@coinrithm/mcp-trading 0.7.19 → 0.7.20

package/dist/agent/templates.js

@@ -50,37 +50,37 @@ const PRESETS = {
         modelFail: 5,
     },
 };
-const THESIS_BODY = `# Momentum Futures — strategy
-
-You operate a CoinRithm **paper-trading** futures account (50,000 virtual mUSD).
-Everything here is simulated; it is not financial advice and never touches real
-money. Edit this prose freely (any language) — it is your agent's borders.
-
-## Each cycle
-
-1. Ground yourself: read your portfolio and open positions first. Never assume
-   balances or what is already open.
-2. Scan the watchlist. A candidate is a coin whose short and medium momentum
-   agree (both up, or both down) and is not already an open position.
-3. Pick the strongest candidate and commit when the read is clear — even a
-   moderate-confidence one — sized small with a stop. Skip only when the signals
-   contradict or the data is stale; a quiet tape where your edge is still real
-   is an act, not a skip.
-4. Quote before you open. Read the liquidation price and confirm it is sane. If
-   the quote is not eligible, relay the reason and stop.
-5. Open small and protected: enter in the trend direction and set a stop-loss at
-   open. Place the take-profit a touch wider than the stop.
-6. Stay in sync: poll your trades for any stop / take-profit / liquidation that
-   fired while you were not looking, and react to what actually happened.
-
-The hard caps (leverage, margin, watchlist) live in the config blocks above and
+const THESIS_BODY = `# Momentum Futures — strategy
+
+You operate a CoinRithm **paper-trading** futures account (50,000 virtual mUSD).
+Everything here is simulated; it is not financial advice and never touches real
+money. Edit this prose freely (any language) — it is your agent's borders.
+
+## Each cycle
+
+1. Ground yourself: read your portfolio and open positions first. Never assume
+   balances or what is already open.
+2. Scan the watchlist. A candidate is a coin whose short and medium momentum
+   agree (both up, or both down) and is not already an open position.
+3. Pick the strongest candidate and commit when the read is clear — even a
+   moderate-confidence one — sized small with a stop. Skip only when the signals
+   contradict or the data is stale; a quiet tape where your edge is still real
+   is an act, not a skip.
+4. Quote before you open. Read the liquidation price and confirm it is sane. If
+   the quote is not eligible, relay the reason and stop.
+5. Open small and protected: enter in the trend direction and set a stop-loss at
+   open. Place the take-profit a touch wider than the stop.
+6. Stay in sync: poll your trades for any stop / take-profit / liquidation that
+   fired while you were not looking, and react to what actually happened.
+
+The hard caps (leverage, margin, watchlist) live in the config blocks above and
 are enforced by the runner — change them there, not in this prose.`;
-const PERSONA_STUB = `# Persona
-
-Decisive and in character. Acts on a clear read — even a moderate-confidence one
-— sized small and protected with a stop, and skips only when the read is
-contradictory or the data is stale. States its reasoning plainly in its own
-voice, and never frames paper results as real-money advice.
+const PERSONA_STUB = `# Persona
+
+Decisive and in character. Acts on a clear read — even a moderate-confidence one
+— sized small and protected with a stop, and skips only when the read is
+contradictory or the data is stale. States its reasoning plainly in its own
+voice, and never frames paper results as real-money advice.
 `;
 export function buildAgentObject(name, preset) {
     const p = PRESETS[preset];

package/dist/agent/version.d.ts

@@ -5,7 +5,7 @@ export declare const COINRITHM_API: {
     readonly kind: "coinrithm-agent-api";
     readonly baseUrl: "https://api.coinrithm.com";
     readonly mcpUrl: "https://mcp.coinrithm.com/mcp";
-    readonly openapiVersion: "1.9.0";
+    readonly openapiVersion: "1.11.0";
     readonly mcpPackage: "@coinrithm/mcp-trading";
     readonly mcpVersion: string;
 };

