@elfa-ai/mcp 2.0.0 → 4.1.0

package/CHANGELOG.md

@@ -1,5 +1,60 @@
 # Changelog
 
+## 4.1.0
+
+### Security
+
+- **DNS rebinding protection is now armed by default on the HTTP transport.** `enableDnsRebindingProtection` was only passed when `ELFA_MCP_ALLOWED_ORIGINS` was set, and that variable is unset in the documented local run (`ELFA_MCP_TRANSPORT=http npx -y @elfa-ai/mcp`), so the control shipped present but disarmed. The transport accepted any `Host` and any `Origin` while holding `ELFA_API_KEY`, which let a page the user visits re-point its own hostname at `127.0.0.1` and reach `tools/list` and `tools/call` at that process's own privilege — including the `auto_*` tools that spend credits. Binding to `127.0.0.1` was never a mitigation, because the victim's browser is already on loopback.
+
+  Setting the origin allowlist did not close it either. `allowedOrigins` was passed but `allowedHosts` never was, and the SDK guards each check with its own `length > 0` test, so `Host` validation never ran. An origin allowlist cannot carry this alone: a rebound request is same-origin and sends no `Origin` header, which leaves `Host` as the only header still naming the attacker's domain.
+
+  Refs GHSA-w48q-cv73-mx4w / CVE-2025-66414. Reported by mcpdone.
+
+### Added
+
+- **`ELFA_MCP_ALLOWED_HOSTS`**, a comma separated `Host` allowlist. It defaults to the loopback names the server binds — `ELFA_MCP_HOST:PORT`, `localhost:PORT` and `127.0.0.1:PORT` — so the documented local run is closed with no configuration.
+
+### Changed
+
+- **Action required for hosted deployments.** The host allowlist fails closed, so a deployment answering on any `Host` other than the loopback names the server binds now returns `403` until it sets `ELFA_MCP_ALLOWED_HOSTS`. That covers a public domain, a reverse proxy, and a container that maps the port to a different one than the server binds, since the default is derived from `ELFA_MCP_PORT`.
+
+  A minor rather than a major, because nothing about the interaction with this server changes: the eleven tools, their arguments, the stdio transport and every client-facing contract are untouched. A self-hosted HTTP deployment needs one environment variable.
+
+  **Migration:** set `ELFA_MCP_ALLOWED_HOSTS` to the host values the deployment serves, for example `ELFA_MCP_ALLOWED_HOSTS=mcp.example.com`. The stdio transport is unaffected and needs no change.
+
+## 4.0.0
+
+### Removed
+
+- **`ELFA_HMAC_SECRET` and request signing are gone.** Elfa no longer documents HMAC signing for `/v2/auto/*` — the API key alone authenticates every route, including mutations. Removed here: the `ELFA_HMAC_SECRET` environment variable, the `x-elfa-hmac-secret` request header on the HTTP transport, the `elfa_hmac_secret` field in the Claude Desktop bundle, and the registry entry in `server.json`.
+
+  **Migration:** unset `ELFA_HMAC_SECRET` and stop sending `x-elfa-hmac-secret`. Neither is read any more. Nothing replaces them.
+
+- **The client-side signing gate is gone.** `auto_query_write` and `auto_draft` no longer inspect a query's action shape and pre-reject it before sending. Every action type Elfa documents for API-key Auto — `notify`, `telegram_bot`, `webhook`, `llm` — is accepted with the API key alone, so the gate could only produce false rejections.
+
+- **`hmacEnabled` is no longer reported by `api_status`.** The field was removed from the key-status response, so surfacing it would report something the API no longer sends.
+
+- **`pacifica` is no longer a valid `auto_validate` exchange.** The documented enum for `method=symbol` is now `hyperliquid`, `gmx`, `binance`.
+
+### Changed
+
+- **Spec refreshed to `2.6.3`** from `2.5.0`. A credit is now $0.0145, so the x402 reference prices move to $0.0145 (1 credit), $0.0725 (5 credits) and $0.261 (18 credits). Accounts already on PAYG keep $0.009 per credit until 28 September 2026, 16:00 UTC.
+- **`getMarketEvents-v2` is recorded as deliberately unexposed.** It is limited to select Enterprise customers and the published operation takes no parameters, so there is no usable tool surface. Eleven tools, unchanged.
+- Install troubleshooting no longer claims a `403` on an Auto call means Auto is not enabled in the portal. There is no separate Auto enablement step; a new API key can call `/v2/auto/*` immediately.
+- `SECURITY.md` now states that the API key is read from the environment on stdio and can arrive per request as `x-elfa-api-key` over HTTP, and refers to the tools by their current names.
+
+## 3.0.0
+
+### Removed
+
+- **The `auto_exchanges` tool is gone.** Exchange connections are no longer part of the documented Auto surface, so listing, connecting and disconnecting venues is no longer exposed here. The three operations are recorded in `manifest.json` under `unexposed`, so the drift check still accounts for every documented `/v2` operation. The endpoints remain reachable over the API for anyone who needs them.
+
+### Changed
+
+- **`validate_symbol` moved to `auto_validate`.** It is now `auto_validate` with `method=symbol`, taking `exchange` and `symbol`, and returns `valid: true/false` with the unsupported case reported as a validation error. The default `method=query` behaviour is unchanged.
+- **Eleven tools**, down from twelve.
+- Signing guidance everywhere — server instructions, `auto_query_write`, README, install docs, the desktop bundle and the registry entry — now describes `ELFA_HMAC_SECRET` as signing Auto mutations that are not plain notifications, rather than exchange linking and order placement.
+
 ## 2.0.0
 
 ### Changed

package/README.md

@@ -48,7 +48,6 @@ Ask *"what's trending in crypto right now?"* to confirm it works.
 | Variable | Required | Purpose |
 | --- | --- | --- |
 | `ELFA_API_KEY` | yes | Authenticates every request |
-| `ELFA_HMAC_SECRET` | no | Signs Auto requests. Needed only to connect an exchange, or to run a query whose action places an order |
 | `ELFA_TIMEOUT` | no | Request timeout in ms, default `120000` |
 | `ELFA_RETRIES` | no | Retries on failure, default `0` |
 | `ELFA_MCP_MAX_RESPONSE_CHARS` | no | Response size ceiling, default `60000` |
@@ -58,31 +57,29 @@ The timeout is high and retries are off on purpose. The interpretation endpoints
 
 Some MCP clients apply their own timeout, often around 60 seconds. `narratives` and `market_chat` can exceed that; the request still completes and is still charged, even if the client gives up first.
 
