@finrock/mcp 0.1.0 → 1.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +6 -6
- package/dist/server.d.ts +1 -1
- package/dist/server.js +2 -2
- package/dist/setup.js +27 -7
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -2,13 +2,13 @@
|
|
|
2
2
|
|
|
3
3
|
[](https://insiders.vscode.dev/redirect/mcp/install?name=finrock&config=%7B%22type%22%3A%22http%22%2C%22url%22%3A%22https%3A%2F%2Fmcp.finrock.io%22%7D)
|
|
4
4
|
[](https://insiders.vscode.dev/redirect/mcp/install?name=finrock&config=%7B%22type%22%3A%22http%22%2C%22url%22%3A%22https%3A%2F%2Fmcp.finrock.io%22%7D&quality=insiders)
|
|
5
|
-
[](https://cursor.com/en/install-mcp?name=finrock&config=eyJ1cmwiOiJodHRwczovL21jcC5maW5yb2NrLmlvIn0=)
|
|
6
6
|
|
|
7
7
|
An [MCP](https://modelcontextprotocol.io) server that lets AI coding agents (Claude, Codex,
|
|
8
8
|
Cursor, VS Code Copilot and others) add [Finrock](https://finrock.io) crypto payments to any
|
|
9
9
|
application.
|
|
10
10
|
|
|
11
|
-
The hosted server at **`https://mcp.finrock.io`**
|
|
11
|
+
The hosted server at **`https://mcp.finrock.io`** needs no API key. It reads the live docs at
|
|
12
12
|
[apidocs.finrock.io](https://apidocs.finrock.io) and returns tested integration code, so an agent
|
|
13
13
|
can go from "accept USDT at checkout" to a working, secure implementation in your codebase. It
|
|
14
14
|
never touches anyone's Finrock account: API calls are signed with your private key, which stays
|
|
@@ -194,10 +194,10 @@ PUBLIC_KEY="$(openssl pkey -in mcp-registry-key.pem -pubout -outform DER | tail
|
|
|
194
194
|
echo "finrock.io. IN TXT \"v=MCPv1; k=ed25519; p=${PUBLIC_KEY}\"" # add this record to finrock.io
|
|
195
195
|
```
|
|
196
196
|
|
|
197
|
-
**Publishing to npm.** Bump the version everywhere (see above)
|
|
198
|
-
|
|
199
|
-
|
|
200
|
-
|
|
197
|
+
**Publishing to npm.** Bump the version everywhere (see above) and push to `main`. The `Release`
|
|
198
|
+
workflow sees the new version in `package.json`, runs the tests, publishes `@finrock/mcp` with npm
|
|
199
|
+
trusted publishing (no npm token is stored in the repo) and tags the commit `vX.Y.Z`. Pushing a
|
|
200
|
+
`vX.Y.Z` tag by hand also publishes, as long as it matches `package.json`. One-time setup on npmjs.com: package **Settings → Trusted
|
|
201
201
|
Publisher → GitHub Actions**, organization `gofinrock`, repository `mcp`, workflow `release.yml`.
|
|
202
202
|
|
|
203
203
|
Then for each release (after the npm publish, because the registry checks that the npm version
|
package/dist/server.d.ts
CHANGED
|
@@ -3,7 +3,7 @@ import { DocsClient } from "./docs.js";
|
|
|
3
3
|
import { type FinrockClient } from "./api/client.js";
|
|
4
4
|
import { type ApiToolOptions } from "./api/tools.js";
|
|
5
5
|
export declare const SERVER_NAME = "finrock";
|
|
6
|
-
export declare const SERVER_VERSION = "0.1
|
|
6
|
+
export declare const SERVER_VERSION = "1.0.1";
|
|
7
7
|
export interface ServerDeps {
|
|
8
8
|
docs?: DocsClient;
|
|
9
9
|
guidesDir?: string;
|
package/dist/server.js
CHANGED
|
@@ -7,7 +7,7 @@ import { verifyWebhookSignature } from "./webhook.js";
|
|
|
7
7
|
import { DEFAULT_API_URL, errorMessage, publicGet, withQuery } from "./api/client.js";
|
|
8
8
|
import { describeMode, registerApiTools } from "./api/tools.js";
|
|
9
9
|
export const SERVER_NAME = "finrock";
|
|
10
|
-
export const SERVER_VERSION = "0.1
|
|
10
|
+
export const SERVER_VERSION = "1.0.1";
|
|
11
11
|
const INSTRUCTIONS = `Finrock (https://finrock.io) is a non-custodial MPC wallet platform for accepting, holding and sending crypto. This server helps you add Finrock payments to an application. It reads the live Finrock docs and returns working integration code; it never touches anyone's Finrock account.