package/dist/agent/version.js

@@ -20,7 +20,7 @@ export const COINRITHM_API = {
     mcpUrl: "https://mcp.coinrithm.com/mcp",
     // The API CONTRACT version (openapi.yaml info.version). Versioned independently
     // from the npm package below — hand-bump this when the OpenAPI contract changes.
-    openapiVersion: "1.9.0",
+    openapiVersion: "1.11.0",
     mcpPackage: "@coinrithm/mcp-trading",
     mcpVersion: PACKAGE_VERSION,
 };

package/dist/client.d.ts

@@ -90,7 +90,52 @@ export declare class CoinRithmClient {
     }): Promise<ApiResult>;
     getPublicPmCanonicalDetail(key: string): Promise<ApiResult>;
     getPublicPmVolumeHistory(): Promise<ApiResult>;
+    getPublicPmPriceHistory(source: string, slug: string, query?: {
+        interval?: string;
+    }): Promise<ApiResult>;
+    getPublicPmOrderBook(source: string, slug: string, query?: {
+        outcomeExternalMarketId?: string;
+    }): Promise<ApiResult>;
+    listPublicPmResolved(query?: {
+        limit?: number;
+        offset?: number;
+        fiat?: string;
+        source?: string;
+        minVolume?: number;
+        year?: number;
+        month?: number;
+    }): Promise<ApiResult>;
+    listPublicPmExpiring(query?: {
+        limit?: number;
+        offset?: number;
+        fiat?: string;
+        days?: number;
+        source?: string;
+    }): Promise<ApiResult>;
+    listPublicPmSurprises(query?: {
+        limit?: number;
+        offset?: number;
+        fiat?: string;
+        source?: string;
+        window?: string;
+    }): Promise<ApiResult>;
+    getPublicInstrumentMarkets(type: string, id: string, query?: {
+        horizon?: string;
+        includeShortTerm?: boolean;
+        limit?: number;
+    }): Promise<ApiResult>;
+    getPublicTradfiReferences(): Promise<ApiResult>;
+    getPublicTradfiReference(ticker: string, query?: {
+        window?: string;
+    }): Promise<ApiResult>;
     getPublicCryptoMovers(direction: "gainers" | "losers", limit?: number): Promise<ApiResult>;
+    getPublicCoin(slug: string, query?: {
+        fiat?: string;
+    }): Promise<ApiResult>;
+    getPublicCoinCandles(slug: string, query?: {
+        range?: string;
+        fiat?: string;
+    }): Promise<ApiResult>;
     whoami(apiKey?: string, agentTrace?: AgentTrace): Promise<ApiResult>;
     getPortfolio(query?: {
         fiat?: string;

