@finchagentic/mcp 4.2.0 → 4.4.1

package/dist/tools/market.js

@@ -293,7 +293,7 @@ async function handleMarketTool(name, args) {
         case "get_market_data": {
             const parsed = GetMarketDataSchema.safeParse(args ?? {});
             if (!parsed.success)
-                return { content: [{ type: "text", text: `Invalid input: ${parsed.error.issues[0].message}` }], isError: true };
+                return { content: [{ type: "text", text: `${parsed.error.issues[0].message}` }], isError: true };
             const { token } = parsed.data;
             if (token) {
                 const resolved = await resolveTokenId(token);
@@ -349,7 +349,7 @@ async function handleMarketTool(name, args) {
         case "get_token_data": {
             const parsed = GetTokenDataSchema.safeParse(args);
             if (!parsed.success)
-                return { content: [{ type: "text", text: `Invalid input: ${parsed.error.issues[0].message}` }], isError: true };
+                return { content: [{ type: "text", text: `${parsed.error.issues[0].message}` }], isError: true };
             const q = parsed.data.question;
             // Try to extract a known symbol first, then fall back to search
             const upperQ = q.toUpperCase();
@@ -381,7 +381,7 @@ async function handleMarketTool(name, args) {
         case "compare_tokens": {
             const parsed = CompareTokensSchema.safeParse(args);
             if (!parsed.success)
-                return { content: [{ type: "text", text: `Invalid input: ${parsed.error.issues[0].message}` }], isError: true };
+                return { content: [{ type: "text", text: `${parsed.error.issues[0].message}` }], isError: true };
             const syms = parsed.data.tokens.map(t => t.toUpperCase());
             const ids = syms.map(s => SYMBOL_TO_ID[s]).filter(Boolean);
             const unknown = syms.filter(s => !SYMBOL_TO_ID[s]);
@@ -449,7 +449,7 @@ async function handleMarketTool(name, args) {
         case "token_history": {
             const parsed = TokenHistorySchema.safeParse(args);
             if (!parsed.success)
-                return { content: [{ type: "text", text: `Invalid input: ${parsed.error.issues[0].message}` }], isError: true };
+                return { content: [{ type: "text", text: `${parsed.error.issues[0].message}` }], isError: true };
             const days = parsed.data.days ?? 7;
             const resolved = await resolveTokenId(parsed.data.token);
             if (!resolved)
@@ -498,7 +498,7 @@ async function handleMarketTool(name, args) {
         case "get_base_token_data": {
             const parsed = GetBaseTokenDataSchema.safeParse(args);
             if (!parsed.success)
-                return { content: [{ type: "text", text: `Invalid input: ${parsed.error.issues[0].message}` }], isError: true };
+                return { content: [{ type: "text", text: `${parsed.error.issues[0].message}` }], isError: true };
             const address = parsed.data.tokenAddress.toLowerCase();
             const [pair, coingeckoId] = await Promise.all([
                 fetchDexscreenerBaseToken(address),

