@elfa-ai/mcp 3.0.0 → 4.1.0

package/CHANGELOG.md

@@ -1,5 +1,48 @@
 # Changelog
 
+## 4.1.0
+
+### Security
+
+- **DNS rebinding protection is now armed by default on the HTTP transport.** `enableDnsRebindingProtection` was only passed when `ELFA_MCP_ALLOWED_ORIGINS` was set, and that variable is unset in the documented local run (`ELFA_MCP_TRANSPORT=http npx -y @elfa-ai/mcp`), so the control shipped present but disarmed. The transport accepted any `Host` and any `Origin` while holding `ELFA_API_KEY`, which let a page the user visits re-point its own hostname at `127.0.0.1` and reach `tools/list` and `tools/call` at that process's own privilege — including the `auto_*` tools that spend credits. Binding to `127.0.0.1` was never a mitigation, because the victim's browser is already on loopback.
+
+  Setting the origin allowlist did not close it either. `allowedOrigins` was passed but `allowedHosts` never was, and the SDK guards each check with its own `length > 0` test, so `Host` validation never ran. An origin allowlist cannot carry this alone: a rebound request is same-origin and sends no `Origin` header, which leaves `Host` as the only header still naming the attacker's domain.
+
+  Refs GHSA-w48q-cv73-mx4w / CVE-2025-66414. Reported by mcpdone.
+
+### Added
+
+- **`ELFA_MCP_ALLOWED_HOSTS`**, a comma separated `Host` allowlist. It defaults to the loopback names the server binds — `ELFA_MCP_HOST:PORT`, `localhost:PORT` and `127.0.0.1:PORT` — so the documented local run is closed with no configuration.
+
+### Changed
+
+- **Action required for hosted deployments.** The host allowlist fails closed, so a deployment answering on any `Host` other than the loopback names the server binds now returns `403` until it sets `ELFA_MCP_ALLOWED_HOSTS`. That covers a public domain, a reverse proxy, and a container that maps the port to a different one than the server binds, since the default is derived from `ELFA_MCP_PORT`.
+
+  A minor rather than a major, because nothing about the interaction with this server changes: the eleven tools, their arguments, the stdio transport and every client-facing contract are untouched. A self-hosted HTTP deployment needs one environment variable.
+
+  **Migration:** set `ELFA_MCP_ALLOWED_HOSTS` to the host values the deployment serves, for example `ELFA_MCP_ALLOWED_HOSTS=mcp.example.com`. The stdio transport is unaffected and needs no change.
+
+## 4.0.0
+
+### Removed
+
+- **`ELFA_HMAC_SECRET` and request signing are gone.** Elfa no longer documents HMAC signing for `/v2/auto/*` — the API key alone authenticates every route, including mutations. Removed here: the `ELFA_HMAC_SECRET` environment variable, the `x-elfa-hmac-secret` request header on the HTTP transport, the `elfa_hmac_secret` field in the Claude Desktop bundle, and the registry entry in `server.json`.
+
+  **Migration:** unset `ELFA_HMAC_SECRET` and stop sending `x-elfa-hmac-secret`. Neither is read any more. Nothing replaces them.
+
+- **The client-side signing gate is gone.** `auto_query_write` and `auto_draft` no longer inspect a query's action shape and pre-reject it before sending. Every action type Elfa documents for API-key Auto — `notify`, `telegram_bot`, `webhook`, `llm` — is accepted with the API key alone, so the gate could only produce false rejections.
+
+- **`hmacEnabled` is no longer reported by `api_status`.** The field was removed from the key-status response, so surfacing it would report something the API no longer sends.
+
+- **`pacifica` is no longer a valid `auto_validate` exchange.** The documented enum for `method=symbol` is now `hyperliquid`, `gmx`, `binance`.
+
+### Changed
+
+- **Spec refreshed to `2.6.3`** from `2.5.0`. A credit is now $0.0145, so the x402 reference prices move to $0.0145 (1 credit), $0.0725 (5 credits) and $0.261 (18 credits). Accounts already on PAYG keep $0.009 per credit until 28 September 2026, 16:00 UTC.
+- **`getMarketEvents-v2` is recorded as deliberately unexposed.** It is limited to select Enterprise customers and the published operation takes no parameters, so there is no usable tool surface. Eleven tools, unchanged.
+- Install troubleshooting no longer claims a `403` on an Auto call means Auto is not enabled in the portal. There is no separate Auto enablement step; a new API key can call `/v2/auto/*` immediately.
+- `SECURITY.md` now states that the API key is read from the environment on stdio and can arrive per request as `x-elfa-api-key` over HTTP, and refers to the tools by their current names.
+
 ## 3.0.0
 