package/dist/client.js

@@ -1,3 +1,4 @@
+import { CALLER_IP_HEADER, callerIp } from "./requestContext.js";
 import { PM_PAPER_V2_BASE, } from "./pmPaperV2.js";
 // Thin HTTP client for the CoinRithm agent surface (/api/agent/*).
 //
@@ -29,7 +30,8 @@ function resolveBaseUrl() {
 }
 // stdio path (single user). The key is OPTIONAL since 2026-10-16 (audit):
 // without one the server starts in data-only mode, exactly like the hosted
-// server: keyless tools (pm_data_*, get_arena_*, get_crypto_movers) work and
+// server: keyless tools (pm_data_*, instrument_markets, tradfi_references,
+// crypto_price, get_arena_*, get_crypto_movers) work and
 // every keyed tool returns the structured missing_api_key result. Requiring a
 // key blocked the one-line `npx -y @coinrithm/mcp-trading` data install.
 export function loadConfig() {
@@ -122,8 +124,9 @@ export class CoinRithmClient {
                     message: "No API key for this request. Mint a free key at " +
                         `${API_KEY_MINT_URL}, then on the hosted MCP send ` +
                         "`Authorization: Bearer crk_live_…`, or for the local server " +
-                        "set COINRITHM_API_KEY. Public data tools " +
-                        "(pm_data_*, get_arena_*, get_crypto_movers) need no key.",
+                        "set COINRITHM_API_KEY. Public data tools (pm_data_*, " +
+                        "instrument_markets, tradfi_references, crypto_price, " +
+                        "get_arena_*, get_crypto_movers) need no key.",
                 },
             };
         }
@@ -142,6 +145,9 @@ export class CoinRithmClient {
         applyAgentTraceHeaders(headers, opts.agentTrace ?? traceFromBody(opts.body));
         if (opts.body !== undefined)
             headers["Content-Type"] = "application/json";
+        const ip = callerIp();
+        if (ip)
+            headers[CALLER_IP_HEADER] = ip;
         let res;
         try {
             res = await fetch(url.toString(), {
@@ -200,9 +206,13 @@ export class CoinRithmClient {
         }
         let res;
         try {
+            const ip = callerIp();
             res = await fetch(url.toString(), {
                 method: "GET",
-                headers: { Accept: "application/json" },
+                headers: {
+                    Accept: "application/json",
+                    ...(ip ? { [CALLER_IP_HEADER]: ip } : {}),
+                },
                 signal: AbortSignal.timeout(UPSTREAM_TIMEOUT_MS),
             });
         }
@@ -302,6 +312,38 @@ export class CoinRithmClient {
     getPublicPmVolumeHistory() {
         return this.publicRequest("/api/prediction-markets/volume-history");
     }
+    // Native venue price history for ONE outcome (Polymarket and Kalshi; other
+    // venues answer 200 with points: []). Points are {t: epoch ms, p: 0-1}.
+    getPublicPmPriceHistory(source, slug, query) {
+        return this.publicRequest(`/api/prediction-markets/event/${encodeURIComponent(source)}/${encodeURIComponent(slug)}/price-history`, query);
+    }
+    // Live order book for the same outcome price-history describes, or the
+    // outcome named by outcomeExternalMarketId. Prices are 0-1 fractions.
+    getPublicPmOrderBook(source, slug, query) {
+        return this.publicRequest(`/api/prediction-markets/event/${encodeURIComponent(source)}/${encodeURIComponent(slug)}/orderbook`, query);
+    }
+    listPublicPmResolved(query) {
+        return this.publicRequest("/api/prediction-markets/resolved", query);
+    }
+    listPublicPmExpiring(query) {
+        return this.publicRequest("/api/prediction-markets/expiring", query);
+    }
+    listPublicPmSurprises(query) {
+        return this.publicRequest("/api/prediction-markets/surprises", query);
+    }
+    // ---- public instrument and TradFi reference data (no key required) ----
+    // Prediction-market strike ladders written on one instrument's price. The
+    // API returns 400 for any query parameter other than these three.
+    getPublicInstrumentMarkets(type, id, query) {
+        return this.publicRequest(`/api/instruments/${encodeURIComponent(type)}/${encodeURIComponent(id)}/markets`, query);
+    }
+    // The catalog accepts no query parameters (any one returns 400).
+    getPublicTradfiReferences() {
+        return this.publicRequest("/api/market/references");
+    }
+    getPublicTradfiReference(ticker, query) {
+        return this.publicRequest(`/api/market/references/${encodeURIComponent(ticker)}`, query);
+    }
     // ---- public crypto data (no key required) ----
     // Top 24h movers across the tracked coin universe (user feature request,
     // 2026-08-18: agents previously could only analyze manually-added pairs).
@@ -312,6 +354,16 @@ export class CoinRithmClient {
             ? "/api/coins/top-losers"
             : "/api/coins/top-gainers", { limit });
     }
+    // One coin's profile by slug: price in USD and `fiat`, 24h change, market
+    // cap, volume and the live-price as-of (priceUpdatedAt, priceStale).
+    // Numerics are decimal strings. An unknown slug is 404 {message}.
+    getPublicCoin(slug, query) {
+        return this.publicRequest(`/api/coins/${encodeURIComponent(slug)}`, query);
+    }
+    // OHLC bars by slug; `range` fixes lookback and resolution (1H = 60 x 1m).
+    getPublicCoinCandles(slug, query) {
+        return this.publicRequest(`/api/coins/${encodeURIComponent(slug)}/candles`, query);
+    }
     // Every method takes an optional trailing `apiKey` (the per-request key for
     // the multi-user HTTP path). When omitted, the constructor key (stdio) is used.
     // ---- reads (scope: read) ----