package/dist/tools/memory.js

@@ -519,7 +519,7 @@ async function handleMemoryTool(name, args) {
         case "memory_add": {
             const parsed = AddSchema.safeParse(args);
             if (!parsed.success)
-                return { content: [{ type: "text", text: `Invalid input: ${parsed.error.issues[0].message}` }], isError: true };
+                return { content: [{ type: "text", text: `${parsed.error.issues[0].message}` }], isError: true };
             const { content, title, tags, sourceUrl, force } = parsed.data;
             // `sourceUrl` is not stored, it is fetched and indexed — by the local
             // memory server on the user's own machine when local mode is on. An
@@ -580,7 +580,7 @@ async function handleMemoryTool(name, args) {
         case "memory_search": {
             const parsed = SearchSchema.safeParse(args);
             if (!parsed.success)
-                return { content: [{ type: "text", text: `Invalid input: ${parsed.error.issues[0].message}` }], isError: true };
+                return { content: [{ type: "text", text: `${parsed.error.issues[0].message}` }], isError: true };
             const { query, limit = 10 } = parsed.data;
             // Over-fetch so post-decay ranking still has enough material.
             const overfetch = Math.min(50, Math.max(limit * 2, 20));
@@ -662,7 +662,7 @@ async function handleMemoryTool(name, args) {
         case "memory_context": {
             const parsed = ContextSchema.safeParse(args);
             if (!parsed.success)
-                return { content: [{ type: "text", text: `Invalid input: ${parsed.error.issues[0].message}` }], isError: true };
+                return { content: [{ type: "text", text: `${parsed.error.issues[0].message}` }], isError: true };
             const { topic, limit = 8 } = parsed.data;
             // v3.25.1: use hybrid retrieval so context loading picks up exact-token
             // matches (env var names, model IDs, contract addresses) that semantic-
@@ -722,7 +722,7 @@ async function handleMemoryTool(name, args) {
         case "memory_list": {
             const parsed = ListSchema.safeParse(args ?? {});
             if (!parsed.success)
-                return { content: [{ type: "text", text: `Invalid input: ${parsed.error.issues[0].message}` }], isError: true };
+                return { content: [{ type: "text", text: `${parsed.error.issues[0].message}` }], isError: true };
             const { limit = 20, tag } = parsed.data;
             const localList = (0, local_memory_js_1.getLocalMemoryConfig)();
             let results;
@@ -753,7 +753,7 @@ async function handleMemoryTool(name, args) {
         case "memory_delete": {
             const parsed = DeleteMemSchema.safeParse(args);
             if (!parsed.success)
-                return { content: [{ type: "text", text: `Invalid input: ${parsed.error.issues[0].message}` }], isError: true };
+                return { content: [{ type: "text", text: `${parsed.error.issues[0].message}` }], isError: true };
             if (args?.confirm !== true) {
                 return {
                     content: [{
@@ -784,7 +784,7 @@ async function handleMemoryTool(name, args) {
         case "memory_insight": {
             const parsed = InsightSchema.safeParse(args);
             if (!parsed.success)
-                return { content: [{ type: "text", text: `Invalid input: ${parsed.error.issues[0].message}` }], isError: true };
+                return { content: [{ type: "text", text: `${parsed.error.issues[0].message}` }], isError: true };
             const { topic, depth = "standard" } = parsed.data;
             const memLimit = depth === "deep" ? 15 : depth === "quick" ? 5 : 8;
             // v3.25.1: hybrid retrieval for memory side (was semantic-only) so the
@@ -872,7 +872,7 @@ async function handleMemoryTool(name, args) {
         case "memory_extract": {
             const parsed = ExtractSchema.safeParse(args);
             if (!parsed.success)
-                return { content: [{ type: "text", text: `Invalid input: ${parsed.error.issues[0].message}` }], isError: true };
+                return { content: [{ type: "text", text: `${parsed.error.issues[0].message}` }], isError: true };
             const { text, facts, source = "extract" } = parsed.data;
             // ── PASS 1: hand the text back with the extraction rubric ───────────
             // Deciding what counts as a fact is judgement about *this user's*
@@ -929,7 +929,7 @@ async function handleMemoryTool(name, args) {
         case "memory_consolidate": {
             const parsed = ConsolidateSchema.safeParse(args);
             if (!parsed.success)
-                return { content: [{ type: "text", text: `Invalid input: ${parsed.error.issues[0].message}` }], isError: true };
+                return { content: [{ type: "text", text: `${parsed.error.issues[0].message}` }], isError: true };
             const { topic, limit = 12, summary } = parsed.data;
             const localConsolidateCfg = (0, local_memory_js_1.getLocalMemoryConfig)();
             // ── PASS 2: save the caller's merged version ────────────────────────

package/dist/tools/miroshark.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MIROSHARK_TOOLS = void 0;
 exports.handleMirosharkTool = handleMirosharkTool;
+const config_js_1 = require("../config.js");
 const CONVEX_SITE = process.env.FINCH_CONVEX_URL ?? "https://befitting-porcupine-276.convex.site";
 exports.MIROSHARK_TOOLS = [
     {
@@ -50,7 +51,13 @@ exports.MIROSHARK_TOOLS = [
 ];
 // ── HTTP helpers ──────────────────────────────────────────────────────────────
 function authHeaders() {
-    const key = process.env.FINCH_API_KEY ?? process.env.FINCH_SESSION_TOKEN;
+    // Bug fix: this used to read only process.env.FINCH_API_KEY/
+    // FINCH_SESSION_TOKEN directly, bypassing getSavedToken()'s env-var-then-
+    // saved-config fallback that every other tool goes through (via
+    // callConvex/callConvexRaw in convex.ts). A user authenticated via
+    // `finch login` (writes to ~/.finch/config.json, not an env var) got a
+    // silent, unauthenticated request here while every other tool worked.
+    const key = process.env.FINCH_API_KEY ?? (0, config_js_1.getSavedToken)();
     return key ? { Authorization: `Bearer ${key}` } : {};
 }
 async function miroJson(path, method, body, timeoutMs = 90000) {

