@finchagentic/mcp 4.1.0 → 4.4.1

package/dist/output-schemas.js

@@ -200,6 +200,30 @@ exports.OUTPUT_SCHEMAS = {
         required: ["input", "resolved"],
     },
     // ── SEC equities ────────────────────────────────────────────────────────────
+    stock_fundamentals: {
+        type: "object",
+        properties: {
+            ticker: { type: "string" },
+            companyName: string_null,
+            cik: string_null,
+            quote: {
+                type: ["object", "null"],
+                additionalProperties: true,
+                description: "{ price, currency, prevClose, prevDate } - null when a live quote wasn't available",
+            },
+            quarterly: {
+                type: "object",
+                additionalProperties: { type: "array", items: { type: "object", additionalProperties: true } },
+                description: "Per-concept arrays of { end, val, form, fy, fp } facts, most recent last",
+            },
+            annual: {
+                type: "object",
+                additionalProperties: { type: "array", items: { type: "object", additionalProperties: true } },
+                description: "Per-concept arrays of { end, val, form, fy, fp } facts, most recent last",
+            },
+        },
+        required: ["ticker", "quarterly", "annual"],
+    },
     stock_events: {
         type: "object",
         properties: {
@@ -415,6 +439,53 @@ exports.OUTPUT_SCHEMAS = {
         },
         required: ["count", "packets"],
     },
+    // ── vault ───────────────────────────────────────────────────────────────────
+    vault_list: {
+        type: "object",
+        properties: {
+            type: string_null,
+            count: { type: "number" },
+            entries: {
+                type: "array",
+                items: {
+                    type: "object",
+                    properties: {
+                        key: { type: "string" },
+                        title: string_null,
+                        type: string_null,
+                        version: { type: "number" },
+                        size: number_null,
+                        updatedAt: number_null,
+                        isPinned: { type: "boolean" },
+                    },
+                    required: ["key"],
+                },
+            },
+        },
+        required: ["count", "entries"],
+    },
+    vault_search: {
+        type: "object",
+        properties: {
+            query: { type: "string" },
+            count: { type: "number" },
+            results: {
+                type: "array",
+                items: {
+                    type: "object",
+                    properties: {
+                        key: { type: "string" },
+                        title: string_null,
+                        type: string_null,
+                        score: number_null,
+                        preview: string_null,
+                    },
+                    required: ["key"],
+                },
+            },
+        },
+        required: ["query", "count", "results"],
+    },
     // ── memory ──────────────────────────────────────────────────────────────────
     memory_search: {
         type: "object",
@@ -453,14 +524,6 @@ exports.OUTPUT_SCHEMAS = {
         required: ["count", "memories"],
     },
     // ── agents ──────────────────────────────────────────────────────────────────
-    list_agents: {
-        type: "object",
-        properties: {
-            count: { type: "number" },
-            agents: { type: "array", items: { type: "object", additionalProperties: true } },
-        },
-        required: ["count", "agents"],
-    },
     agent_ledger: {
         type: "object",
         properties: {
@@ -470,15 +533,6 @@ exports.OUTPUT_SCHEMAS = {
         },
         required: ["name", "count", "versions"],
     },
-    agent_runs: {
-        type: "object",
-        properties: {
-            name: { type: "string" },
-            count: { type: "number" },
-            runs: { type: "array", items: { type: "object", additionalProperties: true } },
-        },
-        required: ["name", "count", "runs"],
-    },
     // ── scanner / orders / wallet ────────────────────────────────────────────────
     scan_market: {
         type: "object",

