@finchagentic/mcp 4.6.2 → 4.6.3

package/dist/tools/base.js

@@ -0,0 +1,283 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BASE_TOOLS = void 0;
+exports.handleBaseTool = handleBaseTool;
+const MORPHO_API = "https://blue-api.morpho.org/graphql";
+const MOONWELL_API = "https://api.moonwell.fi/v1/markets";
+/** Morpho's public API occasionally 403s transiently (rate-limit/WAF blip,
+ * confirmed by hand: identical requests succeed moments later) - one retry
+ * after a short delay clears most of these without adding real latency to
+ * the common case. */
+async function fetchMorphoGql(query) {
+    for (let attempt = 0; attempt < 2; attempt++) {
+        if (attempt > 0)
+            await new Promise((r) => setTimeout(r, 800));
+        const res = await fetch(MORPHO_API, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ query }),
+            signal: AbortSignal.timeout(15000),
+        });
+        if (res.ok)
+            return res.json();
+        if (attempt === 1)
+            throw new Error(`Morpho API error: ${res.status} (after retry)`);
+    }
+}
+exports.BASE_TOOLS = [
+    {
+        name: "base_mcp_yield_vaults",
+        description: "Find the best yield/earning opportunities on Base chain using Morpho vaults - queries Morpho's own " +
+            "API directly, so numbers are fresher than get_defi_yields' DeFiLlama-aggregated Morpho figures, " +
+            "but this tool only covers Morpho (not Aerodrome/Uniswap/other protocols - use get_defi_yields for " +
+            "cross-protocol comparison). Returns all vaults ranked by APY — use this when the user asks about " +
+            "yield farming, APY, best rates to earn, where to put USDC, or passive income on Base. For yield on " +
+            "a specific token, also see base_mcp_lend.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                asset: {
+                    type: "string",
+                    description: "Filter by asset symbol (e.g. USDC, WETH, cbBTC). Leave empty for all.",
+                },
+                limit: {
+                    type: "number",
+                    description: "Max vaults to return (default 10)",
+                },
+            },
+            required: [],
+        },
+    },
+    {
+        name: "base_mcp_lending_rates",
+        description: "Get lending and borrowing rates across all Moonwell markets on Base - queries Moonwell's own API " +
+            "directly, so numbers are fresher than get_defi_yields' DeFiLlama-aggregated Moonwell figures, but " +
+            "this tool only covers Moonwell (use get_defi_yields for cross-protocol comparison, or " +
+            "base_mcp_yield_vaults for Morpho specifically). Returns supply APY, borrow APY, liquidity, and " +
+            "utilization per asset. Use when the user asks about borrow rates, lending rates, interest rates, " +
+            "or supply APY on Base.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                asset: {
+                    type: "string",
+                    description: "Filter by asset symbol (e.g. USDC, ETH, cbBTC). Leave empty for all.",
+                },
+            },
+            required: [],
+        },
+    },
+    {
+        name: "base_mcp_deposit_guide",
+        description: "Get step-by-step deposit instructions for a Morpho vault — shows the vault address, expected APY, and manual deposit steps. Does NOT execute the transaction. Call base_mcp_yield_vaults first to find the vault, then call this to get instructions.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                vaultName: {
+                    type: "string",
+                    description: "Name or partial name of the vault (e.g. 'Gauntlet USDC', 'steakUSDC')",
+                },
+                amount: {
+                    type: "string",
+                    description: "Amount to deposit (e.g. '100', '1000')",
+                },
+                asset: {
+                    type: "string",
+                    description: "Asset to deposit (e.g. USDC, WETH)",
+                },
