@finchagentic/mcp 4.1.0 → 4.2.0

package/dist/tools/base.js

@@ -4,10 +4,35 @@ exports.BASE_TOOLS = void 0;
 exports.handleBaseTool = handleBaseTool;
 const MORPHO_API = "https://blue-api.morpho.org/graphql";
 const MOONWELL_API = "https://api.moonwell.fi/v1/markets";
+/** Morpho's public API occasionally 403s transiently (rate-limit/WAF blip,
+ * confirmed by hand: identical requests succeed moments later) - one retry
+ * after a short delay clears most of these without adding real latency to
+ * the common case. */
+async function fetchMorphoGql(query) {
+    for (let attempt = 0; attempt < 2; attempt++) {
+        if (attempt > 0)
+            await new Promise((r) => setTimeout(r, 800));
+        const res = await fetch(MORPHO_API, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ query }),
+            signal: AbortSignal.timeout(15000),
+        });
+        if (res.ok)
+            return res.json();
+        if (attempt === 1)
+            throw new Error(`Morpho API error: ${res.status} (after retry)`);
+    }
+}
 exports.BASE_TOOLS = [
     {
         name: "base_mcp_yield_vaults",
-        description: "Find the best yield/earning opportunities on Base chain using Morpho vaults. Returns all vaults ranked by APY — use this when the user asks about yield farming, APY, best rates to earn, where to put USDC, or passive income on Base. For yield on a specific token, also see base_mcp_lend.",
+        description: "Find the best yield/earning opportunities on Base chain using Morpho vaults - queries Morpho's own " +
+            "API directly, so numbers are fresher than get_defi_yields' DeFiLlama-aggregated Morpho figures, " +
+            "but this tool only covers Morpho (not Aerodrome/Uniswap/other protocols - use get_defi_yields for " +
+            "cross-protocol comparison). Returns all vaults ranked by APY — use this when the user asks about " +
+            "yield farming, APY, best rates to earn, where to put USDC, or passive income on Base. For yield on " +
+            "a specific token, also see base_mcp_lend.",
         inputSchema: {
             type: "object",
             properties: {
@@ -25,7 +50,12 @@ exports.BASE_TOOLS = [
     },
     {
         name: "base_mcp_lending_rates",
-        description: "Get lending and borrowing rates across all Moonwell markets on Base. Returns supply APY, borrow APY, liquidity, and utilization per asset. Use when the user asks about borrow rates, lending rates, interest rates, or supply APY on Base.",
+        description: "Get lending and borrowing rates across all Moonwell markets on Base - queries Moonwell's own API " +
+            "directly, so numbers are fresher than get_defi_yields' DeFiLlama-aggregated Moonwell figures, but " +
+            "this tool only covers Moonwell (use get_defi_yields for cross-protocol comparison, or " +
+            "base_mcp_yield_vaults for Morpho specifically). Returns supply APY, borrow APY, liquidity, and " +
+            "utilization per asset. Use when the user asks about borrow rates, lending rates, interest rates, " +
+            "or supply APY on Base.",
         inputSchema: {
             type: "object",
             properties: {
@@ -99,15 +129,7 @@ async function fetchMorphoVaults(asset, limit = 10) {
       }
     }
   }`;
-    const res = await fetch(MORPHO_API, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ query: gql }),
-        signal: AbortSignal.timeout(15000),
-    });
-    if (!res.ok)
-        throw new Error(`Morpho API error: ${res.status}`);
-    const data = await res.json();
+    const data = await fetchMorphoGql(gql);
     let vaults = data?.data?.vaults?.items ?? [];
     // Filter out test/spam vaults: min $10k TVL, max 500% APY
     vaults = vaults.filter((v) => {
@@ -199,15 +221,7 @@ async function prepareDeposit(vaultName, asset, amount) {
       }
     }
   }`;
-    const res = await fetch(MORPHO_API, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ query: gql }),
-        signal: AbortSignal.timeout(15000),
-    });
-    if (!res.ok)
-        throw new Error(`Morpho API error: ${res.status}`);
-    const data = await res.json();
+    const data = await fetchMorphoGql(gql);
     let vaults = data?.data?.vaults?.items ?? [];
     // Filter by asset first
     vaults = vaults.filter((v) => v.asset?.symbol?.toLowerCase() === asset.toLowerCase());