-Without `ELFA_HMAC_SECRET` everything still works except exchange linking and order-placing queries — those return a message telling you what to set.
-
 ## Tools
 
 <!-- tools:start -->
 
-12 tools, mapped to every documented `/v2` operation.
+11 tools, mapped to every documented `/v2` operation.
 
 | Tool | Mode | Cost | What it does |
 | --- | --- | --- | --- |
 | `api_status` | read | Free | Check API key tier, credit usage and remaining requests. Also confirms the API is reachable. |
-| `mentions` | read | 1 per call | Social mentions from X and Telegram. mode=top ranks a ticker's mentions by engagement, mode=search filters by keyword or account, mode=news returns the token news feed. |
+| `mentions` | read | 1 per call | Social mentions from X and Telegram. mode=top ranks a ticker's mentions by engagement, mode=search filters by keyword or account, mode=news returns the token news feed, which is X posts from accounts tagged as news sources rather than articles from news outlets. |
 | `trending` | read | 1 per call | What is gaining social attention. scope=tokens for tickers, scope=contracts_twitter or scope=contracts_telegram for contract addresses. |
 | `narratives` | read | 5 per call | Written narrative analysis with source links. scope=market extracts market-wide narratives, scope=keywords summarises events for specific keywords. |
-| `account_stats` | read | 1 per call | Smart follower and engagement stats for an X account. |
+| `account_stats` | read | 1 per call | Smart follower and engagement stats for an X account. Legacy: it still works, but will be removed on 28 October 2026. |
 | `market_chat` | read | Varies by speed | Ask for written market analysis. Supports conversational chat, macro overview, quick summary, token intro, token analysis and account analysis. |
 | `auto_build` | read | 1 plus LLM usage | Turn a plain-language monitoring request into an EQL query. Returns a draft to validate and activate, it does not activate anything itself. |
-| `auto_validate` | read | Free | Check EQL syntax and get a cost estimate before activating. Accepts an inline query or a draft id. |
+| `auto_validate` | read | Free | Check EQL syntax and get a cost estimate before activating, or check that a symbol has market data on a venue. |
 | `auto_query` | read | Free | Read side of Auto: list queries, poll one query, and read its executions and LLM sessions. |
 | `auto_query_write` | write | 5 plus LLM usage to create, free to cancel or delete | Activate, cancel or delete an Auto query. Activated queries run unattended and fire their action when conditions are met. |
 | `auto_draft` | write | Free, except convert which costs the same as creating a query | Manage inactive Auto drafts. Drafts do not evaluate until converted into an active query. |
-| `auto_exchanges` | write | Free | List, connect and disconnect the exchange accounts Auto uses for order actions, and check whether a symbol is tradeable. |
 
 Not exposed as tools:
 
+- `getMarketEvents-v2` — Available only to select Enterprise customers, and the published operation takes no parameters. Contact sales@elfa.ai for access.
 - `chat-stream-v2` — A tool call returns one result, so streaming adds nothing. market_chat covers the same analysis.
 - `auto-stream-queries-v2` — Long lived streams have no tool equivalent. Poll with auto_query.
 - `auto-stream-query-v2` — Long lived streams have no tool equivalent. Poll with auto_query.
@@ -114,18 +111,7 @@ The flow is three steps:
 2. `auto_validate` — check the syntax and get the credit cost
 3. `auto_query_write` — activate it
 
-Actions can notify you, call a webhook, message a Telegram bot, run an LLM analysis, or place an order on a connected exchange. Order actions need `ELFA_HMAC_SECRET` and a connected exchange.
-
-### Connecting an exchange
-
-| Venue | Connect from here | Credentials |
-| --- | --- | --- |
-| `binance` | yes | `apiKey`, `secret` |
-| `pacifica` | yes | `privateKey`, `walletAddress` |
-| `hyperliquid` | no, wallet is set up in the Elfa app | none |
-| `gmx` | no, wallet is set up in the Elfa app | none |
-
-Credentials are verified on connect, so a wrong value fails there rather than when an order fires. They are ordinary tool arguments, so they pass through the model and land in the client's transcript.
+Actions can notify you, call a webhook, message a Telegram bot, or run an LLM analysis.
 
 There is no push channel over MCP. Poll `auto_query` with `method=get`, and wait for the returned `pollAfterSeconds` between calls.
 
