@coinrithm/mcp-trading 0.7.8 → 0.7.10

package/dist/http.js

@@ -24,8 +24,8 @@
 //     forwards as `extra.authInfo`, giving requestKey() a second source. Either
 //     way the caller's own key — and only that key — is used for their tool call.
 //   - Unauthenticated MCP initialization and tool-list introspection are allowed
-//     so registries can verify the server. Actual tool calls without a key return
-//     a structured 401 from CoinRithmClient before any upstream request is made.
+//     so registries can verify the server. Public data tools are also keyless;
+//     protected tools return a structured 401 when their key is missing.
 //
 // Config (env):
 //   COINRITHM_API_URL  (optional)  upstream base URL (default production).
@@ -35,15 +35,23 @@
 // the correct isolation model for a multi-user, per-request-keyed surface — no
 // session state is shared between users.
 import express from "express";
+import { pathToFileURL } from "node:url";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { CoinRithmClient, bearerFromHeader, loadHttpConfig, log, } from "./client.js";
 import { registerTools } from "./tools.js";
 import { SERVER_VERSION } from "./version.js";
-async function main() {
-    const config = loadHttpConfig(); // no global key — keys arrive per request
-    const client = new CoinRithmClient(config); // constructed WITHOUT a default key
+import { observeHttpCompletion, } from "./httpCompletion.js";
+// Factory permits isolated localhost SDK tests without opening a listener on import.
+export function createHttpApp(client, options = {}) {
     const app = express();
+    const completions = new WeakMap();
+    app.use((req, res, next) => {
+        if (req.method === "POST" && /^\/mcp\/?$/i.test(req.path)) {
+            completions.set(res, observeHttpCompletion(req, res, options.completionLogger));
+        }
+        next();
+    });
     app.use(express.json());
     // Lightweight, unauthenticated liveness probe (handy for Coolify/uptime checks).
     // Keep `/healthz` as the deployment contract and expose `/health` as a
@@ -110,8 +118,8 @@ async function main() {
         // Per-request auth: read THIS caller's key from the Authorization header,
         // or from Smithery's non-reserved forwarding header.
         // It is optional at the transport layer so registries can initialize the
-        // server and list tool schemas. Tool handlers still require a key and return
-        // a structured 401 if one is missing.
+        // server and list tool schemas. Public data tools are keyless; protected
+        // tool handlers return a structured 401 if their key is missing.
         const apiKey = bearerFromHeader(req.headers.authorization) ??
             bearerFromHeader(req.headers["x-coinrithm-api-key"]);
         // Belt-and-suspenders: also expose the token via the SDK's authInfo channel.
@@ -120,11 +128,13 @@ async function main() {
         if (apiKey) {
             req.auth = { token: apiKey, clientId: "coinrithm-key", scopes: [] };
         }
-        const server = new McpServer({
-            name: "coinrithm-trading",
-            version: SERVER_VERSION,
-        });
-        registerTools(server, client);
+        const server = options.createServer?.() ??
+            new McpServer({
+                name: "coinrithm-trading",
+                version: SERVER_VERSION,
+            });
+        if (!options.createServer)
+            registerTools(server, client);
         const transport = new StreamableHTTPServerTransport({
             sessionIdGenerator: undefined, // stateless: no cross-request/user state
         });
@@ -134,6 +144,7 @@ async function main() {
         });
         try {
             await server.connect(transport);
+            completions.get(res)?.attach(transport);
             // The transport reads req.headers (→ extra.requestInfo) and req.auth
             // (→ extra.authInfo); tools.ts picks up the caller's key from there.
             await transport.handleRequest(req, res, req.body);
@@ -149,13 +160,22 @@ async function main() {
             }
         }
     });
+    return app;
+}
+async function main() {
+    const config = loadHttpConfig(); // no global key — keys arrive per request
+    const client = new CoinRithmClient(config); // constructed WITHOUT a default key
+    const app = createHttpApp(client);
     const port = Number(process.env.PORT) || 8787;
     app.listen(port, () => {
         log(`HTTP MCP listening on :${port}/mcp (multi-user, per-request key). ` +
             `upstream=${config.baseUrl}. Paper only.`);
     });
 }
-main().catch((err) => {
-    log("fatal:", err instanceof Error ? err.message : err);
-    process.exit(1);
-});
+if (process.argv[1] &&
+    import.meta.url === pathToFileURL(process.argv[1]).href) {
+    main().catch((err) => {
+        log("fatal:", err instanceof Error ? err.message : err);
+        process.exit(1);
+    });
+}