package/dist/tools/defi.js

@@ -11,7 +11,11 @@ exports.DEFI_TOOLS = [
     {
         name: "get_defi_yields",
         description: "Fetch top DeFi yield opportunities on Base - Morpho, Moonwell, Aerodrome, Uniswap, and more. " +
-            "Returns live APY, TVL, and pool info from DeFiLlama (no API key required). " +
+            "Returns APY, TVL, and pool info aggregated from DeFiLlama (no API key required) - broadest " +
+            "protocol coverage, but DeFiLlama's numbers can lag the protocol's own API by hours. Good first " +
+            "stop for comparing across protocols. For the freshest Morpho-vault-specific numbers use " +
+            "base_mcp_yield_vaults instead; for the freshest Moonwell supply/borrow rates use " +
+            "base_mcp_lending_rates instead - both query the protocol directly. " +
             "Filter by token or minimum APY. Use before depositing to find the best rates.",
         inputSchema: {
             type: "object",
@@ -34,7 +38,6 @@ const SwapSchema = zod_1.z.object({
 const DEFAULT_MAX_SLIPPAGE_PCT = 1.0;
 const DEFAULT_MAX_PRICE_IMPACT_PCT = 3.0;
 const SendSchema = zod_1.z.object({ token: zod_1.z.string().min(1), toAddress: zod_1.z.string().regex(/^0x[0-9a-fA-F]{40}$/, "must be a valid 0x address"), amount: zod_1.z.string().min(1) });
-const AnalyzeWalletSchema = zod_1.z.object({ address: zod_1.z.string().regex(/^0x[0-9a-fA-F]{40}$/, "must be a valid 0x address"), label: zod_1.z.string().optional() });
 const DefiYieldsSchema = zod_1.z.object({
     token: zod_1.z.string().optional(),
     minApy: zod_1.z.number().optional(),
@@ -214,34 +217,11 @@ async function handleDefiTool(name, args) {
                 isError: receipt.mined && !receipt.ok,
             };
         }
-        case "analyze_wallet": {
-            const parsed = AnalyzeWalletSchema.safeParse(args);
-            if (!parsed.success)
-                return { content: [{ type: "text", text: `Invalid input: ${parsed.error.issues[0].message}` }], isError: true };
-            const { address, label } = parsed.data;
-            const data = await (0, convex_js_1.callConvex)("/wallet/analyze", "POST", { address, label }, "analyze_wallet");
-            if (data.error)
-                return { content: [{ type: "text", text: `Wallet analysis failed: ${data.error}` }], isError: true };
-            const total = (data.totalUsd ?? 0).toFixed(2);
-            const walletLabel = label ? ` - ${label}` : "";
-            const topHoldings = (data.holdings ?? [])
-                .slice(0, 8)
-                .map(h => `• **${h.token}**: $${(h.valueUsd ?? 0).toFixed(2)}${h.pct != null ? ` (${h.pct}%)` : ""}`)
-                .join("\n");
-            const profileLine = data.profile ? `**Profile:** ${data.profile}\n` : "";
-            const header = [
-                `**Wallet Analysis**${walletLabel}`,
-                `\`${address}\``,
-                `**Portfolio value:** $${total}`,
-                ``,
-                profileLine,
-                `**Holdings:**`,
-                topHoldings || "No token holdings found.",
-                ``,
-            ].join("\n");
-            const body = data.analysis ?? (data.analysisError ? `*AI analysis unavailable: ${data.analysisError}*` : "*AI analysis not available*");
-            return { content: [{ type: "text", text: header + body }] };
-        }
+        // analyze_wallet was removed - it called POST /wallet/analyze, which was
+        // never registered in app/convex/http.ts (only a dangling section-header
+        // comment exists there). The tool was never in the exported DEFI_TOOLS
+        // list either, so this case was already unreachable dead code - no Tool
+        // registers the name "analyze_wallet" for the MCP dispatcher to route to.
         case "get_defi_yields": {
             const parsed = DefiYieldsSchema.safeParse(args ?? {});
             if (!parsed.success)