+            },
+            required: ["asset", "amount"],
+        },
+    },
+    {
+        name: "base_mcp_network",
+        description: "Get real-time Base network stats: ETH price in USD, gas price in gwei, and latest block number. Use when the user asks about gas fees, ETH price, Base network status, or current block. Does not require wallet auth.",
+        inputSchema: {
+            type: "object",
+            properties: {},
+            required: [],
+        },
+    },
+];
+// ── Helpers ────────────────────────────────────────────────────────────────────
+function fmt(n, decimals = 2) {
+    if (n >= 1000000000)
+        return `$${(n / 1000000000).toFixed(1)}B`;
+    if (n >= 1000000)
+        return `$${(n / 1000000).toFixed(1)}M`;
+    if (n >= 1000)
+        return `$${(n / 1000).toFixed(1)}K`;
+    return `$${n.toFixed(decimals)}`;
+}
+function pct(n) {
+    return `${(n * 100).toFixed(2)}%`;
+}
+// ── Morpho vaults ─────────────────────────────────────────────────────────────
+async function fetchMorphoVaults(asset, limit = 10) {
+    const gql = `{
+    vaults(
+      where: { chainId_in: [8453] }
+      orderBy: NetApy
+      orderDirection: Desc
+      first: 50
+    ) {
+      items {
+        name
+        address
+        asset { symbol name }
+        state { apy netApy totalAssetsUsd }
+      }
+    }
+  }`;
+    const data = await fetchMorphoGql(gql);
+    let vaults = data?.data?.vaults?.items ?? [];
+    // Filter out test/spam vaults: min $10k TVL, max 500% APY
+    vaults = vaults.filter((v) => {
+        const tvl = v.state?.totalAssetsUsd ?? 0;
+        const apy = v.state?.netApy ?? v.state?.apy ?? 0;
+        return tvl >= 10000 && apy <= 5;
+    });
+    if (asset) {
+        vaults = vaults.filter((v) => v.asset?.symbol?.toLowerCase().includes(asset.toLowerCase()));
+    }
+    vaults = vaults.slice(0, limit);
+    if (!vaults.length)
+        return "No vaults found for that asset.";
+    const lines = vaults.map((v, i) => {
+        const apy = pct(v.state?.netApy ?? v.state?.apy ?? 0);
+        const tvl = fmt(v.state?.totalAssetsUsd ?? 0);
+        const addr = `${v.address?.slice(0, 6)}...${v.address?.slice(-4)}`;
+        return `${i + 1}. ${v.name}\n   Asset: ${v.asset?.symbol}  APY: ${apy}  TVL: ${tvl}\n   Address: ${addr}`;
+    });
+    return `Morpho Vaults on Base (sorted by APY):\n\n${lines.join("\n\n")}`;
+}
+// ── Moonwell markets ───────────────────────────────────────────────────────────
+async function fetchMoonwellMarkets(asset) {
+    const res = await fetch(`${MOONWELL_API}?network=base`, {
+        signal: AbortSignal.timeout(15000),
+    });
+    if (!res.ok)
+        throw new Error(`Moonwell API error: ${res.status}`);
+    const data = await res.json();
+    let markets = Array.isArray(data) ? data : (data?.data ?? data?.markets ?? []);
+    // Filter deprecated markets
+    markets = markets.filter((m) => !m.deprecated);
+    if (asset) {
+        markets = markets.filter((m) => (m.asset ?? m.underlyingSymbol ?? m.symbol ?? "").toLowerCase().includes(asset.toLowerCase()));
+    }
+    if (!markets.length)
+        return "No markets found.";
+    const lines = markets.slice(0, 15).map((m, i) => {
+        const symbol = m.asset ?? m.underlyingSymbol ?? m.symbol ?? "?";
+        const supplyApy = pct((m.baseSupplyApy ?? m.supplyApy ?? m.supplyRate ?? 0) / 100);
+        const borrowApy = pct((m.baseBorrowApy ?? m.borrowApy ?? m.borrowRate ?? 0) / 100);
+        const liquidity = fmt(m.totalSupplyUsd ?? m.liquidityUsd ?? m.totalSupply ?? 0);
+        const util = m.utilization != null ? `${(m.utilization * 100).toFixed(1)}%` : "-";
+        return `${i + 1}. ${symbol}\n   Supply APY: ${supplyApy}  Borrow APY: ${borrowApy}  Liquidity: ${liquidity}  Util: ${util}`;
+    });
+    return `Moonwell Markets on Base:\n\n${lines.join("\n\n")}`;
+}
+// ── Base chain stats ───────────────────────────────────────────────────────────
+async function fetchBaseStats() {
+    const rpc = "https://mainnet.base.org";
+    const [blockRes, priceRes, gasRes] = await Promise.all([