package/dist/project.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isLocalVaultActive = isLocalVaultActive;
+exports.resolveProjectId = resolveProjectId;
+const convex_js_1 = require("./convex.js");
+const local_vault_js_1 = require("./local-vault.js");
+// MCP has no persistent "active project" UI state the way the webapp Sidebar
+// switcher does - a caller (vault_save, agent_spawn) names the project it
+// wants by string on each call instead. Resolution + auto-create both happen
+// server-side (POST /projects/resolve, see convex/http.ts +
+// convex/projects.ts's resolveOrCreateProjectForUser) so the match/dedup
+// logic exists in exactly one place, shared with the webapp's own project
+// picker.
+//
+// Local-vault mode (vaultBackend: "local") has no project concept at all -
+// it's a flat, unauthenticated file store on the user's own machine with no
+// server to resolve a name against. Callers should check
+// isLocalVaultActive() first and skip resolution entirely rather than call
+// this and get a confusing network-style failure.
+function isLocalVaultActive() {
+    return !!(0, local_vault_js_1.getLocalVaultConfig)();
+}
+async function resolveProjectId(name) {
+    const trimmed = name.trim();
+    if (!trimmed)
+        return null;
+    try {
+        return await (0, convex_js_1.callConvex)("/projects/resolve", "POST", { name: trimmed }, "vault_save");
+    }
+    catch {
+        // Resolution is best-effort - a save should never fail just because the
+        // project lookup did. Falls back to unassigned, same as the webapp's
+        // agent_spawn membership check when a stale/bad id doesn't match.
+        return null;
+    }
+}

package/dist/resources.js

@@ -81,17 +81,12 @@ async function readVaultResource(uri) {
     if (data.error) {
         throw new Error(`Vault entry not found: ${key}`);
     }
-    // Blob-backed entry - preview lives in `content`, real payload streams
-    // from /vault/blob. Same flow vault_read uses internally.
-    let body = data.content ?? "";
-    if (data.contentFileId) {
-        try {
-            body = await (0, convex_js_1.callConvexRaw)(`/vault/blob?id=${encodeURIComponent(data.contentFileId)}`, "read_resource");
-        }
-        catch (err) {
-            body = (data.content ?? "") + `\n\n_(could not load full blob: ${err.message})_`;
-        }
-    }
+    // No blob-storage tier exists on the backend (see app/convex/vault.ts) -
+    // oversized content is rejected at save time, so `contentFileId` never
+    // comes back here. A `/vault/blob` fallback used to live here but the route
+    // was never registered in http.ts either; removed as dead code rather than
+    // fixed against a storage tier that doesn't exist.
+    const body = data.content ?? "";
     const mime = mimeForContentType(data.contentType);
     // Only prepend a friendly header for markdown (the default) - JSON/code
     // payloads must remain valid in their own grammar so consuming tools can