|
|
12
12
|
|
|
13
13
|
Suggested workflow:
|
|
@@ -133,7 +133,7 @@ export function createServer(deps = {}) {
|
|
|
133
133
|
});
|
|
134
134
|
server.registerTool("setup_account_access", {
|
|
135
135
|
title: "Set up Finrock account access securely",
|
|
136
|
-
description: "Step-by-step setup for the local package's account tools
|
|
136
|
+
description: "Step-by-step setup for the local package's account tools: generating the RSA key pair, adding an API user in the Finrock dashboard, and storing the API key and private key in the OS keychain (macOS Keychain, Linux Secret Service, Windows DPAPI) rather than in plain MCP config. Use it when the user wants the agent to work with their own Finrock account.",
|
|
137
137
|
inputSchema: {
|
|
138
138
|
os: z.enum(SETUP_OS).describe("The user's operating system"),
|
|
139
139
|
client: z
|
package/dist/setup.js
CHANGED
|
@@ -5,6 +5,8 @@
|
|
|
5
5
|
*/
|
|
6
6
|
export const SETUP_OS = ["macos", "linux", "windows"];
|
|
7
7
|
export const SETUP_CLIENTS = ["claude-code", "json-config"];
|
|
8
|
+
const QUICKSTART = "[Quickstart: add an API user](https://apidocs.finrock.io/quickstart#before-you-begin-add-an-api-user)";
|
|
9
|
+
const WHITELIST = "[Whitelist IPs](https://apidocs.finrock.io/guides/whitelist-ips)";
|
|
8
10
|
const KEYGEN = `openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:4096 -out finrock_private.pem
|
|
9
11
|
openssl pkey -in finrock_private.pem -pubout -out finrock_public.pem`;
|
|
10
12
|
/**
|
|
@@ -85,7 +87,7 @@ export function buildAccountSetup(os, client) {
|
|
|
85
87
|
|
|
86
88
|
The account tools run in the local package (\`npx @finrock/mcp\`) on the user's machine, which signs every request there. The hosted server at mcp.finrock.io never receives credentials. With this setup, neither key sits in plain text in the MCP config: the package reads each one from the keychain when it starts and keeps it only in memory.
|
|
87
89
|
|
|
88
|
-
**Rules for the agent:** never ask the user to paste the private key or the API key into the chat, and never print, log or commit either one. You may run
|
|
90
|
+
**Rules for the agent:** never ask the user to paste the private key or the API key into the chat, and never print, log or commit either one. You may run steps 1 and 2 for the user if you have a terminal. Steps 3 and 4 happen in the Finrock dashboard, and step 5 prompts for a secret, so the user must do those themselves (in Claude Code, prefix step 5's command with \`!\`).