package/dist/tools/equity.js

@@ -11,8 +11,13 @@
 // and is a stronger analyst than anything this module could embed.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EQUITY_TOOLS = void 0;
+exports.buildStockFundamentals = buildStockFundamentals;
 exports.handleEquityTool = handleEquityTool;
 const zod_1 = require("zod");
+// ── Structured output builder (schema in output-schemas.ts) ─────────────────
+function buildStockFundamentals(ticker, companyName, cik, quote, quarterly, annual) {
+    return { ticker, companyName, cik, quote, quarterly, annual };
+}
 const SEC_UA = "Finch MCP research (contact: support@finchagentic.com)";
 const SEC_TICKERS = "https://www.sec.gov/files/company_tickers.json";
 const SEC_CONCEPT = (cik, tag) => `https://data.sec.gov/api/xbrl/companyconcept/CIK${cik}/us-gaap/${tag}.json`;
@@ -360,5 +365,8 @@ async function handleEquityTool(name, args) {
     // Issuers tag the same concept differently, so naming the tag behind each
     // series makes the figures checkable against EDGAR rather than trusted.
     `_XBRL concepts used: ${usedTags.join(" · ")}_`, ``, `_Figures are as filed with the SEC. Not investment advice._`);
-    return { content: [{ type: "text", text: lines.join("\n") }] };
+    return {
+        content: [{ type: "text", text: lines.join("\n") }],
+        structuredContent: buildStockFundamentals(ticker, company.name ?? null, company.cik ?? null, quote, quarterly, annual),
+    };
 }

package/dist/tools/insight.js

@@ -481,7 +481,7 @@ async function handleInsightTool(name, args) {
         // thesis is model work — and the caller is a model that can also weigh the
         // user's stated context. Hand over grounded data plus the structure.
         const suggest = process.env.TRIGGER_SECRET_KEY
-            ? `\n\n---\n💡 Use \`create_monitor\` for scheduled briefings on ${token.toUpperCase()}.`
+            ? `\n\n---\n💡 Use \`schedule_research\` for scheduled briefings on ${token.toUpperCase()}.`
             : "";
         return {
             content: [{
@@ -575,7 +575,7 @@ async function handleInsightTool(name, args) {
             ]
             : [`**Max position (${riskTolerance}):** ${band.label} — pass \`portfolioSize\` for USD figures.`];
         const suggest = process.env.TRIGGER_SECRET_KEY
-            ? `\n\n---\n💡 Use \`create_monitor\` for scheduled briefings on ${token.toUpperCase()}.`
+            ? `\n\n---\n💡 Use \`schedule_research\` for scheduled briefings on ${token.toUpperCase()}.`
             : "";
         return {
             content: [{