@@ -137,14 +123,32 @@ The same server runs over Streamable HTTP for hosted deployments:
 ELFA_MCP_TRANSPORT=http ELFA_MCP_PORT=3000 npx -y @elfa-ai/mcp
 ```
 
-It is stateless — no sessions, one server instance per request, safe behind a load balancer. Credentials come from `x-elfa-api-key` and `x-elfa-hmac-secret` request headers, falling back to the environment. Set `ELFA_MCP_ALLOWED_ORIGINS` to a comma separated allowlist when exposing it publicly.
+It is stateless — no sessions, one server instance per request, safe behind a load balancer. Credentials come from the `x-elfa-api-key` request header, falling back to the environment.
+
+DNS rebinding protection is on by default. The server accepts only the loopback names it binds — `localhost:PORT` and `127.0.0.1:PORT` — which covers the local run above and nothing else. Any deployment that answers on a different `Host` must list the values it serves:
+
+```bash
+ELFA_MCP_ALLOWED_HOSTS=mcp.example.com
+```
+
+That includes a public domain, a reverse proxy, and a container that maps the port to a different one than the server binds. A `Host` the list does not cover is rejected with 403.
+
+| Variable | Required | Purpose |
+| --- | --- | --- |
+| `ELFA_MCP_TRANSPORT` | no | `http` to serve over Streamable HTTP, default `stdio` |
+| `ELFA_MCP_HOST` | no | Bind address, default `127.0.0.1` |
+| `ELFA_MCP_PORT` | no | Bind port, default `3000` |
+| `ELFA_MCP_ALLOWED_HOSTS` | no | Comma separated `Host` allowlist, defaults to the loopback names bound |
+| `ELFA_MCP_ALLOWED_ORIGINS` | no | Comma separated `Origin` allowlist |
+
+Set `ELFA_MCP_ALLOWED_ORIGINS` as well when browsers call the server directly. It complements the host allowlist rather than replacing it: a rebound request is same origin, so it carries no `Origin` header for that list to check, and the `Host` header is the only one still naming the attacker's domain.
 
 ## Safety
 
 `api_status` is the fastest way to tell an auth problem from a credit problem.
 
 
-Mentions, news and narratives return third-party social text that anyone can write. The server marks it as untrusted in every response, and the server instructions tell the model to treat it as data. Keep that in mind before letting an agent chain from that content into `auto_query_write` or `auto_exchanges`.
+Mentions, news and narratives return third-party social text that anyone can write. The server marks it as untrusted in every response, and the server instructions tell the model to treat it as data. Keep that in mind before letting an agent chain from that content into `auto_query_write`.
 
 ## Development
 

package/dist/index.js

@@ -18,11 +18,8 @@ function messageOf(error) {
   if (typeof error === "string") return error;
   return "Unknown error";
 }
-function missingCredential(what) {
-  if (what === "apiKey") {
-    return `No Elfa API key configured. Set ELFA_API_KEY in the MCP server environment, or send it as an x-elfa-api-key header when using the HTTP transport. Get a key at ${DOCS}.`;
-  }
-  return `This action requires request signing. Set ELFA_HMAC_SECRET in the MCP server environment, then retry. Notification-only Auto queries work without it. See ${DOCS}/auto/api-key-auth.`;
+function missingCredential() {
+  return `No Elfa API key configured. Set ELFA_API_KEY in the MCP server environment, or send it as an x-elfa-api-key header when using the HTTP transport. Get a key at ${DOCS}.`;
 }
 function describeError(error) {
   const status = statusOf(error);
@@ -31,7 +28,7 @@ function describeError(error) {
     case 400:
       return `Request rejected as invalid: ${detail}. Check the argument values and retry.`;
     case 401:
-      return `Authentication failed: ${detail}. Verify ELFA_API_KEY, and ELFA_HMAC_SECRET if this action requires signing.`;
+      return `Authentication failed: ${detail}. Verify ELFA_API_KEY.`;
     case 402:
       return `Out of credits: ${detail}. Top up or upgrade the plan, then retry.`;
     case 403:
@@ -60,21 +57,18 @@ var CredentialError = class extends Error {
 };
 function buildDeps(config, overrides = {}) {
   const apiKey = overrides.apiKey ?? config.apiKey;
-  const hmacSecret = overrides.hmacSecret ?? config.hmacSecret;
   if (!apiKey) {
-    throw new CredentialError(missingCredential("apiKey"));
+    throw new CredentialError(missingCredential());
   }
   const sdk = new ElfaSDK({
     elfaApiKey: apiKey,
     timeout: config.timeout,
     retries: config.retries,
-    ...hmacSecret ? { hmacSecret } : {},
     ...config.baseUrl ? { baseUrl: config.baseUrl } : {},
     ...config.extraHeaders ? { headers: config.extraHeaders } : {}
   });
   return {
     sdk,
-    hasHmac: Boolean(hmacSecret),
     maxResponseChars: config.maxResponseChars
   };
 }
@@ -125,8 +119,8 @@ function loadConfig(env = process.env) {
     port: num(env.ELFA_MCP_PORT, DEFAULT_PORT),
     host: env.ELFA_MCP_HOST || DEFAULT_HOST,
     allowedOrigins: list(env.ELFA_MCP_ALLOWED_ORIGINS),
+    allowedHosts: list(env.ELFA_MCP_ALLOWED_HOSTS),
     apiKey: env.ELFA_API_KEY || void 0,
-    hmacSecret: env.ELFA_HMAC_SECRET || void 0,
     baseUrl: env.ELFA_BASE_URL || void 0,
     extraHeaders: headers(env.ELFA_EXTRA_HEADERS),
     timeout: num(env.ELFA_TIMEOUT, DEFAULT_TIMEOUT),
@@ -148,10 +142,10 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 // package.json
 var package_default = {
   name: "@elfa-ai/mcp",
-  version: "2.0.0",
+  version: "4.1.0",
   description: "Model Context Protocol server for the Elfa API - crypto social intelligence and the Auto condition engine",
   license: "MIT",
-  author: "Elfa Team",
+  author: "Elfa AI",
   type: "module",
   mcpName: "ai.elfa/mcp",
   main: "dist/index.js",
@@ -337,29 +331,6 @@ function pickDefined(input) {
   }
   return out;
 }
-var NOTIFICATION_ACTIONS = /* @__PURE__ */ new Set(["notify", "telegram_bot", "webhook"]);
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isNotificationAction(action) {
-  if (!isRecord(action)) return false;
-  if (typeof action.type !== "string") return false;
-  if (NOTIFICATION_ACTIONS.has(action.type)) return true;
-  if (action.type === "llm") {
-    if (!isRecord(action.params)) return false;
-    if (!isRecord(action.params.callback)) return false;
-    const callbackAction = action.params.callback.action;
-    if (!isRecord(callbackAction)) return false;
-    return typeof callbackAction.type === "string" && NOTIFICATION_ACTIONS.has(callbackAction.type);
-  }
-  return false;
-}
-function requiresSignature(query) {