 ### Removed

package/README.md

@@ -48,7 +48,6 @@ Ask *"what's trending in crypto right now?"* to confirm it works.
 | Variable | Required | Purpose |
 | --- | --- | --- |
 | `ELFA_API_KEY` | yes | Authenticates every request |
-| `ELFA_HMAC_SECRET` | no | Signs Auto mutations when signing is required. Notification-only query mutations do not need it |
 | `ELFA_TIMEOUT` | no | Request timeout in ms, default `120000` |
 | `ELFA_RETRIES` | no | Retries on failure, default `0` |
 | `ELFA_MCP_MAX_RESPONSE_CHARS` | no | Response size ceiling, default `60000` |
@@ -58,8 +57,6 @@ The timeout is high and retries are off on purpose. The interpretation endpoints
 
 Some MCP clients apply their own timeout, often around 60 seconds. `narratives` and `market_chat` can exceed that; the request still completes and is still charged, even if the client gives up first.
 
-Without `ELFA_HMAC_SECRET` notification-only Auto mutations still work. Anything else returns a message telling you what to set.
-
 ## Tools
 
 <!-- tools:start -->
@@ -69,10 +66,10 @@ Without `ELFA_HMAC_SECRET` notification-only Auto mutations still work. Anything
 | Tool | Mode | Cost | What it does |
 | --- | --- | --- | --- |
 | `api_status` | read | Free | Check API key tier, credit usage and remaining requests. Also confirms the API is reachable. |
-| `mentions` | read | 1 per call | Social mentions from X and Telegram. mode=top ranks a ticker's mentions by engagement, mode=search filters by keyword or account, mode=news returns the token news feed. |
+| `mentions` | read | 1 per call | Social mentions from X and Telegram. mode=top ranks a ticker's mentions by engagement, mode=search filters by keyword or account, mode=news returns the token news feed, which is X posts from accounts tagged as news sources rather than articles from news outlets. |
 | `trending` | read | 1 per call | What is gaining social attention. scope=tokens for tickers, scope=contracts_twitter or scope=contracts_telegram for contract addresses. |
 | `narratives` | read | 5 per call | Written narrative analysis with source links. scope=market extracts market-wide narratives, scope=keywords summarises events for specific keywords. |
-| `account_stats` | read | 1 per call | Smart follower and engagement stats for an X account. |
+| `account_stats` | read | 1 per call | Smart follower and engagement stats for an X account. Legacy: it still works, but will be removed on 28 October 2026. |
 | `market_chat` | read | Varies by speed | Ask for written market analysis. Supports conversational chat, macro overview, quick summary, token intro, token analysis and account analysis. |
 | `auto_build` | read | 1 plus LLM usage | Turn a plain-language monitoring request into an EQL query. Returns a draft to validate and activate, it does not activate anything itself. |
 | `auto_validate` | read | Free | Check EQL syntax and get a cost estimate before activating, or check that a symbol has market data on a venue. |
@@ -82,12 +79,10 @@ Without `ELFA_HMAC_SECRET` notification-only Auto mutations still work. Anything
 
 Not exposed as tools:
 
+- `getMarketEvents-v2` — Available only to select Enterprise customers, and the published operation takes no parameters. Contact sales@elfa.ai for access.
 - `chat-stream-v2` — A tool call returns one result, so streaming adds nothing. market_chat covers the same analysis.
 - `auto-stream-queries-v2` — Long lived streams have no tool equivalent. Poll with auto_query.
 - `auto-stream-query-v2` — Long lived streams have no tool equivalent. Poll with auto_query.
-- `auto-list-exchanges-v2` — Exchange connections are no longer part of the documented Auto surface.
-- `auto-connect-exchange-v2` — Exchange connections are no longer part of the documented Auto surface.
-- `auto-disconnect-exchange-v2` — Exchange connections are no longer part of the documented Auto surface.
 