package/dist/httpCompletion.d.ts

@@ -0,0 +1,33 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
+export declare const COMPLETION_TOOL_NAMES: readonly ["whoami", "get_portfolio", "get_wallet", "list_open_orders", "get_positions", "resolve_symbol", "get_equity_curve", "get_my_trades", "get_market_context", "get_candles", "discover_pm_markets", "get_performance", "get_agent_ledger", "export_agent_ledger", "export_run_evidence", "get_arena_leaderboard", "get_arena_agent", "futures_quote", "pm_quote", "spot_quote", "place_spot_order", "cancel_spot_order", "open_futures_position", "set_futures_sl_tp", "close_futures_position", "open_pm_position", "report_pm_opportunity", "pm_data_overview", "pm_data_sources", "pm_data_sources_health", "pm_data_events", "pm_data_event", "pm_data_whales", "pm_data_disagreements", "pm_data_calibration", "pm_data_canonical", "pm_data_volume_history", "get_crypto_movers"];
+type Operation = "initialize" | "tools_list" | "tools_call" | "notification" | "other" | "invalid";
+type Outcome = "result" | "tool_error" | "protocol_error" | "no_response" | "not_applicable";
+type ToolName = (typeof COMPLETION_TOOL_NAMES)[number] | "unknown" | null;
+type RpcCompletion = {
+    operation: Operation;
+    tool: ToolName;
+    rpc_outcome: Outcome;
+    result_http_status: number | null;
+    result_ok: boolean | null;
+};
+export type HttpCompletionRecord = Readonly<RpcCompletion & {
+    event: "mcp_completion";
+    schema_version: 1;
+    completed_at: string;
+    duration_ms: number;
+    service_version: string;
+    transport: "streamable_http";
+    credential_supplied: boolean;
+    http_status: number | null;
+    delivery: "finished" | "aborted";
+}>;
+export type CompletionLogger = (line: string) => void;
+/** Attach before JSON parsing; malformed/rejected HTTP requests remain invalid,
+ * no_response, with their actual HTTP status. Do not read bodies or raw errors.
+ * Authentication and caller origin are deliberately NOT inferred from headers.
+ */
+export declare function observeHttpCompletion(req: IncomingMessage, res: ServerResponse, logger?: CompletionLogger): {
+    attach: (transport: Transport) => void;
+};
+export {};