-  if (!isRecord(query)) return true;
-  const actions = query.actions;
-  if (!Array.isArray(actions) || actions.length === 0) return true;
-  return !actions.every(isNotificationAction);
-}
 
 // src/tools/account.ts
 function registerAccountStats(server, deps) {
@@ -367,7 +338,7 @@ function registerAccountStats(server, deps) {
     "account_stats",
     {
       title: "Account stats",
-      description: "Smart follower and engagement stats for an X account. 1 credit per call. Use it to judge whether an account's reach is real before weighting what it posts.",
+      description: "Smart follower and engagement stats for an X account. 1 credit per call. Use it to judge whether an account's reach is real before weighting what it posts. Returns raw metrics, not a reputation score, so the signal is in the ratios. Legacy: it still works today and keeps working until 28 October 2026, when it will be removed, and it is not being extended before then. Build new work on mentions with mode=search, which returns the posting account alongside each post's engagement metrics.",
       inputSchema: {
         username: z2.string().describe("X username, with or without the @.")
       },
@@ -486,9 +457,6 @@ function registerAutoDraft(server, deps) {
         if (!args.query) {
           return fail("method=upsert needs a query. Build one with auto_build.");
         }
-        if (requiresSignature(args.query) && !deps.hasHmac) {
-          return fail(missingCredential("hmacSecret"));
-        }
       }
       const needsId = args.method === "get" || args.method === "delete" || args.method === "convert";
       if (needsId && !args.draftId) {
@@ -541,98 +509,8 @@ function registerAutoDraft(server, deps) {
   );
 }
 
-// src/tools/autoExchanges.ts
-import { z as z5 } from "zod";
-var EXCHANGES = ["hyperliquid", "gmx", "binance", "pacifica"];
-function registerAutoExchanges(server, deps) {
-  server.registerTool(
-    "auto_exchanges",
-    {
-      title: "Auto exchange connections",
-      description: "The exchange accounts Auto uses when a query's action places an order. Free. method=validate_symbol checks a symbol is tradeable before you build a query around it. Connecting and disconnecting change what Auto can trade with, so confirm with the user first, and both need request signing. binance and pacifica connect from here with credentials. hyperliquid and gmx use a wallet set up in the Elfa app, so use method=list to confirm those rather than trying to connect them.",
-      inputSchema: {
-        method: z5.enum(["list", "connect", "disconnect", "validate_symbol"]).describe("Which action to perform."),
-        exchange: z5.enum(EXCHANGES).optional().describe("Required for connect, disconnect and validate_symbol."),
-        symbol: z5.string().optional().describe("Required for method=validate_symbol."),
-        credentialType: z5.string().optional().describe(
-          "Credential type for method=connect, as documented per venue. Read it off an existing connection with method=list if you are unsure."
-        ),
-        metadata: z5.record(z5.unknown()).optional().describe("Non-secret connection metadata for method=connect."),
-        credentials: z5.record(z5.unknown()).optional().describe(
-          "Venue credentials for method=connect. binance needs apiKey and secret, pacifica needs privateKey and walletAddress. They are verified on connect, so a wrong value fails here rather than at trade time. They also pass through the conversation and are written to the client transcript, so tell the user that before asking for them."
-        )
-      },
-      outputSchema: {
-        method: z5.string(),
-        data: z5.unknown()
-      },
-      annotations: {
-        readOnlyHint: false,
-        destructiveHint: true,
-        idempotentHint: false,
-        openWorldHint: false
-      }
-    },
-    async (args) => {
-      const needsExchange = args.method !== "list";
-      if (needsExchange && !args.exchange) {
-        return fail(
-          `method=${args.method} needs exchange, one of ${EXCHANGES.join(", ")}.`
-        );
-      }
-      if (args.method === "validate_symbol" && !args.symbol) {
-        return fail('method=validate_symbol needs symbol, for example symbol: "BTC".');
-      }
-      if ((args.method === "connect" || args.method === "disconnect") && !deps.hasHmac) {
-        return fail(missingCredential("hmacSecret"));
-      }
-      if (args.method === "connect" && !args.credentialType) {
-        return fail(
-          "method=connect needs credentialType. See https://docs.elfa.ai/auto/trading-execution for the value each venue expects."
-        );
-      }
-      return run(deps, async () => {
-        switch (args.method) {
-          case "connect":
-            return {
-              method: args.method,
-              data: await deps.sdk.auto.connectExchange(
-                pickDefined({
-                  exchange: args.exchange,
-                  credentialType: args.credentialType,
-                  metadata: args.metadata,
-                  credentials: args.credentials
-                })
-              )
-            };
-          case "disconnect":
-            return {
-              method: args.method,
-              data: await deps.sdk.auto.disconnectExchange(
-                args.exchange
-              )
-            };
-          case "validate_symbol":
-            return {
-              method: args.method,
-              data: await deps.sdk.auto.validateSymbol(
-                args.exchange,
-                args.symbol
-              )
-            };
-          default:
-            return {
-              method: "list",
-              data: await deps.sdk.auto.listExchanges()
-            };
-        }
-      });
-    }
-  );
-}
-
 // src/tools/autoQuery.ts
-import { z as z6 } from "zod";
+import { z as z5 } from "zod";
 var ACTIVE = /* @__PURE__ */ new Set(["active", "pending", "running", "armed"]);
 function registerAutoQuery(server, deps) {
   server.registerTool(
@@ -641,7 +519,7 @@ function registerAutoQuery(server, deps) {
       title: "Read Auto queries",
       description: "Read side of Auto. Free. method=list browses queries, method=get polls one query and returns its latest evaluation, method=executions and method=execution show what fired, method=sessions and method=session return the LLM analysis attached to a query. There is no push channel here, poll with method=get and respect pollAfterSeconds.",