|
|
89
91
|
|
|
90
92
|
## 1. Generate the key pair
|
|
91
93
|
|
|
@@ -97,27 +99,45 @@ ${fence(KEYGEN)}
|
|
|
97
99
|
|
|
98
100
|
${fence(s.storeKey)}
|
|
99
101
|
|
|
100
|
-
## 3.
|
|
102
|
+
## 3. Add an API user in the Finrock dashboard
|
|
101
103
|
|
|
102
|
-
|
|
104
|
+
The user does this in their browser (see ${QUICKSTART}):
|
|
105
|
+
|
|
106
|
+
1. Go to **Users**, click **Add new user** and choose **API User**.
|
|
107
|
+
2. **Title**: a name they'll recognise, for example \`AI agent (${s.label.split(" ")[0]})\`. Use a dedicated API user for the agent, not one shared with a production backend.
|
|
108
|
+
3. **Public Key (RSA 4096)**: paste or **Upload** \`finrock_public.pem\` from step 1. Don't use **Generate** here: that creates the private key outside this machine, and steps 1 and 2 already made one that never leaves it.
|
|
109
|
+
4. **Sub Accounts**: select only the sub-accounts the agent should work with, for example **Main Account**.
|
|
110
|
+
5. Click **Save**. A workspace owner must approve the new API user before it can make requests; it shows as **Active** in the users list once approved.
|
|
111
|
+
|
|
112
|
+
## 4. Copy the API key and restrict it to your IP
|
|
113
|
+
|
|
114
|
+
In the users list, click the key icon next to the API user and copy the **API key** (a UUID like \`4466c45a-7b28-4c50-a0f7-198f8d7f34c5\`). In the same window, add this machine's public IP under **IP Whitelist** (see ${WHITELIST}).
|
|
115
|
+
|
|
116
|
+
## 5. Store the API key
|
|
117
|
+
|
|
118
|
+
Run this and paste the API key at the prompt, not in the chat:
|
|
103
119
|
|
|
104
120
|
${fence(s.storeApiKey)}
|
|
105
121
|
|
|
106
|
-
##
|
|
122
|
+
## 6. Point the MCP client at the keychain
|
|
107
123
|
|
|
108
124
|
${clientConfig(os, client, s)}
|
|
109
125
|
|
|
110
126
|
Add \`FINROCK_READ_ONLY=true\` to expose read tools only, or \`FINROCK_ENABLE_SENSITIVE_TOOLS=true\` to also allow tools that move funds. Leave both out for read and create tools.
|
|
111
127
|
|
|
112
|
-
##
|
|
128
|
+
## 7. Check it
|
|
113
129
|
|
|
114
|
-
Restart the client. The server's log should say \`finrock-mcp: account tools on\`; ask the agent to call \`list_wallets\`.
|
|
130
|
+
Restart the client. The server's log should say \`finrock-mcp: account tools on\`; ask the agent to call \`list_wallets\`. If a request is rejected:
|
|
131
|
+
- The API user isn't **Active** yet: a workspace owner still has to approve it.
|
|
132
|
+
- HTTP 401: the uploaded public key doesn't match the stored private key, the stored API key is wrong, or the machine's clock is off.
|
|
133
|
+
- Access denied from an IP: add this machine's IP to the API user's **IP Whitelist**.
|
|
134
|
+
- A sub-account is missing: edit the API user and add it under **Sub Accounts**.
|
|
115
135
|
|
|
116
136
|
## Notes
|
|
117
137
|
|
|
118
138
|
- ${s.notes}
|
|
119
139
|
- With a password manager CLI, set the same variables to its read command instead, for example \`FINROCK_PRIVATE_KEY_COMMAND="op read op://Private/Finrock/private_key"\` for 1Password.
|
|
120
|
-
- To rotate,
|
|
140
|
+
- To rotate, repeat steps 1 to 5 with a new API user (steps 2 and 5 overwrite the stored items), then remove the old API user in the dashboard.
|
|
121
141
|
- Claude on the web and mobile can't run local servers; use Claude Code, Claude Desktop or another client that supports stdio servers.
|
|
122
142
|
- In the user's own application, store the same kind of credentials in that app's server-side secret store (environment variables, a cloud secret manager or KMS), never in browser code or the repository.`;
|
|
123
143
|
}
|