package/dist/httpCompletion.js

@@ -0,0 +1,220 @@
+import { bearerFromHeader, log } from "./client.js";
+import { SERVER_VERSION } from "./version.js";
+// Explicit, server-owned dimensions; tests compare this with actual tools/list.
+// Never retain a caller's unknown tool name, even truncated or hashed.
+export const COMPLETION_TOOL_NAMES = [
+    "whoami",
+    "get_portfolio",
+    "get_wallet",
+    "list_open_orders",
+    "get_positions",
+    "resolve_symbol",
+    "get_equity_curve",
+    "get_my_trades",
+    "get_market_context",
+    "get_candles",
+    "discover_pm_markets",
+    "get_performance",
+    "get_agent_ledger",
+    "export_agent_ledger",
+    "export_run_evidence",
+    "get_arena_leaderboard",
+    "get_arena_agent",
+    "futures_quote",
+    "pm_quote",
+    "spot_quote",
+    "place_spot_order",
+    "cancel_spot_order",
+    "open_futures_position",
+    "set_futures_sl_tp",
+    "close_futures_position",
+    "open_pm_position",
+    "report_pm_opportunity",
+    "pm_data_overview",
+    "pm_data_sources",
+    "pm_data_sources_health",
+    "pm_data_events",
+    "pm_data_event",
+    "pm_data_whales",
+    "pm_data_disagreements",
+    "pm_data_calibration",
+    "pm_data_canonical",
+    "pm_data_volume_history",
+    "get_crypto_movers",
+];
+const toolNames = new Set(COMPLETION_TOOL_NAMES);
+const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value
+    : undefined;
+const status = (value) => typeof value === "number" &&
+    Number.isInteger(value) &&
+    (value === 0 || (value >= 100 && value <= 599))
+    ? value
+    : null;
+const empty = (operation = "invalid", tool = null) => ({
+    operation,
+    tool,
+    rpc_outcome: "no_response",
+    result_http_status: null,
+    result_ok: null,
+});
+/** Attach before JSON parsing; malformed/rejected HTTP requests remain invalid,
+ * no_response, with their actual HTTP status. Do not read bodies or raw errors.
+ * Authentication and caller origin are deliberately NOT inferred from headers.
+ */
+export function observeHttpCompletion(req, res, logger = (line) => log(line)) {
+    const started = performance.now();
+    const credentialSupplied = Boolean(bearerFromHeader(req.headers.authorization) ??
+        bearerFromHeader(req.headers["x-coinrithm-api-key"]));
+    const records = [];
+    // IDs are transient correlations only, never copied into records/logs. Clear
+    // on completion so a late tool callback cannot retain IDs or emit twice.
+    const pending = new Map();
+    let completed = false;
+    let delivery;
+    let sendsInFlight = 0;
+    const emit = () => {
+        if (completed || !delivery || (delivery === "finished" && sendsInFlight))
+            return;
+        completed = true;
+        res.off("finish", onFinish);
+        res.off("close", onClose);
+        res.off("error", onAbort);
+        const elapsed = performance.now() - started;
+        const duration = Number.isFinite(elapsed)
+            ? Math.max(0, Math.round(elapsed * 1000) / 1000)
+            : 0;
+        const completedAt = new Date().toISOString();
+        // A pre-header disconnect has no HTTP status; Node's default 200 is not one.
+        const httpStatus = res.headersSent ? status(res.statusCode) : null;
+        const snapshots = records.length ? records : [empty()];
+        for (const rpc of snapshots) {
+            const record = {
+                event: "mcp_completion",
+                schema_version: 1,
+                completed_at: completedAt,
+                duration_ms: duration,
+                service_version: SERVER_VERSION,
+                transport: "streamable_http",
+                ...rpc,
+                credential_supplied: credentialSupplied,
+                http_status: httpStatus,
+                delivery,
+            };
+            try {
+                logger(JSON.stringify(record));
+            }
+            catch {
+                // Observability must never change a tool response or recurse into logging.
+            }
+        }
+        records.length = 0;
+        pending.clear();
+    };
+    const onFinish = () => {
+        delivery = "finished";
+        emit();
+    };
+    const onAbort = () => {
+        delivery = "aborted";
+        // A computed response in an interrupted stream is not confirmed delivered.
+        // In particular, a still-pending send may reject after this close event.
+        for (const rpc of records) {
+            if (rpc.rpc_outcome !== "not_applicable") {
+                rpc.rpc_outcome = "no_response";
+                rpc.result_http_status = null;
+                rpc.result_ok = null;
+            }
+        }
+        emit();
+    };
+    const onClose = () => {
+        if (!res.writableFinished)
+            onAbort();
+        else
+            onFinish();
+    };
+    res.once("finish", onFinish);
+    res.once("close", onClose);
+    res.once("error", onAbort);
+    const incoming = (message) => {
+        if (completed)
+            return;
+        if (!("method" in message)) {
+            records.push({ ...empty("other"), rpc_outcome: "not_applicable" });
+            return;
+        }
+        if (!("id" in message)) {
+            records.push({ ...empty("notification"), rpc_outcome: "not_applicable" });
+            return;
+        }
+        const operation = message.method === "initialize"
+            ? "initialize"
+            : message.method === "tools/list"
+                ? "tools_list"
+                : message.method === "tools/call"
+                    ? "tools_call"
+                    : "other";
+        const name = operation === "tools_call" ? object(message.params)?.name : undefined;
+        const tool = operation !== "tools_call"
+            ? null
+            : typeof name === "string" && toolNames.has(name)
+                ? name
+                : "unknown";
+        const rpc = empty(operation, tool);
+        records.push(rpc);
+        pending.set(message.id, [...(pending.get(message.id) ?? []), rpc]);
+    };
+    return {
+        attach(transport) {
+            // Call AFTER server.connect (which installs SDK callbacks), before handling
+            // this request. Observe only SDK-accepted messages, not unvalidated bodies.
+            const onmessage = transport.onmessage;
+            transport.onmessage = (message, extra) => {
+                incoming(message);
+                onmessage?.(message, extra);
+            };
+            const send = transport.send.bind(transport);
+            transport.send = async (message, options) => {
+                const matches = "id" in message ? pending.get(message.id) : undefined;
+                // Duplicate IDs are ambiguous; never attribute one response twice.
+                const rpc = !completed && matches?.length === 1 ? matches[0] : undefined;
+                if (!rpc || (!("result" in message) && !("error" in message))) {
+                    return send(message, options);
+                }
+                // This is the SDK's FINAL result, after input/output schema validation.
+                rpc.result_http_status = null;
+                rpc.result_ok = null;
+                if ("error" in message)
+                    rpc.rpc_outcome = "protocol_error";
+                else {
+                    const result = object(message.result);
+                    const structured = object(result?.structuredContent);
+                    rpc.rpc_outcome =
+                        rpc.operation === "tools_call" && result?.isError === true
+                            ? "tool_error"
+                            : "result";
+                    if (rpc.operation === "tools_call") {
+                        rpc.result_http_status = status(structured?.httpStatus);
+                        rpc.result_ok =
+                            typeof structured?.ok === "boolean" ? structured.ok : null;
+                    }
+                }
+                sendsInFlight += 1;
+                try {
+                    return await send(message, options);
+                }
+                catch (error) {
+                    rpc.rpc_outcome = "no_response";
+                    rpc.result_http_status = null;
+                    rpc.result_ok = null;
+                    throw error;
+                }
+                finally {
+                    sendsInFlight -= 1;
+                    emit();
+                }
+            };
+        },
+    };
+}