 <!-- tools:end -->
 
@@ -128,7 +123,25 @@ The same server runs over Streamable HTTP for hosted deployments:
 ELFA_MCP_TRANSPORT=http ELFA_MCP_PORT=3000 npx -y @elfa-ai/mcp
 ```
 
-It is stateless — no sessions, one server instance per request, safe behind a load balancer. Credentials come from `x-elfa-api-key` and `x-elfa-hmac-secret` request headers, falling back to the environment. Set `ELFA_MCP_ALLOWED_ORIGINS` to a comma separated allowlist when exposing it publicly.
+It is stateless — no sessions, one server instance per request, safe behind a load balancer. Credentials come from the `x-elfa-api-key` request header, falling back to the environment.
+
+DNS rebinding protection is on by default. The server accepts only the loopback names it binds — `localhost:PORT` and `127.0.0.1:PORT` — which covers the local run above and nothing else. Any deployment that answers on a different `Host` must list the values it serves:
+
+```bash
+ELFA_MCP_ALLOWED_HOSTS=mcp.example.com
+```
+
+That includes a public domain, a reverse proxy, and a container that maps the port to a different one than the server binds. A `Host` the list does not cover is rejected with 403.
+
+| Variable | Required | Purpose |
+| --- | --- | --- |
+| `ELFA_MCP_TRANSPORT` | no | `http` to serve over Streamable HTTP, default `stdio` |
+| `ELFA_MCP_HOST` | no | Bind address, default `127.0.0.1` |
+| `ELFA_MCP_PORT` | no | Bind port, default `3000` |
+| `ELFA_MCP_ALLOWED_HOSTS` | no | Comma separated `Host` allowlist, defaults to the loopback names bound |
+| `ELFA_MCP_ALLOWED_ORIGINS` | no | Comma separated `Origin` allowlist |
+
+Set `ELFA_MCP_ALLOWED_ORIGINS` as well when browsers call the server directly. It complements the host allowlist rather than replacing it: a rebound request is same origin, so it carries no `Origin` header for that list to check, and the `Host` header is the only one still naming the attacker's domain.
 
 ## Safety
 

package/dist/index.js

@@ -18,11 +18,8 @@ function messageOf(error) {
   if (typeof error === "string") return error;
   return "Unknown error";
 }
-function missingCredential(what) {
-  if (what === "apiKey") {
-    return `No Elfa API key configured. Set ELFA_API_KEY in the MCP server environment, or send it as an x-elfa-api-key header when using the HTTP transport. Get a key at ${DOCS}.`;
-  }
-  return `This action requires request signing. Set ELFA_HMAC_SECRET in the MCP server environment, then retry. Notification-only Auto queries work without it. See ${DOCS}/auto/api-key-auth.`;
+function missingCredential() {
+  return `No Elfa API key configured. Set ELFA_API_KEY in the MCP server environment, or send it as an x-elfa-api-key header when using the HTTP transport. Get a key at ${DOCS}.`;
 }
 function describeError(error) {
   const status = statusOf(error);
@@ -31,7 +28,7 @@ function describeError(error) {
     case 400:
       return `Request rejected as invalid: ${detail}. Check the argument values and retry.`;
     case 401:
-      return `Authentication failed: ${detail}. Verify ELFA_API_KEY, and ELFA_HMAC_SECRET if this action requires signing.`;
+      return `Authentication failed: ${detail}. Verify ELFA_API_KEY.`;
     case 402:
       return `Out of credits: ${detail}. Top up or upgrade the plan, then retry.`;
     case 403:
@@ -60,21 +57,18 @@ var CredentialError = class extends Error {
 };
 function buildDeps(config, overrides = {}) {
   const apiKey = overrides.apiKey ?? config.apiKey;
-  const hmacSecret = overrides.hmacSecret ?? config.hmacSecret;
   if (!apiKey) {
-    throw new CredentialError(missingCredential("apiKey"));
+    throw new CredentialError(missingCredential());
   }
   const sdk = new ElfaSDK({
     elfaApiKey: apiKey,
     timeout: config.timeout,
     retries: config.retries,
-    ...hmacSecret ? { hmacSecret } : {},
