dependency is added for this (supply-chain surface of an npx package).
+export const DEFAULT_PER_CLIENT_PER_MINUTE = 120;
+export const DEFAULT_MAX_IN_FLIGHT = 64;
+const WINDOW_MS = 60_000;
+const firstHeader = (value) => {
+    const raw = Array.isArray(value) ? value[0] : value;
+    const first = raw?.split(",")[0]?.trim();
+    return first ? first : null;
+};
+// Behind Cloudflare and Traefik: Cloudflare's connecting-IP header names the
+// real client; X-Forwarded-For is the fallback; the socket address last.
+export function clientKey(req) {
+    return (firstHeader(req.headers["cf-connecting-ip"]) ??
+        firstHeader(req.headers["x-forwarded-for"]) ??
+        req.socket?.remoteAddress ??
+        "unknown");
+}
+const rpcError = (res, status, retryAfterSeconds, message) => {
+    res.setHeader("Retry-After", String(retryAfterSeconds));
+    res.status(status).json({
+        jsonrpc: "2.0",
+        error: { code: -32000, message, data: { retryAfterSeconds } },
+        id: null,
+    });
+};
+export function createMcpAdmission(options = {}) {
+    const perClient = options.perClientPerMinute ?? DEFAULT_PER_CLIENT_PER_MINUTE;
+    const maxInFlight = options.maxInFlight ?? DEFAULT_MAX_IN_FLIGHT;
+    const now = options.now ?? Date.now;
+    let windowStart = now();
+    let counts = new Map();
+    let inFlight = 0;
+    return function mcpAdmission(req, res, next) {
+        const t = now();
+        if (t - windowStart >= WINDOW_MS) {
+            // Fixed window: dropping the whole map bounds memory to one minute of
+            // distinct clients.
+            windowStart = t;
+            counts = new Map();
+        }
+        const key = clientKey(req);
+        const used = (counts.get(key) ?? 0) + 1;
+        counts.set(key, used);
+        if (used > perClient) {
+            const retry = Math.max(1, Math.ceil((windowStart + WINDOW_MS - t) / 1000));
+            rpcError(res, 429, retry, `Rate limited: at most ${perClient} MCP requests per minute per client. Retry after ${retry} s.`);
+            return;
+        }
+        if (inFlight >= maxInFlight) {
+            rpcError(res, 503, 2, "Server busy: too many MCP requests in flight. Retry shortly.");
+            return;
+        }
+        inFlight += 1;
+        let released = false;
+        const release = () => {
+            if (released)
+                return;
+            released = true;
+            inFlight -= 1;
+        };
+        res.on("finish", release);
+        res.on("close", release);
+        next();
+    };
+}

package/dist/httpShutdown.d.ts

@@ -0,0 +1,13 @@
+import type { Server } from "node:http";
+export declare const SHUTDOWN_GRACE_MS = 8000;
+export type DrainState = {
+    draining: boolean;
+};
+export declare function installGracefulShutdown(server: Pick<Server, "close" | "closeAllConnections">, options: {
+    state: DrainState;
+    graceMs?: number;
+    log?: (...args: unknown[]) => void;
+    exit?: (code: number) => void;
+    signals?: NodeJS.Signals[];
+    onSignal?: (signal: NodeJS.Signals, handler: () => void) => void;
+}): (signal: NodeJS.Signals) => void;

package/dist/httpShutdown.js

@@ -0,0 +1,34 @@
+export const SHUTDOWN_GRACE_MS = 8_000;
+export function installGracefulShutdown(server, options) {
+    const graceMs = options.graceMs ?? SHUTDOWN_GRACE_MS;
+    const exit = options.exit ?? ((code) => process.exit(code));
+    const say = options.log ?? (() => { });
+    let done = false;
+    const finish = (reason) => {
+        if (done)
+            return;
+        done = true;
+        say(`shutdown: ${reason}`);
+        exit(0);
+    };
+    const begin = (signal) => {
+        if (options.state.draining)
+            return;
+        options.state.draining = true;
+        say(`${signal}: draining, up to ${graceMs} ms for open requests`);
+        server.close(() => finish("all requests closed"));
+        const timer = setTimeout(() => {
+            server.closeAllConnections();
+            finish("grace period ended");
+        }, graceMs);
+        timer.unref?.();
+    };
+    const listen = options.onSignal ??
+        ((signal, handler) => {
+            process.once(signal, handler);
+        });
+    for (const signal of options.signals ?? ["SIGTERM", "SIGINT"]) {
+        listen(signal, () => begin(signal));
+    }
+    return begin;
+}