package/dist/retryAfter.d.ts

@@ -0,0 +1 @@
+export declare function retryAfterSeconds(value: string | null, now?: number): number | undefined;

package/dist/retryAfter.js

@@ -0,0 +1,16 @@
+// Retry-After permits a delay in seconds or an HTTP date. Missing/invalid
+// evidence stays absent, so each caller can apply its explicit fallback.
+export function retryAfterSeconds(value, now = Date.now()) {
+    const raw = value?.trim();
+    if (!raw)
+        return undefined;
+    if (/^\d+(?:\.\d+)?$/.test(raw)) {
+        const seconds = Number(raw);
+        return Number.isFinite(seconds) ? seconds : undefined;
+    }
+    // Avoid Date.parse treating malformed numeric delays (e.g. "-1") as dates.
+    if (!/^[A-Za-z]{3}(?:,|day,|\s)/.test(raw))
+        return undefined;
+    const date = Date.parse(raw);
+    return Number.isFinite(date) ? Math.max(0, (date - now) / 1000) : undefined;
+}

package/dist/tools.js

@@ -196,6 +196,8 @@ const EVENT_SUMMARY_FIELDS = [
     "startDate",
     "endDate",
     "resolvedAt",
+    "resolvedAtBasis",
+    "settlementWindowClosedAt",
     "freshness",
     "volume",
     "volume24h",
@@ -205,6 +207,8 @@ const EVENT_SUMMARY_FIELDS = [
     "bestBid",
     "bestAsk",
     "spread",
+    "spreadPoints",
+    "probabilityBook",
     "marketsCount",
     "referenceProbability",
     "crossPlatform",
@@ -215,6 +219,7 @@ const OUTCOME_SUMMARY_FIELDS = [
     "externalMarketId",
     "name",
     "probability",
+    "normalizedProbability",
     "priceChange24h",
 ];
 const WHALE_TRADE_FIELDS = [
@@ -253,7 +258,17 @@ function eventSummary(value) {
     if (!isJsonRecord(value))
         return value;
     const source = isJsonRecord(value.source)
-        ? pick(value.source, ["id", "name", "kind", "supportsTrading"])
+        ? pick(value.source, [
+            "id",
+            "name",
+            "kind",
+            "supportsTrading",
+            // Quotes remain venue-native. Magnitude cannot distinguish a 0.5-point
+            // bid from a 0.5 ratio; keep the API's explicit unit with the number.
+            "quoteScale",
+            "methodology",
+            "supportsMarketMetrics",
+        ])
         : value.source;
     const outcomes = Array.isArray(value.outcomes)
         ? value.outcomes
@@ -799,6 +814,9 @@ export function registerTools(server, client) {
             "1H=60x1-minute, 1D=288x5-minute, 1W=672x15-minute, 1M=720x1-hour, " +
             "3M=540x4-hour candles. Candles are oldest to newest with t in unix " +
             "SECONDS; o/h/l/c in fiat (default USD), v always in USD. " +
+            "These are sampled composite-price bars, not venue trade candles. " +
+            "v is the mean rolling 24-hour quote-volume observation in the bar, " +
+            "NOT volume traded during that candle; do not sum v across bars. " +
             PAPER_NOTE,
         inputSchema: {
             coinId: z

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coinrithm/mcp-trading",
-  "version": "0.7.8",
+  "version": "0.7.10",
   "mcpName": "io.github.CoinRithm/mcp-trading",
   "description": "CoinRithm paper-trading toolkit: an MCP server (coinrithm-mcp) AND a self-host agent runner (coinrithm-agent) for spot, futures, and prediction markets with a user-minted API key.",
   "type": "module",
@@ -31,6 +31,7 @@
     "build": "tsc -p tsconfig.json",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
     "lint": "eslint src",
     "lint:fix": "eslint src --fix",
     "format": "prettier --write \"src/**/*.ts\"",
@@ -77,10 +78,20 @@
     "@eslint/js": "^9.13.0",
     "@types/express": "^4.17.21",
     "@types/node": "^20.14.0",
+    "@vitest/coverage-v8": "4.1.11",
     "eslint": "^9.13.0",
     "prettier": "^3.3.3",
     "typescript": "^5.5.0",
     "typescript-eslint": "^8.11.0",
-    "vitest": "^2.1.0"
+    "vitest": "4.1.11"
+  },
+  "exports": {
+    ".": "./dist/index.js",
+    "./engine": {
+      "types": "./dist/agent/engine.d.ts",
+      "import": "./dist/agent/engine.js"
+    },
+    "./package.json": "./package.json",
+    "./dist/*": "./dist/*"
   }
 }