package/dist/server.js

@@ -61,7 +61,13 @@ const market_js_1 = require("./tools/market.js");
 const defi_js_1 = require("./tools/defi.js");
 const automation_js_1 = require("./tools/automation.js");
 const insight_js_1 = require("./tools/insight.js");
-const framework_js_1 = require("./tools/framework.js");
+// tools/framework.ts removed - list_playbooks, run_playbook and
+// get_finch_ledger called /framework/playbooks, /framework/playbook/run and
+// /swarm/ledger, none of which are registered in app/convex/http.ts (only
+// dangling section-header comments) and none of which have a backing data
+// model (no playbook table, no Sentinel ledger table in schema.ts). All 3
+// tools always 404'd. Re-add only alongside building the Noel Framework
+// playbook/Sentinel backend for real.
 const wallet_js_1 = require("./tools/wallet.js");
 const vault_js_1 = require("./tools/vault.js");
 const miroshark_js_1 = require("./tools/miroshark.js");
@@ -86,6 +92,7 @@ const monitor_js_1 = require("./tools/monitor.js");
 const github_js_1 = require("./tools/github.js");
 const chronicle_js_1 = require("./tools/chronicle.js");
 const packets_js_1 = require("./tools/packets.js");
+const stake_js_1 = require("./tools/stake.js");
 const token_gate_js_1 = require("./token-gate.js");
 const PRIVATE_KEY_RESPONSE = {
     content: [{
@@ -107,38 +114,52 @@ exports.ALL_TOOLS = [
     ...automation_js_1.AUTOMATION_TOOLS, // 6 - create, list, pause, delete, get_runs, run
     // SWARM_TOOLS removed v3.19 - multi-agent research is now built into
     // deep_research (depth=standard|deep). Handler fully removed v3.21.
-    ...framework_js_1.FRAMEWORK_TOOLS, // 3 - list_playbooks, run_playbook, get_finch_ledger
-    ...vault_js_1.VAULT_TOOLS, // 14 - save, read, list, search, history, diff, export, pin, tag, delete, link, related, store_credential, get_credential
+    // FRAMEWORK_TOOLS removed - list_playbooks/run_playbook/get_finch_ledger backend routes never existed, see tools/ import comment above.
+    ...vault_js_1.VAULT_TOOLS, // 17 - save, code_session_save, read, list, search, history, diff, export, pin, unpublish, tag, delete, link, related, store_credential, get_credential, list_projects
     ...wallet_js_1.WALLET_TOOLS, // 3 - get_wallet_address, get_wallet_balance, wallet_sign_message
     ...miroshark_js_1.MIROSHARK_TOOLS, // 3 - simulate, status, stop
-    ...agents_js_1.AGENT_TOOLS, // 12 - list_agents, hire_agent, agent_spawn, agent_recall, agent_update, agent_identity, agent_ledger + agent_schedule, agent_unschedule, agent_pause, agent_resume, agent_runs (v3.18 autonomous)
+    ...agents_js_1.AGENT_TOOLS, // 4 - agent_spawn, agent_recall, agent_update, agent_ledger (vault-backed, all working). list_agents/hire_agent and the autonomous-schedule tools (agent_identity/agent_schedule/agent_unschedule/agent_pause/agent_resume/agent_runs) removed - their backend routes were never implemented, see tools/agents.ts
     ...scanner_js_1.SCANNER_TOOLS, // 3 - score_token, check_token, scan_market (dips+momentum merged)
     ...equity_js_1.EQUITY_TOOLS, // 1 - stock_fundamentals (SEC EDGAR XBRL; no key)
     ...insider_js_1.INSIDER_TOOLS, // 1 - stock_insider (SEC Form 4; separates discretionary from automatic)
     ...events_js_1.EVENT_TOOLS, // 1 - stock_events (SEC 8-K item codes decoded)
     ...coder_js_1.CODER_TOOLS, // 1 - audit_contract (static Solidity scan; the client model does the reasoning)
-    ...base_js_1.BASE_TOOLS, // 4 - query_vaults, list_markets, prepare_deposit, chain_stats
+    ...base_js_1.BASE_TOOLS, // 4 - base_mcp_yield_vaults, base_mcp_lending_rates, base_mcp_deposit_guide, base_mcp_network
     ...base_mcp_js_1.BASE_MCP_TOOLS, // 7 - base_mcp_{status,balance,send,swap,estimate,lend,resolve} (analyze removed v3.17.5 - dead backend route)
     ...rh_mcp_js_1.RH_MCP_TOOLS, // 8 - rh_mcp_{status,list_stocks,balance,estimate,swap} + rh_token_resolve, rh_analyze, rh_safety_check (RH Chain 4663 Uni V4: stocks + arbitrary crypto via DexScreener/Blockscout)
     ...rh_orders_js_1.RH_ORDER_TOOLS, // 5 - rh_dca_create, rh_bracket_create, rh_orders_list, rh_order_cancel, rh_orders_tick (RH automated DCA/TP/SL)
     ...rh_bridge_js_1.BRIDGE_TOOLS, // 1 - rh_stock_bridge (tokenized stock vs real equity)
-    ...memory_js_1.MEMORY_TOOLS, // 10 - memory_add, memory_search, memory_context, memory_profile, memory_list, memory_delete, memory_insight, memory_extract, memory_consolidate, memory_publish
+    ...memory_js_1.MEMORY_TOOLS, // 9 - memory_add, memory_search, memory_context, memory_profile, memory_list, memory_delete, memory_insight, memory_extract, memory_consolidate. memory_publish removed - promised a "Memory Marketplace" that doesn't exist at any layer (no browse route, no query, no UI), see tools/memory.ts
     ...os_js_1.OS_TOOLS, // 3 - finch_status, finch_diagnostics, finch_shell_chat
     ...research_js_1.RESEARCH_TOOLS, // 2 - web_scrape, web_search