     ...config.baseUrl ? { baseUrl: config.baseUrl } : {},
     ...config.extraHeaders ? { headers: config.extraHeaders } : {}
   });
   return {
     sdk,
-    hasHmac: Boolean(hmacSecret),
     maxResponseChars: config.maxResponseChars
   };
 }
@@ -125,8 +119,8 @@ function loadConfig(env = process.env) {
     port: num(env.ELFA_MCP_PORT, DEFAULT_PORT),
     host: env.ELFA_MCP_HOST || DEFAULT_HOST,
     allowedOrigins: list(env.ELFA_MCP_ALLOWED_ORIGINS),
+    allowedHosts: list(env.ELFA_MCP_ALLOWED_HOSTS),
     apiKey: env.ELFA_API_KEY || void 0,
-    hmacSecret: env.ELFA_HMAC_SECRET || void 0,
     baseUrl: env.ELFA_BASE_URL || void 0,
     extraHeaders: headers(env.ELFA_EXTRA_HEADERS),
     timeout: num(env.ELFA_TIMEOUT, DEFAULT_TIMEOUT),
@@ -148,7 +142,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 // package.json
 var package_default = {
   name: "@elfa-ai/mcp",
-  version: "3.0.0",
+  version: "4.1.0",
   description: "Model Context Protocol server for the Elfa API - crypto social intelligence and the Auto condition engine",
   license: "MIT",
   author: "Elfa AI",
@@ -337,29 +331,6 @@ function pickDefined(input) {
   }
   return out;
 }
-var NOTIFICATION_ACTIONS = /* @__PURE__ */ new Set(["notify", "telegram_bot", "webhook"]);
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isNotificationAction(action) {
-  if (!isRecord(action)) return false;
-  if (typeof action.type !== "string") return false;
-  if (NOTIFICATION_ACTIONS.has(action.type)) return true;
-  if (action.type === "llm") {
-    if (!isRecord(action.params)) return false;
-    if (!isRecord(action.params.callback)) return false;
-    const callbackAction = action.params.callback.action;
-    if (!isRecord(callbackAction)) return false;
-    return typeof callbackAction.type === "string" && NOTIFICATION_ACTIONS.has(callbackAction.type);
-  }
-  return false;
-}
-function requiresSignature(query) {
-  if (!isRecord(query)) return true;
-  const actions = query.actions;
-  if (!Array.isArray(actions) || actions.length === 0) return true;
-  return !actions.every(isNotificationAction);
-}
 
 // src/tools/account.ts
 function registerAccountStats(server, deps) {
@@ -367,7 +338,7 @@ function registerAccountStats(server, deps) {
     "account_stats",
     {
       title: "Account stats",
-      description: "Smart follower and engagement stats for an X account. 1 credit per call. Use it to judge whether an account's reach is real before weighting what it posts.",
+      description: "Smart follower and engagement stats for an X account. 1 credit per call. Use it to judge whether an account's reach is real before weighting what it posts. Returns raw metrics, not a reputation score, so the signal is in the ratios. Legacy: it still works today and keeps working until 28 October 2026, when it will be removed, and it is not being extended before then. Build new work on mentions with mode=search, which returns the posting account alongside each post's engagement metrics.",
       inputSchema: {
         username: z2.string().describe("X username, with or without the @.")
       },
@@ -486,9 +457,6 @@ function registerAutoDraft(server, deps) {
         if (!args.query) {
           return fail("method=upsert needs a query. Build one with auto_build.");
         }
-        if (requiresSignature(args.query) && !deps.hasHmac) {
-          return fail(missingCredential("hmacSecret"));
-        }
       }
       const needsId = args.method === "get" || args.method === "delete" || args.method === "convert";
       if (needsId && !args.draftId) {
@@ -656,7 +624,7 @@ function registerAutoQueryWrite(server, deps) {
     "auto_query_write",
     {
       title: "Write Auto queries",