package/dist/tools/memory.js

@@ -47,6 +47,7 @@ const zod_1 = require("zod");
 const crypto = __importStar(require("crypto"));
 const convex_js_1 = require("../convex.js");
 const public_url_js_1 = require("../public-url.js");
+const local_vault_js_1 = require("../local-vault.js");
 const local_memory_js_1 = require("../local-memory.js");
 // memory_extract and memory_consolidate used to run their own LLM calls here
 // (and a matching pair of Convex routes did the same server-side). Both are now
@@ -89,6 +90,18 @@ function lookupRecentHash(hash) {
     }
     return hit;
 }
+// memory_delete must purge this too - otherwise a deleted memory's hash stays
+// cached (up to an hour) and re-adding the exact same content within that
+// window gets silently skipped as a "duplicate" of an id that no longer
+// exists, when there is no longer any real duplicate to skip.
+function forgetRecentHashById(id) {
+    for (const [hash, entry] of recentHashCache) {
+        if (entry.id === id) {
+            recentHashCache.delete(hash);
+            break;
+        }
+    }
+}
 // Two-tier dedup lookup: in-process cache first (catches same-session
 // dupes during eventual-consistency window), then a list call (catches
 // cross-session dupes once they've been indexed). Returns null on any
@@ -410,26 +423,6 @@ exports.MEMORY_TOOLS = [
             required: [],
         },
     },
-    {
-        name: "memory_publish",
-        description: "IRREVERSIBLE, PUBLIC. Publish a memory snippet to the Memory Marketplace — visible to " +
-            "ALL Finch users at /memory-marketplace. Reversible with vault_unpublish, but only for " +
-            "future discovery — anyone who already read it keeps what they saw. " +
-            "Requires confirm: true. Never call this on the user's behalf without them explicitly asking " +
-            "to publish; re-read the content for anything private (keys, addresses, personal details) first. " +
-            "Saved as a public vault entry (type=memory).",
-        inputSchema: {
-            type: "object",
-            properties: {
-                title: { type: "string", description: "Short title for the memory (shown publicly in the marketplace)" },
-                content: { type: "string", description: "The memory content to share — this becomes PUBLIC" },
-                tags: { type: "array", items: { type: "string" }, description: "Optional tags (e.g. ['DeFi', 'Base', 'research'])" },
-                authorName: { type: "string", description: "Public display name. Defaults to \"Anonymous\" — do NOT pass a wallet address unless the user asks to be identified." },
-                confirm: { type: "boolean", description: "Must be true to publish. Guards against accidental public disclosure." },
-            },
-            required: ["title", "content", "confirm"],
-        },
-    },
     {
         name: "memory_consolidate",
         description: "Clean up fragmented knowledge after heavy research sessions. Two-pass, no API key needed. " +
@@ -709,7 +702,7 @@ async function handleMemoryTool(name, args) {
                 content: [{
                         type: "text",
                         text: [
-                            `🧠 **Finch Semantic Memory**`,
+                            `🧠 **Finch Memory**`,
                             ``,
                             `Space: \`${space}\``,
                             `Total memories: **${total}**`,
@@ -720,7 +713,7 @@ async function handleMemoryTool(name, args) {
                             `• memory_add (URL indexing) - ✅`,
                             `• Google Drive / Gmail / Notion - connect at finchagentic.com`,
                             ``,
-                            `**Capabilities:** Semantic search · Vector context · 81.6% LongMemEval`,
+                            `**Capabilities:** Full-text (keyword) search with 90-day time-decay ranking - not embeddings, no vector search.`,
                         ].join("\n"),
                     }],
                 structuredContent: buildMemoryProfile(data),
@@ -785,6 +778,7 @@ async function handleMemoryTool(name, args) {
                 if (data?.error)
                     return { content: [{ type: "text", text: `Error: ${data.error}` }], isError: true };
             }
+            forgetRecentHashById(parsed.data.id);
             return { content: [{ type: "text", text: `🗑️ Memory deleted: \`${parsed.data.id}\`` }] };
         }
         case "memory_insight": {
@@ -795,10 +789,15 @@ async function handleMemoryTool(name, args) {
             const memLimit = depth === "deep" ? 15 : depth === "quick" ? 5 : 8;
             // v3.25.1: hybrid retrieval for memory side (was semantic-only) so the
             // intelligence report surfaces exact-token matches alongside meaning
-            // matches. Vault side runs in parallel as before.
+            // matches. Vault side runs in parallel as before - but only against
+            // Convex when the vault isn't local; a local vault's topic string must
+            // never leave the machine, and this never checked that before.
+            const localVault = (0, local_vault_js_1.getLocalVaultConfig)();
             const [memResults, vaultData] = await Promise.all([
                 hybridMemorySearch(topic, memLimit),
-                (0, convex_js_1.callConvex)(`/vault/search?q=${encodeURIComponent(topic)}&limit=6`, "GET", undefined, "vault_search").catch(() => ({ results: [] })),
+                localVault
+                    ? Promise.resolve((0, local_vault_js_1.localVaultSearch)(localVault, topic, { limit: 6 }))
+                    : (0, convex_js_1.callConvex)(`/vault/search?q=${encodeURIComponent(topic)}&limit=6`, "GET", undefined, "vault_search").catch(() => ({ results: [] })),
             ]);
             const vaultResults = vaultData.results ?? [];
             const total = memResults.length + vaultResults.length;
@@ -955,7 +954,11 @@ async function handleMemoryTool(name, args) {
                 };
             }
             // ── PASS 1: fetch every memory on the topic, numbered ───────────────
-            const rows = await searchSupermemory(topic, limit);
+            // Uses the same RRF-fused semantic+lexical retrieval as memory_search/
+            // memory_context - a plain single-source searchSupermemory() call here
+            // used to mean consolidation could miss memories only the lexical/BM25
+            // side would surface, while still claiming an exhaustive "N memories".
+            const rows = await hybridMemorySearch(topic, limit);
             if (rows.length === 0) {
                 return { content: [{ type: "text", text: `No memories found for "${topic}" to consolidate.` }], isError: true };
             }
@@ -989,61 +992,22 @@ async function handleMemoryTool(name, args) {
                     }],
             };
         }
-        case "memory_publish": {
-            const { title, content, tags, authorName, confirm } = args;
-            if (!title || !content)
-                return { content: [{ type: "text", text: "title and content are required" }], isError: true };
-            if (confirm !== true) {
-                return {
-                    content: [{
-                            type: "text",
-                            text: "Refusing to publish: this makes the content **public to all Finch users**. " +
-                                "It can be hidden again with `vault_unpublish`, but not un-read. Review the content " +
-                                "for keys, addresses and personal details, then pass `confirm: true`.",
-                        }],
-                    isError: true,
-                };
-            }
-            if (authorName && /^0x[a-fA-F0-9]{40}$/.test(authorName.trim())) {
-                return {
-                    content: [{
-                            type: "text",
-                            text: "Refusing to publish with a wallet address as the author name — that permanently " +
-                                "links your on-chain identity to this public entry. Use a handle, or omit authorName " +
-                                "to publish as \"Anonymous\".",
-                        }],
-                    isError: true,
-                };
-            }
-            const data = await (0, convex_js_1.callConvex)("/vault/save", "POST", {
-                type: "memory",
-                title,
-                content,
-                tags: tags ?? [],
-                isPublic: true,
-                authorName: authorName ?? "Anonymous",
-                commitMsg: "published to marketplace",
-            }, "vault_save");
-            if (data.error)
-                return { content: [{ type: "text", text: `Error: ${data.error}` }], isError: true };
-            return {
-                content: [{
-                        type: "text",
-                        text: [
-                            `🧠 **Memory Published**`,
-                            ``,
-                            `**Title:** ${title}`,
-                            `**Key:** \`${data.key}\``,
-                            `**Version:** ${data.version ?? 1}`,
-                            ``,
-                            `Now visible at the Memory Marketplace in the Finch app.`,
-                            ``,
-                            `Make it private again: \`vault_unpublish key: "${data.key}"\``,
-                            `That stops future discovery. Anyone who already read it keeps what they saw.`,
-                        ].join("\n"),
-                    }],
-            };
-        }
+        // memory_publish was removed - it was broken two levels deep. The tool
+        // called POST /vault/save with isPublic/authorName fields that the
+        // handler silently dropped (only type/title/content/key/contentType/
+        // agentId/tags/commitMsg/metadata are forwarded to vault.saveEntry - see
+        // app/convex/http.ts), so `published` was never actually set true; the
+        // real publishEntry mutation (POST /vault/publish) existed but this tool
+        // never called it. And even a correctly-wired publish would have done
+        // nothing observable: nothing anywhere reads the `published` field for
+        // cross-user browsing - no /vault/community route (dangling comment
+        // only, same pattern as the other removed routes), no backend query for
+        // it, no "Memory Marketplace" page in app/src. The tool asked users to
+        // accept an "IRREVERSIBLE, PUBLIC" risk for a marketplace that doesn't
+        // exist at any layer. Re-add only alongside building the actual
+        // discovery path: a community-browse query + route + UI that reads
+        // `published: true` entries. vault_unpublish is left in place - it's a
+        // correct, harmless no-op until then.
         default:
             return null;
     }