       inputSchema: {
-        method: z6.enum([
+        method: z5.enum([
           "list",
           "get",
           "executions",
@@ -649,19 +527,19 @@ function registerAutoQuery(server, deps) {
           "sessions",
           "session"
         ]).describe("Which read to perform."),
-        queryId: z6.string().optional().describe("Required for get, sessions and session."),
-        sessionId: z6.string().optional().describe("Required for method=session."),
-        executionId: z6.string().optional().describe("Required for method=execution."),
-        status: z6.string().optional().describe("Filter by status."),
-        type: z6.string().optional().describe("Filter executions by type."),
-        search: z6.string().optional().describe("Free text filter for method=list."),
-        limit: z6.number().int().min(1).max(50).default(10).describe("Page size for list style methods."),
-        offset: z6.number().int().min(0).default(0).describe("Pagination offset.")
+        queryId: z5.string().optional().describe("Required for get, sessions and session."),
+        sessionId: z5.string().optional().describe("Required for method=session."),
+        executionId: z5.string().optional().describe("Required for method=execution."),
+        status: z5.string().optional().describe("Filter by status."),
+        type: z5.string().optional().describe("Filter executions by type."),
+        search: z5.string().optional().describe("Free text filter for method=list."),
+        limit: z5.number().int().min(1).max(50).default(10).describe("Page size for list style methods."),
+        offset: z5.number().int().min(0).default(0).describe("Pagination offset.")
       },
       outputSchema: {
-        method: z6.string(),
-        data: z6.unknown(),
-        pollAfterSeconds: z6.number().nullable()
+        method: z5.string(),
+        data: z5.unknown(),
+        pollAfterSeconds: z5.number().nullable()
       },
       annotations: {
         readOnlyHint: true,
@@ -740,25 +618,25 @@ function registerAutoQuery(server, deps) {
 }
 
 // src/tools/autoQueryWrite.ts
-import { z as z7 } from "zod";
+import { z as z6 } from "zod";
 function registerAutoQueryWrite(server, deps) {
   server.registerTool(
     "auto_query_write",
     {
       title: "Write Auto queries",
-      description: "Activate, cancel or delete an Auto query. Creating costs 5 credits plus LLM usage, cancel and delete are free. An activated query runs unattended and fires its action without asking again, so validate it with auto_validate and confirm the cost and the action with the user before calling this. Queries whose action places an order also need request signing.",
+      description: "Activate, cancel or delete an Auto query. Creating costs 5 credits plus LLM usage, cancel and delete are free. An activated query runs unattended and fires its action without asking again, so validate it with auto_validate and confirm the cost and the action with the user before calling this.",
       inputSchema: {
-        method: z7.enum(["create", "cancel", "delete"]).describe(
+        method: z6.enum(["create", "cancel", "delete"]).describe(
           "create activates a new query. cancel stops an active one. delete removes one that has already finished."
         ),
         query: eqlQueryArg.optional(),
-        title: z7.string().max(120).optional().describe("Short title shown in the notification when this fires."),
-        description: z7.string().max(500).optional().describe("Why this was set up, shown alongside the title."),
-        queryId: z7.string().optional().describe("Required for cancel and delete.")
+        title: z6.string().max(120).optional().describe("Short title shown in the notification when this fires."),
+        description: z6.string().max(500).optional().describe("Why this was set up, shown alongside the title."),
+        queryId: z6.string().optional().describe("Required for cancel and delete.")
       },
       outputSchema: {
-        method: z7.string(),
-        data: z7.unknown()
+        method: z6.string(),
+        data: z6.unknown()
       },
       annotations: {
         readOnlyHint: false,
@@ -772,9 +650,6 @@ function registerAutoQueryWrite(server, deps) {
         if (!args.query) {
           return fail("method=create needs a query. Build one with auto_build.");
         }
-        if (requiresSignature(args.query) && !deps.hasHmac) {
-          return fail(missingCredential("hmacSecret"));
-        }
       } else if (!args.queryId) {
         return fail(`method=${args.method} needs queryId. Find one with auto_query.`);
       }
@@ -797,25 +672,29 @@ function registerAutoQueryWrite(server, deps) {
 }
 
 // src/tools/autoValidate.ts
-import { z as z8 } from "zod";
+import { z as z7 } from "zod";
+var EXCHANGES = ["hyperliquid", "gmx", "binance"];
 function registerAutoValidate(server, deps) {
   server.registerTool(
     "auto_validate",
     {
       title: "Validate Auto query",
-      description: "Check EQL syntax and get a cost estimate before anything is activated. Free. Always run this before auto_query_write, and show the estimated cost to the user. Pass either an inline query or a draftId.",
+      description: "Check EQL syntax and get a cost estimate before anything is activated. Free. Always run this before auto_query_write, and show the estimated cost to the user. Pass either an inline query or a draftId. method=symbol instead checks that a symbol has market data on a venue, before you build price or ta conditions around it.",
       inputSchema: {
+        method: z7.enum(["query", "symbol"]).default("query").describe("query validates EQL, symbol checks symbol support."),
         query: eqlQueryArg.optional(),
-        draftId: z8.string().optional().describe("Validate a stored draft instead of an inline query."),
-        title: z8.string().max(120).optional().describe("Title to validate with the query."),
-        description: z8.string().max(500).optional().describe("Description to validate with the query.")
+        draftId: z7.string().optional().describe("Validate a stored draft instead of an inline query."),
+        title: z7.string().max(120).optional().describe("Title to validate with the query."),
+        description: z7.string().max(500).optional().describe("Description to validate with the query."),
+        exchange: z7.enum(EXCHANGES).optional().describe("Required for method=symbol."),
+        symbol: z7.string().optional().describe('Required for method=symbol, for example "BTC".')