package/dist/tools/monitor.js

@@ -106,7 +106,7 @@ async function handleMonitorTool(name, args) {
     if (name === "schedule_research") {
         const parsed = CreateSchema.safeParse(args);
         if (!parsed.success)
-            return { content: [{ type: "text", text: `Invalid input: ${parsed.error.issues[0].message}` }], isError: true };
+            return { content: [{ type: "text", text: `${parsed.error.issues[0].message}` }], isError: true };
         const key = getKey();
         if (!key)
             return noKeyMsg();
@@ -284,7 +284,7 @@ async function handleMonitorTool(name, args) {
     if (name === "cancel_monitor") {
         const parsed = CancelSchema.safeParse(args);
         if (!parsed.success)
-            return { content: [{ type: "text", text: `Invalid input: ${parsed.error.issues[0].message}` }], isError: true };
+            return { content: [{ type: "text", text: `${parsed.error.issues[0].message}` }], isError: true };
         if (args?.confirm !== true) {
             return {
                 content: [{

package/dist/tools/os.js

@@ -6,6 +6,7 @@ const convex_js_1 = require("../convex.js");
 const token_gate_js_1 = require("../token-gate.js");
 const wallet_js_1 = require("../wallet.js");
 const local_memory_js_1 = require("../local-memory.js");
+const config_js_1 = require("../config.js");
 const CONVEX_SITE = process.env.FINCH_CONVEX_URL ?? "https://befitting-porcupine-276.convex.site";
 exports.OS_TOOLS = [
     {
@@ -199,13 +200,18 @@ async function handleOsTool(name, args) {
             if (!message)
                 return { content: [{ type: "text", text: "Error: message is required" }] };
             try {
-                const res = await fetch(`${CONVEX_SITE}/noel/shell/chat`, {
+                // Bug fix: this used to read only process.env.FINCH_SESSION_TOKEN/
+                // FINCH_API_KEY directly, bypassing getSavedToken()'s fallback to
+                // ~/.finch/config.json - a user authenticated via `finch login`
+                // (not an env var) silently sent an empty Authorization header here
+                // while every other tool (which goes through callConvex) worked.
+                const res = await fetch(`${CONVEX_SITE}/finch/shell/chat`, {
                     method: "POST",
                     headers: {
                         "Content-Type": "application/json",
-                        "Authorization": `Bearer ${process.env.FINCH_SESSION_TOKEN ?? process.env.FINCH_API_KEY ?? ""}`,
+                        "Authorization": `Bearer ${(0, config_js_1.getSavedToken)() ?? process.env.FINCH_API_KEY ?? ""}`,
                     },
-                    body: JSON.stringify({ message, agentId: agent_id ?? "noel-default" }),
+                    body: JSON.stringify({ message, agentId: agent_id ?? "finch-default" }),
                     signal: AbortSignal.timeout(60000),
                 });
                 if (!res.ok) {

package/dist/tools/research-chain.js

@@ -147,7 +147,7 @@ async function handleResearchChain(name, args) {
         return null;
     const parsed = InputSchema.safeParse(args);
     if (!parsed.success) {
-        return { content: [{ type: "text", text: `Invalid input: ${parsed.error.issues[0].message}` }], isError: true };
+        return { content: [{ type: "text", text: `${parsed.error.issues[0].message}` }], isError: true };
     }
     const { startKey } = parsed.data;
     const maxDepth = parsed.data.maxDepth ?? 8;

package/dist/tools/research-compare.js

@@ -154,7 +154,7 @@ async function handleResearchCompare(name, args) {
         return null;
     const parsed = InputSchema.safeParse(args);
     if (!parsed.success) {
-        return { content: [{ type: "text", text: `Invalid input: ${parsed.error.issues[0].message}` }], isError: true };
+        return { content: [{ type: "text", text: `${parsed.error.issues[0].message}` }], isError: true };
     }
     const { keyA, keyB, focus, comparison } = parsed.data;
     const saveToVault = parsed.data.saveToVault ?? true;