+        fetch(rpc, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "eth_blockNumber", params: [] }),
+            signal: AbortSignal.timeout(8000),
+        }).then(r => r.json()).catch(() => null),
+        fetch("https://api.coingecko.com/api/v3/simple/price?ids=ethereum&vs_currencies=usd", {
+            signal: AbortSignal.timeout(8000),
+        }).then(r => r.json()).catch(() => null),
+        fetch(rpc, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ jsonrpc: "2.0", id: 2, method: "eth_gasPrice", params: [] }),
+            signal: AbortSignal.timeout(8000),
+        }).then(r => r.json()).catch(() => null),
+    ]);
+    const block = blockRes?.result ? parseInt(blockRes.result, 16) : "-";
+    const ethPrice = priceRes?.ethereum?.usd ?? "-";
+    const gasPriceGwei = gasRes?.result
+        ? (parseInt(gasRes.result, 16) / 1e9).toFixed(4)
+        : "-";
+    return `Base Chain Stats:\n\n• ETH Price: $${ethPrice}\n• Gas Price: ${gasPriceGwei} gwei\n• Latest Block: ${block.toLocaleString()}\n• Network: Base Mainnet (Chain ID 8453)`;
+}
+// ── Prepare deposit info ───────────────────────────────────────────────────────
+async function prepareDeposit(vaultName, asset, amount) {
+    const gql = `{
+    vaults(
+      where: { chainId_in: [8453] }
+      orderBy: NetApy
+      orderDirection: Desc
+      first: 100
+    ) {
+      items {
+        name
+        address
+        asset { symbol name }
+        state { netApy apy totalAssetsUsd }
+      }
+    }
+  }`;
+    const data = await fetchMorphoGql(gql);
+    let vaults = data?.data?.vaults?.items ?? [];
+    // Filter by asset first
+    vaults = vaults.filter((v) => v.asset?.symbol?.toLowerCase() === asset.toLowerCase());
+    // Filter by vault name if provided
+    if (vaultName) {
+        const match = vaults.find((v) => v.name?.toLowerCase().includes(vaultName.toLowerCase()));
+        if (match)
+            vaults = [match];
+    }
+    // Take best APY vault
+    const vault = vaults[0];
+    if (!vault) {
+        return `No Morpho vault found for ${asset} on Base. Try base_mcp_yield_vaults to see available vaults.`;
+    }
+    const apy = pct(vault.state?.netApy ?? vault.state?.apy ?? 0);
+    const tvl = fmt(vault.state?.totalAssetsUsd ?? 0);
+    return [
+        `Morpho Vault Deposit Instructions`,
+        ``,
+        `Vault: ${vault.name}`,
+        `Asset: ${vault.asset?.symbol}`,
+        `APY: ${apy}  |  TVL: ${tvl}`,
+        `Contract: ${vault.address}`,
+        ``,
+        `Steps to deposit ${amount} ${asset}:`,
+        `1. Go to app.morpho.org or use the vault address above`,
+        `2. Connect your wallet (ensure you have ${amount} ${asset})`,
+        `3. Approve the vault contract to spend your ${asset}`,
+        `4. Call deposit(${amount}, yourAddress) on the vault contract`,
+        `5. You'll receive vault shares representing your deposit`,
+        ``,
+        `Expected yield: ~${apy} on ${amount} ${asset}`,
+        `Note: APY is variable and changes based on market conditions.`,
+    ].join("\n");
+}
+// ── Handler ────────────────────────────────────────────────────────────────────
+async function handleBaseTool(name, args) {
+    const a = (args ?? {});
+    switch (name) {
+        case "base_mcp_yield_vaults": {
+            const text = await fetchMorphoVaults(a.asset, a.limit ?? 10);
+            return { content: [{ type: "text", text }] };
+        }
+        case "base_mcp_lending_rates": {
+            const text = await fetchMoonwellMarkets(a.asset);
+            return { content: [{ type: "text", text }] };
+        }
+        case "base_mcp_deposit_guide": {
+            const text = await prepareDeposit(a.vaultName, a.asset, a.amount);
+            return { content: [{ type: "text", text }] };
+        }
+        case "base_mcp_network": {
+            const text = await fetchBaseStats();
+            return { content: [{ type: "text", text }] };
+        }
+        default:
+            return null;
+    }
+}

package/dist/tools/chronicle.js