     ...deep_research_js_1.DEEP_RESEARCH_TOOLS, // 1 - deep_research (search → scrape → rank → cited evidence pack; caller synthesises)
     ...research_compare_js_1.RESEARCH_COMPARE_TOOLS, // 1 - research_compare (diff two reports across time)
     ...research_chain_js_1.RESEARCH_CHAIN_TOOLS, // 1 - research_chain (walk continueFrom evolution timeline)
-    ...monitor_js_1.MONITOR_TOOLS, // 4 - schedule_research, create_monitor (alias), list_monitors, cancel_monitor
+    ...monitor_js_1.MONITOR_TOOLS, // 3 - schedule_research, list_monitors, cancel_monitor
     ...github_js_1.GITHUB_TOOLS, // 8 - list_repos, list_prs, get_pr, list_issues, get_issue, get_file, get_commits, search_code
     ...chronicle_js_1.CHRONICLE_TOOLS, // 4 - chronicle_add, chronicle_list, chronicle_search, chronicle_stats
     ...packets_js_1.PACKET_TOOLS, // 4 - packet_create, packet_run, packet_list, packet_share
-    // total: 120 (refactor: −6 tools whose work the client model already does; v3.41.0: rh_mcp_balance now lists ALL held tokens via Blockscout (was blind to non-catalog crypto); v3.40.0: RH RPC relay fallback via Convex — works on networks that block robinhood.com; v3.39.1: fix — sell approval target now follows the route (Permit2 for V4, SwapRouter02 for V2/V3); v3.39.0: +Uniswap V2 routing — full V2/V3/V4 best-fill router; v3.38.0: Uniswap V3 routing + launchpad detection folded into rh_safety_check; v3.37.1: RH audit fixes — preview read-only, tx-hash extract, pending nonce, atomic store, crash isolation; v3.37.0: +rh_safety_check; v3.36.0: +RH DCA/TP/SL)
+    ...stake_js_1.STAKE_TOOLS, // 5 - stake_finch_status, stake_finch, unstake_finch, claim_vested_rewards, stake_auto_restake (custodial wallet; requires `finch login`)
+    // total: 116 tools as measured by ALL_TOOLS.length - do not hand-maintain a
+    // count in this comment (drifted stale multiple times already: before
+    // staking was added, after the P1 audit removed 9 dead framework/agent-
+    // schedule tools, after memory_publish was removed for promising a
+    // marketplace that doesn't exist, after stake_auto_restake was added,
+    // after claim_vested_rewards was added to close the gap where the
+    // stake-lifecycle notification told users to "run claimVestedRewards" but
+    // no MCP tool by that name existed, after code_session_save was added so
+    // coding sessions persist the same way deep_research already auto-saves
+    // research, and after list_projects was added alongside `workspaceProject`
+    // support on vault_save/agent_spawn - MCP tools can now file into the same
+    // Projects the webapp Agents page organizes by, resolved/auto-created
+    // server-side via POST /projects/resolve; ALL_TOOLS.length is the only
+    // number that can't lie). Per-category counts above are best-effort
+    // documentation, not load-bearing anywhere.
 ];
 exports.HANDLER_MAP = new Map([
     ...market_js_1.MARKET_TOOLS.map(t => [t.name, market_js_1.handleMarketTool]),
     ...defi_js_1.DEFI_TOOLS.map(t => [t.name, defi_js_1.handleDefiTool]),
     ...automation_js_1.AUTOMATION_TOOLS.map(t => [t.name, automation_js_1.handleAutomationTool]),
-    ...framework_js_1.FRAMEWORK_TOOLS.map(t => [t.name, framework_js_1.handleFrameworkTool]),
     ...vault_js_1.VAULT_TOOLS.map(t => [t.name, vault_js_1.handleVaultTool]),
     ...wallet_js_1.WALLET_TOOLS.map(t => [t.name, wallet_js_1.handleWalletTool]),
     ...insight_js_1.INSIGHT_TOOLS.map(t => [t.name, insight_js_1.handleInsightTool]),
@@ -164,6 +185,7 @@ exports.HANDLER_MAP = new Map([
     ...github_js_1.GITHUB_TOOLS.map(t => [t.name, github_js_1.handleGithubTool]),
     ...chronicle_js_1.CHRONICLE_TOOLS.map(t => [t.name, (n, a) => (0, chronicle_js_1.handleChronicle)(n, a)]),
     ...packets_js_1.PACKET_TOOLS.map(t => [t.name, (n, a) => (0, packets_js_1.handlePacket)(n, a)]),
+    ...stake_js_1.STAKE_TOOLS.map(t => [t.name, stake_js_1.handleStakeTool]),
 ]);
 // `instructions` is returned in the initialize result - it tells the client
 // (and, through it, the model) what this server is and how to reach for it.
@@ -175,10 +197,10 @@ const SERVER_INSTRUCTIONS = [
     "research, DeFi on Base (base_mcp_*), and Robinhood Chain trading (rh_*).",
     "",
     "Tool annotations are set: read-only tools are safe to run without asking;",
-    "tools with destructiveHint (deletes, cancels, memory_publish, and anything",
-    "that moves funds - base_mcp_swap/send/lend, rh_mcp_swap, rh_dca_create,",
-    "rh_bracket_create, run_playbook/automation, packet_run) should be confirmed",
-    "with the user before running.",
+    "tools with destructiveHint (deletes, cancels, packet_share, and anything",
+    "that moves funds - base_mcp_swap/send, rh_mcp_swap, rh_dca_create,",
+    "rh_bracket_create, run_automation, packet_run, stake_finch,",
+    "unstake_finch) should be confirmed with the user before running.",
     "",
     "Vault entries are also exposed as resources (finch://vault/<key>); prefer",
     "reading those over a vault_read tool call when you only need the content.",