       },
       outputSchema: {
-        valid: z8.boolean(),
-        errors: z8.array(z8.unknown()),
-        warnings: z8.array(z8.unknown()),
-        estimatedCredits: z8.number().nullable(),
-        estimatedCost: z8.record(z8.unknown()).nullable()
+        valid: z7.boolean(),
+        errors: z7.array(z7.unknown()),
+        warnings: z7.array(z7.unknown()),
+        estimatedCredits: z7.number().nullable(),
+        estimatedCost: z7.record(z7.unknown()).nullable()
       },
       annotations: {
         readOnlyHint: true,
@@ -825,6 +704,26 @@ function registerAutoValidate(server, deps) {
       }
     },
     async (args) => {
+      if (args.method === "symbol") {
+        if (!args.exchange || !args.symbol) {
+          return fail(
+            `method=symbol needs exchange, one of ${EXCHANGES.join(", ")}, and symbol.`
+          );
+        }
+        const exchange = args.exchange;
+        const symbol = args.symbol;
+        return run(deps, async () => {
+          const response = await deps.sdk.auto.validateSymbol(exchange, symbol);
+          const supported = response.supported === "true";
+          return {
+            valid: supported,
+            errors: supported ? [] : [`${symbol} has no market data on ${exchange}.`],
+            warnings: [],
+            estimatedCredits: null,
+            estimatedCost: null
+          };
+        });
+      }
       if (!args.query && !args.draftId) {
         return fail("Pass either query or draftId. Retry with one of them set.");
       }
@@ -849,7 +748,7 @@ function registerAutoValidate(server, deps) {
 }
 
 // src/tools/chat.ts
-import { z as z9 } from "zod";
+import { z as z8 } from "zod";
 function registerChat(server, deps) {
   server.registerTool(
     "market_chat",
@@ -857,7 +756,7 @@ function registerChat(server, deps) {
       title: "Market chat",
       description: "Ask Elfa for written market analysis grounded in its social data. Costs credits and varies by speed, so fast is the cheaper option. Pass sessionId from a previous reply to continue the same conversation.",
       inputSchema: {
-        analysisType: z9.enum([
+        analysisType: z8.enum([
           "chat",
           "macro",
           "summary",
@@ -867,20 +766,20 @@ function registerChat(server, deps) {
         ]).default("chat").describe(
           "chat needs message. tokenIntro and tokenAnalysis need symbol, or chain plus contractAddress. accountAnalysis needs username. macro and summary need nothing else."
         ),
-        message: z9.string().optional().describe("The question, required for analysisType=chat."),
-        sessionId: z9.string().optional().describe("Continue an earlier conversation."),
-        speed: z9.enum(["fast", "expert", "adaptive"]).default("fast").describe(
+        message: z8.string().optional().describe("The question, required for analysisType=chat."),
+        sessionId: z8.string().optional().describe("Continue an earlier conversation."),
+        speed: z8.enum(["fast", "expert", "adaptive"]).default("fast").describe(
           "Defaults to fast, which is cheaper and shallower. Ask for expert when the answer needs deeper reasoning."
         ),
-        symbol: z9.string().optional().describe("Token symbol, for token analysis."),
-        chain: z9.string().optional().describe("Chain, paired with contractAddress."),
-        contractAddress: z9.string().optional().describe("Contract address, paired with chain."),
-        username: z9.string().optional().describe("X username, for analysisType=accountAnalysis.")
+        symbol: z8.string().optional().describe("Token symbol, for token analysis."),
+        chain: z8.string().optional().describe("Chain, paired with contractAddress."),
+        contractAddress: z8.string().optional().describe("Contract address, paired with chain."),
+        username: z8.string().optional().describe("X username, for analysisType=accountAnalysis.")
       },
       outputSchema: {
-        message: z9.string(),
-        sessionId: z9.string().nullable(),
-        creditsConsumed: z9.number().nullable()
+        message: z8.string(),
+        sessionId: z8.string().nullable(),
+        creditsConsumed: z8.number().nullable()
       },
       annotations: {
         readOnlyHint: true,
@@ -929,40 +828,40 @@ function registerChat(server, deps) {
 }
 
 // src/tools/mentions.ts
-import { z as z10 } from "zod";
+import { z as z9 } from "zod";
 function registerMentions(server, deps) {
   server.registerTool(
     "mentions",
     {
       title: "Mentions",
-      description: "Social mentions from X and Telegram. 1 credit per call. Returns engagement metrics and a link per post, not the post text. mode=top ranks one ticker's mentions by engagement. mode=search filters by keywords or by account. mode=news returns the token news feed.",
+      description: "Social mentions from X and Telegram. 1 credit per call. Returns engagement metrics and a link per post, not the post text. mode=top ranks one ticker's mentions by engagement. mode=search filters by keywords or by account. mode=news returns the token news feed, which is X posts from accounts tagged as news sources rather than articles from news outlets.",
       inputSchema: {
-        mode: z10.enum(["top", "search", "news"]).describe(
+        mode: z9.enum(["top", "search", "news"]).describe(
           "top needs ticker. search needs keywords or accountName. news is a feed and needs neither."
         ),
-        ticker: z10.string().optional().describe('Ticker for mode=top, for example "BTC" or "$SOL".'),
-        keywords: z10.string().optional().describe("Up to 5 comma separated keywords for mode=search."),
-        accountName: z10.string().optional().describe("X username for mode=search, without the @."),
-        coinIds: z10.string().optional().describe("Comma separated CoinGecko coin ids to filter mode=news."),
-        searchType: z10.enum(["and", "or"]).optional().describe("How multiple keywords combine in mode=search."),
+        ticker: z9.string().optional().describe('Ticker for mode=top, for example "BTC" or "$SOL".'),
+        keywords: z9.string().optional().describe("Up to 5 comma separated keywords for mode=search."),
+        accountName: z9.string().optional().describe("X username for mode=search, without the @."),
+        coinIds: z9.string().optional().describe("Comma separated CoinGecko coin ids to filter mode=news."),