@@ -0,0 +1,268 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CHRONICLE_TOOLS = void 0;
+exports.buildChronicleList = buildChronicleList;
+exports.buildChronicleSearch = buildChronicleSearch;
+exports.buildChronicleStats = buildChronicleStats;
+exports.handleChronicle = handleChronicle;
+const convex_js_1 = require("../convex.js");
+const CHRONICLE_TYPES = ["vault", "memory", "agent", "tool", "automation", "monitor", "system", "custom"];
+exports.CHRONICLE_TOOLS = [
+    {
+        name: "chronicle_add",
+        description: "Log an event to Finch Chronicle - the system-wide audit log for your AI runtime. " +
+            "Records anything meaningful: vault saves, agent updates, automation triggers, " +
+            "custom milestones, research completions. Chronicle is your permanent timeline of what happened. " +
+            "Types: vault | memory | agent | tool | automation | monitor | system | custom.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                type: {
+                    type: "string",
+                    enum: [...CHRONICLE_TYPES],
+                    description: "Event category",
+                },
+                title: {
+                    type: "string",
+                    description: "Short event title, e.g. 'Saved ETH research to vault'",
+                },
+                detail: {
+                    type: "string",
+                    description: "Optional longer description or result summary",
+                },
+                metadata: {
+                    type: "object",
+                    description: "Optional extra data (key, agentId, topic, etc.)",
+                },
+            },
+            required: ["type", "title"],
+        },
+    },
+    {
+        name: "chronicle_list",
+        description: "Read the Finch Chronicle event log - your AI runtime timeline. Returns recent events in reverse chronological order. " +
+            "Filter by type to see only vault saves, agent activity, automations, etc.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                limit: {
+                    type: "number",
+                    description: "Max events to return (default 20, max 100)",
+                },
+                type: {
+                    type: "string",
+                    enum: [...CHRONICLE_TYPES],
+                    description: "Filter by event type (optional)",
+                },
+            },
+        },
+    },
+    {
+        name: "chronicle_search",
+        description: "Search the Finch Chronicle by keyword. Matches against event titles and details. " +
+            "Useful for finding when something specific happened: 'when did I last research ETH?' or 'find all vault saves for Base'.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                query: {
+                    type: "string",
+                    description: "Keyword or phrase to search for in event titles and details",
+                },
+                type: {
+                    type: "string",
+                    enum: [...CHRONICLE_TYPES],
+                    description: "Optional: filter by event type before searching",
+                },
+                limit: {
+                    type: "number",
+                    description: "Max results to return (default 10, max 50)",
+                },
+            },
+            required: ["query"],
+        },
+    },
+    {
+        name: "chronicle_stats",
+        description: "Activity stats for your AI runtime - breakdown by event type, daily activity heatmap, " +
+            "busiest days, and most active categories. Use to understand how heavily you're using the runtime.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                days: {
+                    type: "number",
+                    description: "How many days back to analyze (default 30, max 90)",
+                },
+            },
+        },
+    },
+];
+// Keep "swarm" emoji for backward compatibility - legacy chronicle entries
+// may still have this type even though it's no longer accepted on new writes.