package/dist/token-gate.js

@@ -57,9 +57,9 @@ exports.PREMIUM_TOOLS = new Set([
     // Automations
     "create_automation", "run_automation", "pause_automation", "delete_automation", "get_automation_runs",
     // Autonomous monitors
-    "schedule_research", "create_monitor",
+    "schedule_research",
     // Persistent agents
-    "hire_agent", "agent_spawn", "agent_recall", "agent_update",
+    "agent_spawn", "agent_recall", "agent_update",
 ]);
 function tokenGateError(toolName) {
     return {

package/dist/tool-filter.js

@@ -17,12 +17,21 @@ exports.filterTools = filterTools;
 //   FINCH_TOOLS=all          every registered tool
 //
 // Unknown presets fall back to all to avoid silently hiding tools.
+// Each preset's regex is checked against every tool name in ALL_TOOLS by
+// tools-registration.test.ts (see "every tool matches at least one preset")
+// - a tool that matches no preset's regex is invisible under every FINCH_TOOLS
+// setting except "all", which happened silently to 33/121 tools before that
+// test existed (rh_* order-management tools, all *_automation tools, packets,
+// playbooks, wallet balance/sign, miroshark, stock_* - a user on
+// FINCH_TOOLS=defi couldn't even see rh_order_cancel for an order placed
+// through that same preset). New tools MUST match a preset or the test fails
+// the build, instead of quietly vanishing like these did.
 const PRESETS = {
-    core: /^(memory_|vault_|agent_|list_agents|hire_agent|ask_finch|finch_status|get_wallet_address|chronicle_)/,
-    defi: /^(get_market_data|get_token_data|compare_tokens|market_overview|token_history|market_thesis|trade_plan|base_mcp_|rh_mcp_|base_|get_defi_yields|score_token|check_token|scan_market|analyze_wallet)/,
-    research: /^(memory_|vault_|deep_research|research_compare|research_chain|web_search|web_scrape|schedule_research|create_monitor|list_monitors|cancel_monitor|ask_finch)/,
-    memory: /^(memory_|vault_|agent_|list_agents|hire_agent|chronicle_)/,
-    coder: /^(audit_contract|github_)/,
+    core: /^(memory_|vault_|code_session_save|list_projects|agent_|ask_finch|finch_status|finch_diagnostics|finch_shell_chat|get_wallet_address|get_wallet_balance|wallet_sign_message|chronicle_|packet_)/,
+    defi: /^(get_market_data|get_token_data|compare_tokens|market_overview|token_history|get_base_token_data|stock_fundamentals|stock_insider|stock_events|market_thesis|trade_plan|base_mcp_|rh_|base_|get_defi_yields|score_token|check_token|scan_market|get_wallet_balance|wallet_sign_message|create_automation|list_automations|pause_automation|delete_automation|get_automation_runs|run_automation|miroshark_|stake_|unstake_finch|claim_vested_rewards)/,
+    research: /^(memory_|vault_|code_session_save|list_projects|deep_research|research_compare|research_chain|web_search|web_scrape|schedule_research|list_monitors|cancel_monitor|ask_finch|stock_fundamentals|stock_insider|stock_events)/,
+    memory: /^(memory_|vault_|code_session_save|list_projects|agent_|chronicle_)/,
+    coder: /^(audit_contract|github_|code_session_save)/,
 };
 function filterTools(allTools) {
     // Default is "core" - keeps LLM context cost low while everything