package/dist/tools/research.js

@@ -100,7 +100,7 @@ async function handleResearchTool(name, args) {
     if (name === "web_scrape") {
         const parsed = ScrapeSchema.safeParse(args);
         if (!parsed.success)
-            return { content: [{ type: "text", text: `Invalid input: ${parsed.error.issues[0].message}` }], isError: true };
+            return { content: [{ type: "text", text: `${parsed.error.issues[0].message}` }], isError: true };
         const { url, focus } = parsed.data;
         const unsafe = await (0, public_url_js_1.assertPublicUrl)(url);
         if (unsafe) {
@@ -120,7 +120,7 @@ async function handleResearchTool(name, args) {
     if (name === "web_search") {
         const parsed = SearchSchema.safeParse(args);
         if (!parsed.success)
-            return { content: [{ type: "text", text: `Invalid input: ${parsed.error.issues[0].message}` }], isError: true };
+            return { content: [{ type: "text", text: `${parsed.error.issues[0].message}` }], isError: true };
         const { query, limit = 5 } = parsed.data;
         // Priority 1: user BYOK direct path. Priority 2: Finch proxy.
         // Same data shape so the formatting code below is identical for both.

package/dist/tools/rh-bridge.js

@@ -94,7 +94,7 @@ async function handleBridgeTool(name, args) {
         return null;
     const parsed = Schema.safeParse(args);
     if (!parsed.success) {
-        return { content: [{ type: "text", text: `Invalid input: ${parsed.error.issues[0].message}` }], isError: true };
+        return { content: [{ type: "text", text: `${parsed.error.issues[0].message}` }], isError: true };
     }
     const wanted = parsed.data.ticker?.trim().toUpperCase();
     const minGap = parsed.data.minGapPct ?? 0;

package/dist/tools/rh-mcp.js

@@ -30,6 +30,20 @@ exports.RH_RPC = process.env.ROBINHOOD_RPC_URL ??
     process.env.RH_RPC_URL ??
     process.env.FINCH_RH_RPC_URL ??
     "https://rpc.mainnet.chain.robinhood.com";
+/** Host only, for display in tool output - never the full RH_RPC. An
+ *  operator can point ROBINHOOD_RPC_URL/RH_RPC_URL at a keyed provider
+ *  (same pattern app/convex just fixed for its own Alchemy-key leak risk -
+ *  a `.../v2/<key>`-style URL echoed verbatim into a tool response lands the
+ *  key in chat transcripts/client logs). Falls back to the raw value only
+ *  if it isn't a parseable URL, which should never happen in practice. */
+function rhRpcDisplay() {
+    try {
+        return new URL(exports.RH_RPC).host;
+    }
+    catch {
+        return "(configured)";
+    }
+}
 exports.RH_EXPLORER = "https://robinhoodchain.blockscout.com";
 const NATIVE_ETH = "0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeEEeE";
 const RH_PERMIT2 = "0x000000000022D473030F116dDEE9F6B43aC78BA3";
@@ -754,7 +768,7 @@ async function fetchRhBalances(address) {
     else
         for (const h of holdings)
             lines.push(`- ${h.symbol}: ${h.bal}  \`${h.address}\``);
-    lines.push(``, `_RPC: ${exports.RH_RPC}_`, `_Explorer: ${exports.RH_EXPLORER}/address/${address}_`);
+    lines.push(``, `_RPC: ${rhRpcDisplay()}_`, `_Explorer: ${exports.RH_EXPLORER}/address/${address}_`);
     return lines.join("\n");
 }
 // ─── Onchain safety scan (Blockscout + DexScreener; free, no LLM) ─────────────
@@ -1177,7 +1191,7 @@ async function handleRhMcpTool(name, args) {
                 "",
                 `**Wallet**: \`${addr ?? "(not configured — run finch login / first tool)"}\``,
                 `**ETH on RH (gas)**: ${eth}`,
-                `**RPC**: ${exports.RH_RPC}`,
+                `**RPC**: ${rhRpcDisplay()}`,
                 `**Explorer**: ${exports.RH_EXPLORER}`,
                 `**Catalog**: ${exports.RH_STOCKS.length} stocks (AAPL…USAR) + any RH-chain crypto via DexScreener`,
                 "",