-      description: "Activate, cancel or delete an Auto query. Creating costs 5 credits plus LLM usage, cancel and delete are free. An activated query runs unattended and fires its action without asking again, so validate it with auto_validate and confirm the cost and the action with the user before calling this. Queries whose action is not a plain notification also need request signing.",
+      description: "Activate, cancel or delete an Auto query. Creating costs 5 credits plus LLM usage, cancel and delete are free. An activated query runs unattended and fires its action without asking again, so validate it with auto_validate and confirm the cost and the action with the user before calling this.",
       inputSchema: {
         method: z6.enum(["create", "cancel", "delete"]).describe(
           "create activates a new query. cancel stops an active one. delete removes one that has already finished."
@@ -682,9 +650,6 @@ function registerAutoQueryWrite(server, deps) {
         if (!args.query) {
           return fail("method=create needs a query. Build one with auto_build.");
         }
-        if (requiresSignature(args.query) && !deps.hasHmac) {
-          return fail(missingCredential("hmacSecret"));
-        }
       } else if (!args.queryId) {
         return fail(`method=${args.method} needs queryId. Find one with auto_query.`);
       }
@@ -708,7 +673,7 @@ function registerAutoQueryWrite(server, deps) {
 
 // src/tools/autoValidate.ts
 import { z as z7 } from "zod";
-var EXCHANGES = ["hyperliquid", "gmx", "binance", "pacifica"];
+var EXCHANGES = ["hyperliquid", "gmx", "binance"];
 function registerAutoValidate(server, deps) {
   server.registerTool(
     "auto_validate",
@@ -869,7 +834,7 @@ function registerMentions(server, deps) {
     "mentions",
     {
       title: "Mentions",
-      description: "Social mentions from X and Telegram. 1 credit per call. Returns engagement metrics and a link per post, not the post text. mode=top ranks one ticker's mentions by engagement. mode=search filters by keywords or by account. mode=news returns the token news feed.",
+      description: "Social mentions from X and Telegram. 1 credit per call. Returns engagement metrics and a link per post, not the post text. mode=top ranks one ticker's mentions by engagement. mode=search filters by keywords or by account. mode=news returns the token news feed, which is X posts from accounts tagged as news sources rather than articles from news outlets.",
       inputSchema: {
         mode: z9.enum(["top", "search", "news"]).describe(
           "top needs ticker. search needs keywords or accountName. news is a feed and needs neither."
@@ -1116,7 +1081,6 @@ var REPORTED = [
   "depositCredits",
   "spendCapCredits",
   "athenaEnabled",
-  "hmacEnabled",
   "scopes"
 ];
 function summarise(data) {
@@ -1242,7 +1206,7 @@ var INSTRUCTIONS = `Elfa gives you crypto social intelligence plus Auto, a condi
 
 Start cheap. trending, mentions and account_stats cost 1 credit. narratives costs 5 and market_chat costs more, so reach for them only when metrics are not enough. If a call fails on auth or credits, check api_status.
 
-Auto is a three step flow: auto_build drafts EQL from plain language, auto_validate checks it and returns the cost, auto_query_write activates it. Never activate without showing the user the estimated cost and the action that will fire. Some Auto mutations need ELFA_HMAC_SECRET set; notification-only ones do not.
+Auto is a three step flow: auto_build drafts EQL from plain language, auto_validate checks it and returns the cost, auto_query_write activates it. Never activate without showing the user the estimated cost and the action that will fire.
 
 Auto has no push channel here. Poll auto_query with method=get and wait for pollAfterSeconds between calls.
 
@@ -1279,6 +1243,14 @@ function jsonRpcError(res, status, message) {
     id: null
   });
 }
+function defaultAllowedHosts(config) {