package/dist/http.js

@@ -45,6 +45,7 @@ import { SERVER_VERSION } from "./version.js";
 import { observeHttpCompletion, } from "./httpCompletion.js";
 import { createMcpAdmission } from "./httpLimits.js";
 import { installGracefulShutdown } from "./httpShutdown.js";
+import { runWithCaller } from "./requestContext.js";
 // "/mcp" immediately followed by the markdown "](" of a pasted link, literal or
 // percent-encoded. Anything else under /mcp is not this family.
 export const MALFORMED_MCP_LINK = /^\/mcp(?:\]|%5d)(?:\(|%28)/i;
@@ -84,7 +85,7 @@ export function createHttpApp(client, options = {}) {
         res.json({
             service: "CoinRithm MCP",
             version: SERVER_VERSION,
-            description: "Model Context Protocol server for CoinRithm: keyless prediction-market data tools across 12 venues (pm_data_*), keyless crypto movers and Agent Arena reads, plus crypto market context and paper-trading tools (spot, futures, prediction markets) with a crk_live_ API key. Opt-in PM paper v2 and spot reference tools are off unless the server enables them. Paper only, never real money.",
+            description: "Model Context Protocol server for CoinRithm: keyless prediction-market data tools across 12 venues (pm_data_*), keyless strike ladders (instrument_markets), TradFi reference prices (tradfi_references), crypto prices (crypto_price), crypto movers and Agent Arena reads, plus crypto market context and paper-trading tools (spot, futures, prediction markets) with a crk_live_ API key. Opt-in PM paper v2 and spot reference tools are off unless the server enables them. Paper only, never real money.",
             endpoint: {
                 url: "https://mcp.coinrithm.com/mcp",
                 method: "POST",
@@ -171,7 +172,9 @@ export function createHttpApp(client, options = {}) {
             completions.get(res)?.attach(transport);
             // The transport reads req.headers (→ extra.requestInfo) and req.auth
             // (→ extra.authInfo); tools.ts picks up the caller's key from there.
-            await transport.handleRequest(req, res, req.body);
+            // Upstream calls made while handling it carry the caller's own
+            // address (requestContext.ts), not the container's.
+            await runWithCaller(req.headers["cf-connecting-ip"], () => transport.handleRequest(req, res, req.body));
         }
         catch (err) {
             log("http request error:", err);