+const TYPE_EMOJI = {
+    vault: "🗄️",
+    memory: "🧠",
+    agent: "🤖",
+    tool: "🔧",
+    automation: "⚡",
+    monitor: "👁️",
+    system: "⚙️",
+    custom: "📌",
+    swarm: "🐝",
+};
+function formatEntry(e) {
+    const emoji = TYPE_EMOJI[e.type] ?? "📌";
+    const date = new Date(e.ts).toLocaleString("en-US", {
+        month: "short", day: "numeric",
+        hour: "2-digit", minute: "2-digit",
+    });
+    const lines = [`${emoji} **${e.title}** · \`${e.type}\` · ${date}`];
+    if (e.detail)
+        lines.push(`   ${e.detail}`);
+    return lines.join("\n");
+}
+// ── Structured output builders (schemas in output-schemas.ts) ───────────────
+function chronicleEntry(e) {
+    return { title: e.title ?? null, detail: e.detail ?? null, type: e.type ?? null, ts: e.ts ?? null };
+}
+function buildChronicleList(type, entries) {
+    return { type: type ?? null, count: entries.length, entries: entries.map(chronicleEntry) };
+}
+function buildChronicleSearch(query, type, matched) {
+    return { query, type: type ?? null, count: matched.length, entries: matched.map(chronicleEntry) };
+}
+function buildChronicleStats(days, entries) {
+    const byType = {};
+    const byDay = {};
+    for (const e of entries) {
+        byType[e.type] = (byType[e.type] ?? 0) + 1;
+        const day = new Date(e.ts).toISOString().slice(0, 10);
+        byDay[day] = (byDay[day] ?? 0) + 1;
+    }
+    const busiestDays = Object.entries(byDay).sort((a, b) => b[1] - a[1]).slice(0, 5).map(([day, count]) => ({ day, count }));
+    return {
+        days,
+        totalEvents: entries.length,
+        activeDays: Object.keys(byDay).length,
+        avgPerDay: entries.length / days,
+        byType: Object.entries(byType).sort((a, b) => b[1] - a[1]).map(([type, count]) => ({ type, count })),
+        busiestDays,
+    };
+}
+async function handleChronicle(name, args) {
+    if (name === "chronicle_add") {
+        const { type = "custom", title, detail, metadata } = args;
+        await (0, convex_js_1.callConvex)("/chronicle/add", "POST", {
+            type,
+            title,
+            detail,
+            metadata,
+            source: "mcp",
+        }, "chronicle_add");
+        const emoji = TYPE_EMOJI[type] ?? "📌";
+        return {
+            content: [{
+                    type: "text",
+                    text: [
+                        `${emoji} **Logged to Chronicle**`,
+                        ``,
+                        `**${title}**${detail ? `\n${detail}` : ""}`,
+                        ``,
+                        `Type: \`${type}\` · Use \`chronicle_list\` to view your timeline.`,
+                    ].join("\n"),
+                }],
+        };
+    }
+    if (name === "chronicle_list") {
+        const limit = Math.min(Number(args.limit ?? 20), 100);
+        const type = args.type;
+        const data = await (0, convex_js_1.callConvex)(`/chronicle/list?limit=${limit}${type ? `&type=${type}` : ""}`, "GET", undefined, "chronicle_list");
+        const entries = data.entries ?? [];
+        if (entries.length === 0) {
+            return {
+                content: [{
+                        type: "text",
+                        text: "No chronicle entries yet. Use `chronicle_add` to start logging events.",
+                    }],
+                structuredContent: buildChronicleList(type, []),
+            };
+        }
+        const lines = [
+            `## 📜 Finch Chronicle${type ? ` · ${type}` : ""}`,
+            `*${entries.length} event${entries.length !== 1 ? "s" : ""}*`,
+            "",
+        ];
+        for (const e of entries)
+            lines.push(formatEntry(e));
+        return { content: [{ type: "text", text: lines.join("\n") }], structuredContent: buildChronicleList(type, entries) };
+    }
+    if (name === "chronicle_search") {