package/dist/tools/monitor.js

@@ -22,8 +22,8 @@ const MONITOR_INPUT_SCHEMA = {
 exports.MONITOR_TOOLS = [
     {
         name: "schedule_research",
-        description: "Schedule recurring autonomous research on any topic - runs on a cron schedule, saves findings to vault, " +
-            "and sends a Telegram notification. The agent runs completely on its own with no prompting needed. " +
+        description: "Schedule recurring autonomous research on any topic - runs on a cron schedule, saves findings to vault. " +
+            "The agent runs completely on its own with no prompting needed. " +
             "Requires TRIGGER_SECRET_KEY env var (trigger.dev). " +
             "Examples: daily morning briefing, weekly competitor analysis, hourly price alerts, monthly industry report.",
         inputSchema: MONITOR_INPUT_SCHEMA,
@@ -103,7 +103,7 @@ function buildMonitorList(schedules, configs = {}) {
     };
 }
 async function handleMonitorTool(name, args) {
-    if (name === "schedule_research" || name === "create_monitor") {
+    if (name === "schedule_research") {
         const parsed = CreateSchema.safeParse(args);
         if (!parsed.success)
             return { content: [{ type: "text", text: `Invalid input: ${parsed.error.issues[0].message}` }], isError: true };
@@ -192,7 +192,7 @@ async function handleMonitorTool(name, args) {
                     key: `monitor-config/${externalId}`,
                     agentId: "os",
                     tags: ["monitor-config"],
-                    commitMsg: "create_monitor config",
+                    commitMsg: "schedule_research config",
                 }, "vault_save");
             }
             catch {
@@ -210,7 +210,7 @@ async function handleMonitorTool(name, args) {
                             data.nextRun ? `⏭️ Next run: ${new Date(data.nextRun).toUTCString()}` : "",
                             ``,
                             configSaved
-                                ? `The agent will research "${topic}" on schedule, save findings to vault, and send a Telegram notification if configured.`
+                                ? `The agent will research "${topic}" on schedule and save findings to vault.`
                                 : `⚠️ Monitor schedule created but config save failed - the agent may use a default topic on first run. Try \`cancel_monitor\` and recreate.`,
                             `Use \`list_monitors\` to see all active monitors.`,
                         ].filter(Boolean).join("\n"),
@@ -240,7 +240,7 @@ async function handleMonitorTool(name, args) {
                 return {
                     content: [{
                             type: "text",
-                            text: `No active monitors.\n\nUse \`create_monitor\` to set up an autonomous agent that runs on a schedule.`,
+                            text: `No active monitors.\n\nUse \`schedule_research\` to set up an autonomous agent that runs on a schedule.`,
                         }],
                     structuredContent: buildMonitorList([]),
                 };