+        searchType: z9.enum(["and", "or"]).optional().describe("How multiple keywords combine in mode=search."),
         timeWindow: timeWindowArg,
-        from: z10.number().int().optional().describe(
+        from: z9.number().int().optional().describe(
           "Start of an absolute range, unix seconds. Use with to. For mode=search the range must span at least 1 day and at most 30."
         ),
         to: toArg,
         page: pageArg,
         pageSize: pageSizeArg,
-        limit: z10.number().int().min(1).max(30).default(10).describe("Result count for mode=search."),
-        cursor: z10.string().optional().describe("Pagination cursor from a previous mode=search response."),
+        limit: z9.number().int().min(1).max(30).default(10).describe("Result count for mode=search."),
+        cursor: z9.string().optional().describe("Pagination cursor from a previous mode=search response."),
         reposts: repostsArg,
         verbosity: verbosityArg
       },
       outputSchema: {
-        mode: z10.string(),
-        notice: z10.string(),
-        total: z10.number().nullable(),
-        next: z10.string().nullable(),
-        mentions: z10.array(z10.record(z10.unknown()))
+        mode: z9.string(),
+        notice: z9.string(),
+        total: z9.number().nullable(),
+        next: z9.string().nullable(),
+        mentions: z9.array(z9.record(z9.unknown()))
       },
       annotations: {
         readOnlyHint: true,
@@ -1068,7 +967,7 @@ function registerMentions(server, deps) {
 }
 
 // src/tools/narratives.ts
-import { z as z11 } from "zod";
+import { z as z10 } from "zod";
 function registerNarratives(server, deps) {
   server.registerTool(
     "narratives",
@@ -1076,22 +975,22 @@ function registerNarratives(server, deps) {
       title: "Narratives",
       description: "Written narrative analysis with source links, for when counts are not enough. 5 credits per call, so prefer trending or mentions when metrics will do. scope=market extracts the narratives moving the market. scope=keywords summarises events for keywords you supply, and can take over a minute to return.",
       inputSchema: {
-        scope: z11.enum(["market", "keywords"]).default("market").describe("market is a broad sweep. keywords needs the keywords argument."),
-        keywords: z11.string().optional().describe("Up to 5 comma separated keywords for scope=keywords."),
-        searchType: z11.enum(["and", "or"]).optional().describe("How multiple keywords combine for scope=keywords."),
-        timeFrame: z11.enum(["day", "week"]).optional().describe("Lookback for scope=market."),
-        maxNarratives: z11.number().int().min(1).max(20).optional().describe("Cap the narratives returned for scope=market."),
-        maxTweetsPerNarrative: z11.number().int().min(1).max(20).optional().describe("Cap the sources per narrative for scope=market."),
+        scope: z10.enum(["market", "keywords"]).default("market").describe("market is a broad sweep. keywords needs the keywords argument."),
+        keywords: z10.string().optional().describe("Up to 5 comma separated keywords for scope=keywords."),
+        searchType: z10.enum(["and", "or"]).optional().describe("How multiple keywords combine for scope=keywords."),
+        timeFrame: z10.enum(["day", "week"]).optional().describe("Lookback for scope=market."),
+        maxNarratives: z10.number().int().min(1).max(20).optional().describe("Cap the narratives returned for scope=market."),
+        maxTweetsPerNarrative: z10.number().int().min(1).max(20).optional().describe("Cap the sources per narrative for scope=market."),
         timeWindow: timeWindowArg,
         from: fromArg,
         to: toArg
       },
       outputSchema: {
-        scope: z11.string(),
-        notice: z11.string(),
-        items: z11.array(z11.record(z11.unknown())),
-        matched: z11.number().nullable(),
-        note: z11.string().nullable()
+        scope: z10.string(),
+        notice: z10.string(),
+        items: z10.array(z10.record(z10.unknown())),
+        matched: z10.number().nullable(),
+        note: z10.string().nullable()
       },
       annotations: {
         readOnlyHint: true,
@@ -1164,7 +1063,7 @@ function registerNarratives(server, deps) {
 }
 
 // src/tools/status.ts
-import { z as z12 } from "zod";
+import { z as z11 } from "zod";
 var REPORTED = [
   "tier",
   "status",
@@ -1182,7 +1081,6 @@ var REPORTED = [
   "depositCredits",
   "spendCapCredits",
   "athenaEnabled",
-  "hmacEnabled",
   "scopes"
 ];
 function summarise(data) {
@@ -1200,9 +1098,9 @@ function registerStatus(server, deps) {
       description: "Check the Elfa API key tier, credit usage and remaining requests, and confirm the API is reachable. Free. Call this first when a request fails with an auth or credit error.",
       inputSchema: {},
       outputSchema: {
-        reachable: z12.boolean(),
-        key: z12.record(z12.unknown()).nullable(),
-        problem: z12.string().nullable()
+        reachable: z11.boolean(),
+        key: z11.record(z11.unknown()).nullable(),
+        problem: z11.string().nullable()
       },
       annotations: {
         readOnlyHint: true,
@@ -1226,7 +1124,7 @@ function registerStatus(server, deps) {
 }
 
 // src/tools/trending.ts
-import { z as z13 } from "zod";
+import { z as z12 } from "zod";
 function registerTrending(server, deps) {
   server.registerTool(
     "trending",
@@ -1234,22 +1132,22 @@ function registerTrending(server, deps) {
       title: "Trending",
       description: "What is gaining social attention right now. 1 credit per call. scope=tokens returns tickers ranked by mention volume with the change against the previous window. scope=contracts_twitter and scope=contracts_telegram return trending contract addresses.",
       inputSchema: {
-        scope: z13.enum(["tokens", "contracts_twitter", "contracts_telegram"]).default("tokens").describe("Which trending list to return."),
-        timeWindow: z13.string().optional().describe(
+        scope: z12.enum(["tokens", "contracts_twitter", "contracts_telegram"]).default("tokens").describe("Which trending list to return."),
+        timeWindow: z12.string().optional().describe(
           'Relative window such as "24h" or "7d". Defaults to 24h unless both from and to are given.'
         ),
         from: fromArg,
         to: toArg,
         page: pageArg,
         pageSize: pageSizeArg,
-        minMentions: z13.number().int().min(1).default(5).describe("Drop entries below this mention count.")