+        const { query, type, limit = 10 } = args;
+        if (!query)
+            return { content: [{ type: "text", text: "query is required" }], isError: true };
+        const data = await (0, convex_js_1.callConvex)(`/chronicle/list?limit=100${type ? `&type=${type}` : ""}`, "GET", undefined, "chronicle_list");
+        const allEntries = data.entries ?? [];
+        const q = query.toLowerCase();
+        const matched = allEntries.filter((e) => (e.title ?? "").toLowerCase().includes(q) ||
+            (e.detail ?? "").toLowerCase().includes(q)).slice(0, Math.min(Number(limit), 50));
+        if (matched.length === 0) {
+            return {
+                content: [{
+                        type: "text",
+                        text: `No chronicle events matching "${query}"${type ? ` (type: ${type})` : ""}. (searched most recent 100 entries)`,
+                    }],
+                structuredContent: buildChronicleSearch(query, type, []),
+            };
+        }
+        const lines = [
+            `## 🔍 Chronicle Search: "${query}"`,
+            `*${matched.length} match${matched.length !== 1 ? "es" : ""}${type ? ` · type: ${type}` : ""} · searched most recent 100 entries*`,
+            "",
+        ];
+        for (const e of matched)
+            lines.push(formatEntry(e));
+        return { content: [{ type: "text", text: lines.join("\n") }], structuredContent: buildChronicleSearch(query, type, matched) };
+    }
+    if (name === "chronicle_stats") {
+        const days = Math.min(Number(args.days ?? 30), 90);
+        const cutoff = Date.now() - days * 24 * 60 * 60 * 1000;
+        const data = await (0, convex_js_1.callConvex)(`/chronicle/list?limit=100`, "GET", undefined, "chronicle_list");
+        const allEntries = (data.entries ?? []).filter((e) => (e.ts ?? 0) >= cutoff);
+        if (allEntries.length === 0) {
+            return {
+                content: [{ type: "text", text: `No chronicle events in the past ${days} days.` }],
+                structuredContent: buildChronicleStats(days, []),
+            };
+        }
+        // Count by type
+        const byType = {};
+        const byDay = {};
+        for (const e of allEntries) {
+            byType[e.type] = (byType[e.type] ?? 0) + 1;
+            const day = new Date(e.ts).toISOString().slice(0, 10);
+            byDay[day] = (byDay[day] ?? 0) + 1;
+        }
+        const sortedTypes = Object.entries(byType).sort((a, b) => b[1] - a[1]);
+        const sortedDays = Object.entries(byDay).sort((a, b) => b[1] - a[1]);
+        const activeDays = Object.keys(byDay).length;
+        const avgPerDay = (allEntries.length / days).toFixed(1);
+        const lines = [
+            `## 📊 Chronicle Stats — last ${days} days`,
+            ``,
+            `**Total events:** ${allEntries.length} across ${activeDays} active day${activeDays !== 1 ? "s" : ""} (avg ${avgPerDay}/day)`,
+            ``,
+            `**By type:**`,
+            ...sortedTypes.map(([t, n]) => {
+                const bar = "█".repeat(Math.round((n / allEntries.length) * 20));
+                const emoji = TYPE_EMOJI[t] ?? "📌";
+                return `  ${emoji} ${t.padEnd(12)} ${String(n).padStart(3)}  ${bar}`;
+            }),
+            ``,
+            `**Busiest days:**`,
+            ...sortedDays.slice(0, 5).map(([d, n]) => `  ${d}  ${n} event${n !== 1 ? "s" : ""}`),
+            ``,
+            `*Note: stats based on most recent 100 entries*`,
+        ];
+        return { content: [{ type: "text", text: lines.join("\n") }], structuredContent: buildChronicleStats(days, allEntries) };
+    }
+    return { content: [{ type: "text", text: `Unknown chronicle tool: ${name}` }], isError: true };
+}

package/dist/tools/coder.js

@@ -0,0 +1,94 @@
+"use strict";
+// Solidity static analysis.