package/dist/tools/os.js

@@ -138,7 +138,6 @@ async function handleOsTool(name, args) {
                 "FIRECRAWL_API_KEY": !!process.env.FIRECRAWL_API_KEY,
                 "FINCH_SESSION_TOKEN": !!process.env.FINCH_SESSION_TOKEN,
                 "FINCH_API_KEY": !!process.env.FINCH_API_KEY,
-                "TELEGRAM_BOT_TOKEN": !!process.env.TELEGRAM_BOT_TOKEN,
             };
             const localMemCfg = (0, local_memory_js_1.getLocalMemoryConfig)();
             const pingLocalMemory = async () => {

package/dist/tools/packets.js

@@ -245,8 +245,8 @@ async function handlePacket(toolName, args) {
     }
     if (toolName === "packet_share") {
         const { name, authorName, confirm } = args;
-        // Same bar as memory_publish and vault_delete: an action the user cannot
-        // fully take back needs an explicit second step, not a single call.
+        // Same bar as vault_delete: an action the user cannot fully take back
+        // needs an explicit second step, not a single call.
         if (confirm !== true) {
             return {
                 content: [{

package/dist/tools/rh-mcp.js

@@ -14,6 +14,7 @@ exports.dexTokenBest = dexTokenBest;
 exports.resolveTokenSmart = resolveTokenSmart;
 exports.buildRhAnalysis = buildRhAnalysis;
 exports.buildRhStocksList = buildRhStocksList;
+exports.rhProviderAsync = rhProviderAsync;
 exports.rhErc20Balance = rhErc20Balance;
 exports.rhPriceUsd = rhPriceUsd;
 exports.buildRhSafetyStructured = buildRhSafetyStructured;
@@ -990,7 +991,16 @@ async function quoteRh(args) {
         throw new Error("RH swaps route ETH ↔ token. Buy a token with ETH, or sell a token for ETH.");
     }
     const sellAmount = parseHumanToWei(args.amount, from.decimals);
-    const slippageBps = Math.round((args.maxSlippagePct ?? 2.0) * 100);
+    const slippagePct = args.maxSlippagePct ?? 2.0;
+    // Same bound defi.ts's SwapSchema already enforces for Base swaps
+    // (.positive().max(50)) - this file had no equivalent check anywhere, so a
+    // negative or absurd value flowed straight through to the backend as
+    // slippageBps, both for direct rh_mcp_swap calls and for every unattended
+    // rh_orders_tick execution of a DCA/bracket order created with a bad value.
+    if (!(slippagePct > 0) || slippagePct > 50) {
+        throw new Error(`maxSlippagePct must be greater than 0 and at most 50 (got ${args.maxSlippagePct}).`);
+    }
+    const slippageBps = Math.round(slippagePct * 100);
     const result = await (0, convex_js_1.callConvex)("/mcp/rh/quote", "POST", {
         sellToken: from.address,
         buyToken: to.address,
@@ -999,7 +1009,7 @@ async function quoteRh(args) {
         slippageBps,
         fromSymbol: from.symbol,
         toSymbol: to.symbol,
-    }, "rh_mcp_estimate");
+    }, args.toolName ?? "rh_mcp_estimate");
     if (result.error)
         throw new Error(result.error);
     return { ...result, from, to, sellAmount, slippageBps };
@@ -1269,6 +1279,7 @@ async function handleRhMcpTool(name, args) {
                     amount: String(a.amount),
                     maxSlippagePct: a.maxSlippagePct,
                     taker: wallet.address,
+                    toolName: "rh_mcp_swap",
                 });
                 const quote = q.quote ?? q;
                 const tx = quote.transaction ?? {