+        minMentions: z12.number().int().min(1).default(5).describe("Drop entries below this mention count.")
       },
       outputSchema: {
-        scope: z13.string(),
-        page: z13.number().nullable(),
-        pageSize: z13.number().nullable(),
-        total: z13.number().nullable(),
-        items: z13.array(z13.record(z13.unknown()))
+        scope: z12.string(),
+        page: z12.number().nullable(),
+        pageSize: z12.number().nullable(),
+        total: z12.number().nullable(),
+        items: z12.array(z12.record(z12.unknown()))
       },
       annotations: {
         readOnlyHint: true,
@@ -1308,7 +1206,7 @@ var INSTRUCTIONS = `Elfa gives you crypto social intelligence plus Auto, a condi
 
 Start cheap. trending, mentions and account_stats cost 1 credit. narratives costs 5 and market_chat costs more, so reach for them only when metrics are not enough. If a call fails on auth or credits, check api_status.
 
-Auto is a three step flow: auto_build drafts EQL from plain language, auto_validate checks it and returns the cost, auto_query_write activates it. Never activate without showing the user the estimated cost and the action that will fire. Actions that place orders, and connecting an exchange, need ELFA_HMAC_SECRET set.
+Auto is a three step flow: auto_build drafts EQL from plain language, auto_validate checks it and returns the cost, auto_query_write activates it. Never activate without showing the user the estimated cost and the action that will fire.
 
 Auto has no push channel here. Poll auto_query with method=get and wait for pollAfterSeconds between calls.
 
@@ -1329,7 +1227,6 @@ function createServer(deps) {
   registerAutoQuery(server, deps);
   registerAutoQueryWrite(server, deps);
   registerAutoDraft(server, deps);
-  registerAutoExchanges(server, deps);
   return server;
 }
 
@@ -1346,6 +1243,14 @@ function jsonRpcError(res, status, message) {
     id: null
   });
 }
+function defaultAllowedHosts(config) {
+  const hosts = /* @__PURE__ */ new Set();
+  for (const name of [config.host, "localhost", "127.0.0.1", "[::1]"]) {
+    hosts.add(`${name}:${config.port}`);
+    if (config.port === 80) hosts.add(name);
+  }
+  return [...hosts];
+}
 function createHttpApp(config) {
   const app = express();
   app.disable("x-powered-by");
@@ -1372,12 +1277,13 @@ function createHttpApp(config) {
     let transport;
     try {
       const deps = buildDeps(config, {
-        apiKey: header(req, "x-elfa-api-key"),
-        hmacSecret: header(req, "x-elfa-hmac-secret")
+        apiKey: header(req, "x-elfa-api-key")
       });
       server = createServer(deps);
       transport = new StreamableHTTPServerTransport({
-        ...config.allowedOrigins.length > 0 ? { allowedOrigins: config.allowedOrigins, enableDnsRebindingProtection: true } : {}
+        enableDnsRebindingProtection: true,
+        allowedHosts: config.allowedHosts.length > 0 ? config.allowedHosts : defaultAllowedHosts(config),
+        ...config.allowedOrigins.length > 0 ? { allowedOrigins: config.allowedOrigins } : {}
       });
       res.on("close", () => {
         void transport?.close();

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "server": {
     "name": "elfa",
-    "version": "2.0.0",
+    "version": "4.1.0",
     "docs": "https://docs.elfa.ai",
     "spec": "https://docs.elfa.ai/swagger/swagger.json",
     "specScope": "/v2"
@@ -26,7 +26,7 @@
     {
       "name": "mentions",
       "title": "Mentions",
-      "summary": "Social mentions from X and Telegram. mode=top ranks a ticker's mentions by engagement, mode=search filters by keyword or account, mode=news returns the token news feed.",
+      "summary": "Social mentions from X and Telegram. mode=top ranks a ticker's mentions by engagement, mode=search filters by keyword or account, mode=news returns the token news feed, which is X posts from accounts tagged as news sources rather than articles from news outlets.",
       "credits": "1 per call",
       "annotations": {
         "readOnlyHint": true,
@@ -76,7 +76,7 @@
     {
       "name": "account_stats",
       "title": "Account stats",
-      "summary": "Smart follower and engagement stats for an X account.",
+      "summary": "Smart follower and engagement stats for an X account. Legacy: it still works, but will be removed on 28 October 2026.",
       "credits": "1 per call",
       "annotations": {
         "readOnlyHint": true,
@@ -121,7 +121,7 @@
     {
       "name": "auto_validate",
       "title": "Validate Auto query",
-      "summary": "Check EQL syntax and get a cost estimate before activating. Accepts an inline query or a draft id.",
+      "summary": "Check EQL syntax and get a cost estimate before activating, or check that a symbol has market data on a venue.",
       "credits": "Free",
       "annotations": {
         "readOnlyHint": true,
@@ -131,7 +131,8 @@
       },
       "operations": [
         "auto-validate-query-v2",
-        "auto-validate-query-draft-v2"
+        "auto-validate-query-draft-v2",
+        "auto-validate-symbol-v2"
       ]
     },
     {
@@ -189,27 +190,14 @@
         "auto-delete-query-draft-v2",
         "auto-convert-query-draft-v2"
       ]
-    },
-    {
-      "name": "auto_exchanges",
-      "title": "Auto exchange connections",
-      "summary": "List, connect and disconnect the exchange accounts Auto uses for order actions, and check whether a symbol is tradeable.",
-      "credits": "Free",
-      "annotations": {
-        "readOnlyHint": false,
-        "destructiveHint": true,
-        "idempotentHint": false,
-        "openWorldHint": false
-      },
-      "operations": [
-        "auto-list-exchanges-v2",
-        "auto-connect-exchange-v2",
-        "auto-disconnect-exchange-v2",
-        "auto-validate-symbol-v2"
-      ]
     }
   ],
   "unexposed": [
+    {
+      "operationId": "getMarketEvents-v2",
+      "reason": "restricted",
+      "note": "Available only to select Enterprise customers, and the published operation takes no parameters. Contact sales@elfa.ai for access."
+    },
     {
       "operationId": "chat-stream-v2",
       "reason": "sse",

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@elfa-ai/mcp",
-  "version": "2.0.0",
+  "version": "4.1.0",
   "description": "Model Context Protocol server for the Elfa API - crypto social intelligence and the Auto condition engine",
   "license": "MIT",
-  "author": "Elfa Team",
+  "author": "Elfa AI",
   "type": "module",
   "mcpName": "ai.elfa/mcp",
   "main": "dist/index.js",