+  const hosts = /* @__PURE__ */ new Set();
+  for (const name of [config.host, "localhost", "127.0.0.1", "[::1]"]) {
+    hosts.add(`${name}:${config.port}`);
+    if (config.port === 80) hosts.add(name);
+  }
+  return [...hosts];
+}
 function createHttpApp(config) {
   const app = express();
   app.disable("x-powered-by");
@@ -1305,12 +1277,13 @@ function createHttpApp(config) {
     let transport;
     try {
       const deps = buildDeps(config, {
-        apiKey: header(req, "x-elfa-api-key"),
-        hmacSecret: header(req, "x-elfa-hmac-secret")
+        apiKey: header(req, "x-elfa-api-key")
       });
       server = createServer(deps);
       transport = new StreamableHTTPServerTransport({
-        ...config.allowedOrigins.length > 0 ? { allowedOrigins: config.allowedOrigins, enableDnsRebindingProtection: true } : {}
+        enableDnsRebindingProtection: true,
+        allowedHosts: config.allowedHosts.length > 0 ? config.allowedHosts : defaultAllowedHosts(config),
+        ...config.allowedOrigins.length > 0 ? { allowedOrigins: config.allowedOrigins } : {}
       });
       res.on("close", () => {
         void transport?.close();

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "server": {
     "name": "elfa",
-    "version": "3.0.0",
+    "version": "4.1.0",
     "docs": "https://docs.elfa.ai",
     "spec": "https://docs.elfa.ai/swagger/swagger.json",
     "specScope": "/v2"
@@ -26,7 +26,7 @@
     {
       "name": "mentions",
       "title": "Mentions",
-      "summary": "Social mentions from X and Telegram. mode=top ranks a ticker's mentions by engagement, mode=search filters by keyword or account, mode=news returns the token news feed.",
+      "summary": "Social mentions from X and Telegram. mode=top ranks a ticker's mentions by engagement, mode=search filters by keyword or account, mode=news returns the token news feed, which is X posts from accounts tagged as news sources rather than articles from news outlets.",
       "credits": "1 per call",
       "annotations": {
         "readOnlyHint": true,
@@ -76,7 +76,7 @@
     {
       "name": "account_stats",
       "title": "Account stats",
-      "summary": "Smart follower and engagement stats for an X account.",
+      "summary": "Smart follower and engagement stats for an X account. Legacy: it still works, but will be removed on 28 October 2026.",
       "credits": "1 per call",
       "annotations": {
         "readOnlyHint": true,
@@ -193,6 +193,11 @@
     }
   ],
   "unexposed": [
+    {
+      "operationId": "getMarketEvents-v2",
+      "reason": "restricted",
+      "note": "Available only to select Enterprise customers, and the published operation takes no parameters. Contact sales@elfa.ai for access."
+    },
     {
       "operationId": "chat-stream-v2",
       "reason": "sse",
@@ -207,21 +212,6 @@
       "operationId": "auto-stream-query-v2",
       "reason": "sse",
       "note": "Long lived streams have no tool equivalent. Poll with auto_query."
-    },
-    {
-      "operationId": "auto-list-exchanges-v2",
-      "reason": "not-advertised",
-      "note": "Exchange connections are no longer part of the documented Auto surface."
-    },
-    {
-      "operationId": "auto-connect-exchange-v2",
-      "reason": "not-advertised",
-      "note": "Exchange connections are no longer part of the documented Auto surface."
-    },
-    {
-      "operationId": "auto-disconnect-exchange-v2",
-      "reason": "not-advertised",
-      "note": "Exchange connections are no longer part of the documented Auto surface."
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elfa-ai/mcp",
-  "version": "3.0.0",
+  "version": "4.1.0",
   "description": "Model Context Protocol server for the Elfa API - crypto social intelligence and the Auto condition engine",
   "license": "MIT",
   "author": "Elfa AI",