package/dist/httpCompletion.d.ts

@@ -1,6 +1,6 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
-export declare const COMPLETION_TOOL_NAMES: readonly ["whoami", "get_portfolio", "get_wallet", "list_open_orders", "get_positions", "resolve_symbol", "get_equity_curve", "get_my_trades", "get_market_context", "get_candles", "get_news", "discover_pm_markets", "get_performance", "get_agent_ledger", "export_agent_ledger", "export_run_evidence", "get_arena_leaderboard", "get_arena_agent", "futures_quote", "pm_quote", "spot_quote", "place_spot_order", "cancel_spot_order", "open_futures_position", "set_futures_sl_tp", "close_futures_position", "open_pm_position", "report_pm_opportunity", "pm_data_overview", "pm_data_sources", "pm_data_sources_health", "pm_data_events", "pm_data_event", "pm_data_whales", "pm_data_whale_wallets", "pm_data_whale_wallet", "pm_data_disagreements", "pm_data_calibration", "pm_data_canonical", "pm_data_volume_history", "get_crypto_movers"];
+export declare const COMPLETION_TOOL_NAMES: readonly ["whoami", "get_portfolio", "get_wallet", "list_open_orders", "get_positions", "resolve_symbol", "get_equity_curve", "get_my_trades", "get_market_context", "get_candles", "get_news", "discover_pm_markets", "get_performance", "get_agent_ledger", "export_agent_ledger", "export_run_evidence", "get_arena_leaderboard", "get_arena_agent", "futures_quote", "pm_quote", "spot_quote", "place_spot_order", "cancel_spot_order", "open_futures_position", "set_futures_sl_tp", "close_futures_position", "open_pm_position", "report_pm_opportunity", "pm_data_overview", "pm_data_sources", "pm_data_sources_health", "pm_data_events", "pm_data_event", "pm_data_whales", "pm_data_whale_wallets", "pm_data_whale_wallet", "pm_data_disagreements", "pm_data_calibration", "pm_data_canonical", "pm_data_volume_history", "pm_data_price_history", "pm_data_orderbook", "pm_data_resolved", "pm_data_expiring", "pm_data_surprises", "get_crypto_movers", "instrument_markets", "tradfi_references", "crypto_price"];
 type Operation = "initialize" | "tools_list" | "tools_call" | "notification" | "other" | "invalid";
 type Outcome = "result" | "tool_error" | "protocol_error" | "no_response" | "not_applicable";
 type ToolName = (typeof COMPLETION_TOOL_NAMES)[number] | "unknown" | null;

package/dist/httpCompletion.js

@@ -43,7 +43,15 @@ export const COMPLETION_TOOL_NAMES = [
     "pm_data_calibration",
     "pm_data_canonical",
     "pm_data_volume_history",
+    "pm_data_price_history",
+    "pm_data_orderbook",
+    "pm_data_resolved",
+    "pm_data_expiring",
+    "pm_data_surprises",
     "get_crypto_movers",
+    "instrument_markets",
+    "tradfi_references",
+    "crypto_price",
 ];
 const toolNames = new Set(COMPLETION_TOOL_NAMES);
 const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value)

package/dist/instructions.js

@@ -6,7 +6,7 @@ import { PAPER_NOTE } from "./tools.js";
 // paper disclaimer on 25 tools, audit 2026-09-29).
 export const SERVER_INSTRUCTIONS = [
     "CoinRithm MCP: crypto and prediction-market data from 12 venues, plus paper trading.",
-    "Start keyless: the pm_data_* tools, get_arena_leaderboard, get_arena_agent and get_crypto_movers need no API key.",
+    "Start keyless: the pm_data_* tools, instrument_markets, tradfi_references, crypto_price, get_arena_leaderboard, get_arena_agent and get_crypto_movers need no API key.",
     "pm_data_events returns open markets by default; pass status=closed or status=all for history.",
     `Tools that read or act on an account need a key. The user mints one at ${API_KEY_MINT_URL}; start with a read-only key.`,
     "Every tool returns { httpStatus, ok, ledgerEventId, ledgerStatus, body }: httpStatus is CoinRithm's HTTP status (0 = network error), ok means 2xx, body is the parsed response.",

package/dist/requestContext.d.ts

@@ -0,0 +1,5 @@
+export declare const CALLER_IP_HEADER = "cf-connecting-ip";
+/** Runs `fn` with the caller's address (if it is a valid IP) in scope. */
+export declare function runWithCaller<T>(rawIp: string | string[] | undefined, fn: () => T): T;
+/** The current request's caller address, or undefined (stdio, no header). */
+export declare const callerIp: () => string | undefined;