package/dist/tools/scanner.js

@@ -345,7 +345,7 @@ async function handleScannerTool(name, args) {
     if (name === "score_token") {
         const parsed = ScoreTokenSchema.safeParse(args);
         if (!parsed.success)
-            return { content: [{ type: "text", text: `Invalid input: ${parsed.error.issues[0].message}` }], isError: true };
+            return { content: [{ type: "text", text: `${parsed.error.issues[0].message}` }], isError: true };
         const { address, minLiquidity = DEFAULT_MIN_LIQ } = parsed.data;
         const data = await fetchJson(`https://api.dexscreener.com/latest/dex/tokens/${address}`);
         const pair = (data.pairs ?? [])
@@ -414,7 +414,7 @@ async function handleScannerTool(name, args) {
     if (name === "check_token") {
         const parsed = CheckTokenSchema.safeParse(args);
         if (!parsed.success)
-            return { content: [{ type: "text", text: `Invalid input: ${parsed.error.issues[0].message}` }], isError: true };
+            return { content: [{ type: "text", text: `${parsed.error.issues[0].message}` }], isError: true };
         const { address } = parsed.data;
         // GoPlusLabs - chain 8453 = Base mainnet
         const data = await fetchJson(`https://api.gopluslabs.io/api/v1/token_security/8453?contract_addresses=${address}`);
@@ -476,7 +476,7 @@ async function handleScannerTool(name, args) {
     if (name === "scan_market") {
         const parsed = ScanDipsSchema.safeParse(args ?? {});
         if (!parsed.success)
-            return { content: [{ type: "text", text: `Invalid input: ${parsed.error.issues[0].message}` }], isError: true };
+            return { content: [{ type: "text", text: `${parsed.error.issues[0].message}` }], isError: true };
         const input = args;
         const mode = input?.mode === "momentum" ? "momentum" : "dips";
         const { minScore = DEFAULT_MIN_SCORE, minLiquidity = DEFAULT_MIN_LIQ, limit = 40 } = parsed.data;

package/dist/tools/stake.js

@@ -134,6 +134,21 @@ exports.STAKE_TOOLS = [
             required: ["stakeId", "confirm"],
         },
     },
+    {
+        name: "claim_vested_rewards",
+        description: "Claim all your fully-vested USDG staking rewards to your custodial wallet. Daily rewards split " +
+            "50% instant / 50% vested over 3 days - this claims whatever portion has finished vesting across " +
+            "ALL your stakes in one call (check stake_finch_status for accrued totals; you'll also get a " +
+            "notification when rewards become claimable). Does nothing to the stake itself - principal stays " +
+            "staked and earning. Requires `finch login` and `confirm: true`.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                confirm: { type: "boolean", description: "Must be true to claim - this moves real USDG into your custodial wallet." },
+            },
+            required: ["confirm"],
+        },
+    },
     {
         name: "stake_auto_restake",
         description: "Turn auto-restake on/off for one of your stakes. When ON, the moment the lock-up ends the stake " +
@@ -143,7 +158,7 @@ exports.STAKE_TOOLS = [
             "the stake is unlockable and it just sits there earning nothing until you run unstake_finch. " +
             "Does NOT auto-compound rewards into the stake - that would require signing from your custodial " +
             "wallet unattended, which this intentionally does not do; claim rewards yourself with " +
-            "claimVestedRewards (you'll get a notification when they're ready). Requires `finch login`.",
+            "claim_vested_rewards (you'll get a notification when they're ready). Requires `finch login`.",
         inputSchema: {
             type: "object",
             properties: {
@@ -304,6 +319,31 @@ async function handleStakeTool(name, args) {
         }
         return { content: [{ type: "text", text: lines.join("\n") }] };
     }
+    if (name === "claim_vested_rewards") {
+        const { confirm } = (args ?? {});
+        if (confirm !== true) {
+            return {
+                content: [{ type: "text", text: "Refusing to claim without confirmation - pass `confirm: true`." }],
+                isError: true,
+            };
+        }
+        const login = requireLogin();
+        if (!login)
+            return { content: [{ type: "text", text: NOT_LOGGED_IN_MSG }], isError: true };
+        const result = await (0, convex_js_1.callConvex)("/mcp/stake/claim-rewards", "POST", {}, "claim_vested_rewards");
+        if (result.error)
+            return { content: [{ type: "text", text: `Claim failed: ${result.error}` }], isError: true };
+        return {
+            content: [{
+                    type: "text",
+                    text: [
+                        `✅ Claimed ${(result.claimedAmount ?? 0).toFixed(4)} USDG vested rewards`,
+                        `Tx: \`${result.txHash}\``,
+                        `${rh_mcp_js_1.RH_EXPLORER}/tx/${result.txHash}`,
+                    ].join("\n"),
+                }],
+        };
+    }
     if (name === "stake_auto_restake") {
         const { stakeId, enabled } = (args ?? {});
         if (!stakeId)