+//
+// This module used to also generate, explain and review code via a server-side
+// LLM. Those were removed: the MCP client (Claude Code, Cursor, the CLI's own
+// agent loop) is already a model, and it does that work better because it has
+// the repository in context. What survives here is the part a model cannot do
+// for itself — a deterministic pattern scan over the source.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CODER_TOOLS = void 0;
+exports.handleCoderTool = handleCoderTool;
+const zod_1 = require("zod");
+const _solidity_scan_js_1 = require("./_solidity-scan.js");
+function ok(text) {
+    return { content: [{ type: "text", text }] };
+}
+function err(text) {
+    return { content: [{ type: "text", text }], isError: true };
+}
+exports.CODER_TOOLS = [
+    {
+        name: "audit_contract",
+        description: "Run a deterministic static scan over Solidity source for common antipatterns " +
+            "(tx.origin auth, reentrancy ordering, unchecked low-level calls, delegatecall hijack, " +
+            "floating pragma, etc). Returns the findings with severities plus a review rubric for YOU " +
+            "to work through — you are the reviewer, and you have the repo in context. " +
+            "Needs no API key. Not a substitute for a professional audit (CertiK, Trail of Bits, " +
+            "OpenZeppelin) or formal verification.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                code: {
+                    type: "string",
+                    description: "The full Solidity contract source code to audit",
+                },
+                focus: {
+                    type: "array",
+                    items: { type: "string" },
+                    description: "Optional: specific areas to focus on, e.g. ['reentrancy', 'access control', 'overflow']",
+                },
+            },
+            required: ["code"],
+        },
+    },
+];
+const AuditSchema = zod_1.z.object({
+    code: zod_1.z.string().min(10),
+    focus: zod_1.z.array(zod_1.z.string()).optional(),
+});
+async function handleCoderTool(name, args) {
+    if (name !== "audit_contract")
+        return null;
+    const p = AuditSchema.safeParse(args);
+    if (!p.success)
+        return err(p.error.issues[0].message);
+    const { code, focus = [] } = p.data;
+    // The pattern scan grounds the review. Without it an audit is pure model
+    // opinion — someone might trust "looks safe" with nothing behind it.
+    const findings = (0, _solidity_scan_js_1.staticScanSolidity)(code);
+    const findingsBlock = (0, _solidity_scan_js_1.formatFindings)(findings);
+    const criticalCount = findings.filter((f) => f.severity === "critical").length;
+    const highCount = findings.filter((f) => f.severity === "high").length;
+    // The rubric travels with the findings rather than being applied out of sight,
+    // so the discipline the old server-side prompt enforced is preserved.
+    const rubric = (focus.length ? `**User-requested focus:** ${focus.join(", ")}\n\n` : "") +
+        `## How to review this\n\n` +
+        `**Overall risk** — Critical / High / Medium / Low / Informational, plus one sentence of ` +
+        `justification. The scan found **${criticalCount} critical** and **${highCount} high**; where that ` +
+        `is ≥1 critical or ≥2 high, your rating must be at least High unless you explicitly refute those ` +
+        `findings with reasoning.\n\n` +
+        `**Static findings review** — one line per finding, none skipped:\n` +
+        `\`- **<ID>** — confirmed / refuted / needs-context — (1-3 sentences)\`\n\n` +
+        `**Additional findings** the scan cannot catch (severity, location, description, recommendation), ` +
+        `or "No additional findings."\n\n` +
+        `**Gas optimizations** — 2-5 concrete savings, skip if already tight.\n\n` +
+        `**Positive patterns** — 3-5 bullets max.\n\n` +
+        `Never call the contract "secure" or "safe" — that implies a guarantee no review can make. ` +
+        `Prefer "no obvious issues found in X under Y", and say where you are uncertain.`;
+    return ok([
+        `# Smart Contract Audit — static scan`,
+        ``,
+        `**${findings.length} finding(s)** — ${criticalCount} critical · ${highCount} high · ` +
+            `${findings.length - criticalCount - highCount} medium/low/info`,
+        ``,
+        `## Automated static scan findings`,
+        ``,
+        findingsBlock,
+        ``,
+        `---`,
+        ``,
+        rubric,
+        _solidity_scan_js_1.AUDIT_DISCLAIMER,
+    ].join("\n"));
+}