package/dist/requestContext.js

@@ -0,0 +1,25 @@
+// Per-HTTP-request context for the hosted MCP (audit 2026-10-16, fresh kit
+// audit P1-1). The hosted server calls the API inside the Docker network
+// (http://api:4000), where the API's keyless rate limit buckets by
+// cf-connecting-ip and otherwise by the socket address. Without this every
+// anonymous MCP user shared the MCP container's one bucket (300 requests per
+// 5 minutes), so one busy client could 429 everyone else.
+//
+// http.ts records the caller's Cloudflare-set address for the duration of the
+// request; the client forwards it as cf-connecting-ip on upstream calls. The
+// API trusts that header only because its origin accepts nothing but
+// Cloudflare and this internal network; the value here is the one Cloudflare
+// set on the MCP request, re-validated as an IP. stdio has no context and
+// sends nothing extra.
+import { AsyncLocalStorage } from "node:async_hooks";
+import { isIP } from "node:net";
+const storage = new AsyncLocalStorage();
+export const CALLER_IP_HEADER = "cf-connecting-ip";
+/** Runs `fn` with the caller's address (if it is a valid IP) in scope. */
+export function runWithCaller(rawIp, fn) {
+    const value = Array.isArray(rawIp) ? rawIp[0] : rawIp;
+    const ip = value?.trim();
+    return storage.run({ clientIp: ip && isIP(ip) ? ip : undefined }, fn);
+}
+/** The current request's caller address, or undefined (stdio, no header). */
+export const callerIp = () => storage.getStore()?.clientIp;

package/dist/tools.d.ts

@@ -27,4 +27,48 @@ export declare function compactPublicCryptoMovers(data: unknown): unknown;
  * ~466KB to ~48KB.
  */
 export declare function compactPublicPmDisagreements(data: unknown): unknown;
+/**
+ * Evenly spaced subset of a time series that always keeps the first and the
+ * last point. Values are never rewritten or interpolated.
+ */
+export declare function samplePoints(points: unknown[], max: number): unknown[];
+/** Price history for one outcome, with the point series bounded to maxPoints. */
+export declare function compactPublicPmPriceHistory(data: unknown, maxPoints: number): unknown;
+/** Order book with each side cut to its best `depth` levels as served. */
+export declare function compactPublicPmOrderBook(data: unknown, depth: number): unknown;
+/** Resolved archive and surprise pages: rows reduced to settled summaries. */
+export declare function compactPublicPmSettled(data: unknown): unknown;
+/** Expiring page: each row is a full event plus expiresInMs. */
+export declare function compactPublicPmExpiring(data: unknown): unknown;
+/**
+ * Strike ladders without per-contract venue ids, parser details and URLs.
+ * detail=full returns the untouched record (externalMarketId included).
+ * Verified live 2026-10-16: bitcoin, 10 ladders, 174 contracts went from
+ * about 92 KB to about 40 KB.
+ */
+export declare function compactInstrumentMarkets(data: unknown): unknown;
+export declare const TRADFI_ASSET_CLASSES: readonly ["equity", "etf", "metal", "commodity", "fx"];
+/** TradFi catalog filtered by asset class and paged on the MCP side. */
+export declare function compactTradfiCatalog(data: unknown, opts: {
+    assetClass?: string;
+    limit: number;
+    offset: number;
+}): unknown;
+/** TradFi detail with its 15-minute history bounded to maxPoints. */
+export declare function compactTradfiReference(data: unknown, maxPoints: number): unknown;
+export declare const COIN_CANDLE_RANGES: readonly ["1H", "1D", "1W", "1M", "3M", "1Y"];
+/**
+ * Compact coin profile from GET /api/coins/{slug}: price, change, market cap,
+ * volume and the live-price as-of. The profile, not /price, because its
+ * priceUpdatedAt is the live-price write time (probe 2026-10-16: /price
+ * reported dead-pair coins as 0.6 h old while the profile said weeks).
+ */
+export declare function compactCryptoPrice(data: unknown, fiat: string): unknown;
+/**
+ * Bars from GET /api/coins/{slug}/candles, merged into at most maxPoints
+ * consecutive groups (open of the first bar, high and low across the group,
+ * close of the last). `v` is dropped: it is a rolling 24h volume observed at
+ * each bar, not the volume traded in it, so it cannot be merged.
+ */
+export declare function compactCoinCandles(data: unknown, maxPoints: number): unknown;
 export declare function registerTools(server: McpServer, client: CoinRithmClient): void;