package/dist/index.js

@@ -6,7 +6,8 @@
 // paper account and place simulated trades using a user-minted API key.
 //
 // Config (env):
-//   COINRITHM_API_KEY  (required)  crk_live_… key minted in your profile.
+//   COINRITHM_API_KEY  (optional)  crk_live_… key minted in your profile.
+//                                  Without it: data-only mode (keyless tools).
 //   COINRITHM_API_URL  (optional)  base URL; defaults to https://api.coinrithm.com
 //
 // stdout is the JSON-RPC channel — we log ONLY to stderr.

package/dist/instructions.js

@@ -6,7 +6,7 @@ import { PAPER_NOTE } from "./tools.js";
 // paper disclaimer on 25 tools, audit 2026-09-29).
 export const SERVER_INSTRUCTIONS = [
     "CoinRithm MCP: crypto and prediction-market data from 12 venues, plus paper trading.",
-    "Start keyless: the pm_data_* tools, get_arena_leaderboard, get_arena_agent and get_crypto_movers need no API key.",
+    "Start keyless: the pm_data_* tools, instrument_markets, tradfi_references, crypto_price, get_arena_leaderboard, get_arena_agent and get_crypto_movers need no API key.",
     "pm_data_events returns open markets by default; pass status=closed or status=all for history.",
     `Tools that read or act on an account need a key. The user mints one at ${API_KEY_MINT_URL}; start with a read-only key.`,
     "Every tool returns { httpStatus, ok, ledgerEventId, ledgerStatus, body }: httpStatus is CoinRithm's HTTP status (0 = network error), ok means 2xx, body is the parsed response.",

package/dist/requestContext.d.ts

@@ -0,0 +1,5 @@
+export declare const CALLER_IP_HEADER = "cf-connecting-ip";
+/** Runs `fn` with the caller's address (if it is a valid IP) in scope. */
+export declare function runWithCaller<T>(rawIp: string | string[] | undefined, fn: () => T): T;
+/** The current request's caller address, or undefined (stdio, no header). */
+export declare const callerIp: () => string | undefined;

package/dist/requestContext.js

@@ -0,0 +1,25 @@
+// Per-HTTP-request context for the hosted MCP (audit 2026-10-16, fresh kit
+// audit P1-1). The hosted server calls the API inside the Docker network
+// (http://api:4000), where the API's keyless rate limit buckets by
+// cf-connecting-ip and otherwise by the socket address. Without this every
+// anonymous MCP user shared the MCP container's one bucket (300 requests per
+// 5 minutes), so one busy client could 429 everyone else.
+//
+// http.ts records the caller's Cloudflare-set address for the duration of the
+// request; the client forwards it as cf-connecting-ip on upstream calls. The
+// API trusts that header only because its origin accepts nothing but
+// Cloudflare and this internal network; the value here is the one Cloudflare
+// set on the MCP request, re-validated as an IP. stdio has no context and
+// sends nothing extra.
+import { AsyncLocalStorage } from "node:async_hooks";
+import { isIP } from "node:net";
+const storage = new AsyncLocalStorage();
+export const CALLER_IP_HEADER = "cf-connecting-ip";
+/** Runs `fn` with the caller's address (if it is a valid IP) in scope. */
+export function runWithCaller(rawIp, fn) {
+    const value = Array.isArray(rawIp) ? rawIp[0] : rawIp;
+    const ip = value?.trim();
+    return storage.run({ clientIp: ip && isIP(ip) ? ip : undefined }, fn);
+}
+/** The current request's caller address, or undefined (stdio, no header). */
+export const callerIp = () => storage.getStore()?.clientIp;