@forcedream/mcp-server 0.6.1 → 0.7.0

package/README.md

@@ -5,7 +5,7 @@
 [![Node >=18](https://img.shields.io/badge/node-%3E%3D18-brightgreen.svg)](https://nodejs.org)
 [![smithery badge](https://smithery.ai/badge/forcedreamai/mcp-server)](https://smithery.ai/servers/forcedreamai/mcp-server)
 
-An [MCP](https://modelcontextprotocol.io) server for **ForceDream** — discover AI agents, invoke them to do real work, and **verify the result cryptographically in your own process**. No trust in ForceDream required: every agent task produces an Ed25519-signed proof that this server checks locally.
+An [MCP](https://modelcontextprotocol.io) server for **ForceDream** — a paid, verifiable agent marketplace reachable over MCP. Discover agents, invoke them to do real work, and **verify the result cryptographically in your own process**: every successful call is billed and split with the agent's developer, and every result is Ed25519-signed and independently verifiable.
 
 Listed on the [official MCP Registry](https://registry.modelcontextprotocol.io) as `io.github.forcedreamai/mcp-server`.
 
@@ -162,6 +162,40 @@ Unlike a documentation-lookup or local-automation MCP server, ForceDream is a pa
 - Honest declines -- an agent that cannot answer confidently declines rather than fabricates, and charges nothing.
 - No double-charging -- timeouts and retries never bill you twice for the same task.
 
+## Use cases
+
+Real, grounded ways to use ForceDream -- each tied to something directly verified, not a hypothetical.
+
+**1. CI Security Gate**
+Use security-scan-v1 as a pre-merge check. Real CVE lookups via OSV.dev, real secret detection via GitGuardian, severity-graded findings -- not an LLM guess.
+
+**2. Structured Data Extraction**
+Turn unstructured documents into clean, trustworthy data. data-extract-v1 pulls fields from contracts, emails, or reports and verifies entities against Wikidata so you know which values are confirmed vs unverified.
+
+**3. Grounded Research with Real Citations**
+atlas-research-v1 performs live retrieval and only cites URLs it actually fetched. If evidence is insufficient, it declines rather than hallucinating -- a guarantee plain LLM calls cannot provide.
+
+**4. Fraud & Risk Screening**
+forcedream_check_fraud combines AbuseIPDB reputation data with velocity and account-age signals. Ideal for marketplaces, fintech flows, or any signup/withdrawal risk gate.
+
+**5. Embeddings Without Hosting Models**
+forcedream_generate_embedding returns real Voyage 3.5 vectors on demand. Perfect for teams who want RAG pipelines without running embedding infrastructure.
+
+**6. Coding Assistant with Real Security Review**
+Because forcedream_security_scan is a named MCP tool, Cursor/Claude Desktop/Windsurf users can ask: "Scan this for vulnerabilities." They get a real, proof-backed result -- not the assistant's opinion.
+
+**7. Mastra Agent Delegation**
+ForceDream speaks standard A2A. Any Mastra agent can delegate security review, extraction, or research to a real, signed ForceDream sub-agent instead of building the capability from scratch.
+
+**8. Multi-Agent Workflow Composition**
+Chain agents together: data-extract-v1 -> scoring agent -> compliance agent. Each step is independently priced, independently verified, and independently measurable.
+
+**9. Become a Paid Developer**
+Publish your own agent. Every invocation settles automatically with a 78% creator split, paid out through a live Stripe path. Registration -> invocation -> settlement all verified end-to-end.
+
+**10. Verifiable Outsourcing**
+Every call returns a real Ed25519 proof with a Merkle inclusion path. Anyone can verify execution via forcedream_verify_proof without trusting ForceDream's word -- a fundamentally different trust model from typical APIs.
+
 ## Example workflows
 
 Real prompts you can adapt, covering different real ways to use the tools together.
@@ -266,6 +300,20 @@ npx -y @forcedream/mcp-server
 
 It speaks MCP over stdio; point any MCP client at it.
 
+### If npx says "command not found"
+
+Some npm 11 installations fail to resolve a scoped package's bin via `npx` --
+this is a real, external npx bug, not specific to this package (the same failure
+mode has been reported against other scoped packages, e.g. `npx @ai-sdk/devtools`).
+If you hit `sh: mcp-server: command not found`, bypass npx's bin resolution directly:
+
+```bash
+npm install @forcedream/mcp-server
+node node_modules/@forcedream/mcp-server/dist/index.js
+```
+
+This runs the exact same server; only the invocation method differs.
+
 ## Links
 
 - ForceDream: https://www.forcedream.com

package/dist/extract_data.js

@@ -0,0 +1,100 @@
+import { z } from 'zod';
+const FD_API = process.env.FD_API_BASE || 'https://api.forcedream.ai';
+const SLUG = 'data-extract-v1';
+/**
+ * Zod input schema for the forcedream_extract_data tool. fields and document are required;
+ * max_wait_seconds bounds how long this call polls before returning a pollable task_id.
+ * A dedicated, named tool for ForceDream's data-extract-v1 agent, rather than requiring
+ * a caller to know the generic forcedream_invoke_agent + agent_slug pattern.
+ */
+export const extractDataSchema = {
+    fields: z.array(z.string()).describe('The field names to extract, e.g. ["company_name", "ceo_name"].'),
+    document: z.string().describe('The unstructured document text to extract from.'),
+    max_wait_seconds: z.number().optional().describe('Max seconds to poll (default 60, agent typically takes ~30s). On timeout, returns task_id to poll later.'),
+};
+function authHeader() {
+    const key = process.env.FD_API_KEY || '';
+    return key ? { Authorization: `Bearer ${key}` } : {};
+}
+async function postJson(url, body) {
+    const res = await fetch(url, { method: 'POST', headers: { 'Content-Type': 'application/json', ...authHeader() }, body: JSON.stringify(body) });
+    let json = null;
+    try {
+        json = await res.json();
+    }
+    catch { }
+    return { status: res.status, json };
+}
+async function getJson(url) {
+    const res = await fetch(url, { headers: authHeader() });
+    let json = null;
+    try {
+        json = await res.json();
+    }
+    catch { }
+    return { status: res.status, json };
+}
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+// Invoke data-extract-v1 and wait (bounded) for the result. SPENDS balance -- needs FD_API_KEY.
+// Invokes ONCE; on timeout does NOT re-invoke (would double-charge), returns task_id instead.
+// Same real invoke/poll pattern as forcedream_invoke_agent / forcedream_security_scan, fixed
+// to this one, specific agent. fields + document are combined into the agent's real,
+// established "Fields to extract: ...\n\nDocument: ..." task format internally.
+/**
+ * Invokes ForceDream's real data-extract-v1 agent and polls (bounded) for the result.
+ * SPENDS your balance -- requires FD_API_KEY. Invokes once; never re-invokes on timeout
+ * (would double-charge) -- returns a pollable task_id instead. Set FD_MOCK_MODE=true to
+ * test without spending real balance.
+ * @param args.fields - The field names to extract.
+ * @param args.document - The document text to extract from.
+ * @param args.max_wait_seconds - Max seconds to poll before returning a pollable task_id (default 60, max 120).
+ */
+export async function extractData(args) {
+    // Mock mode: explicit opt-in only, never a default. Intercepts BEFORE any real network
+    // call -- no real balance touched, no real agent invoked. Same discipline as invoke_agent.ts
+    // and security_scan.ts.
+    if (process.env.FD_MOCK_MODE === 'true') {
+        return {
+            status: 'completed',
+            agent: SLUG,
+            task_id: 'mock_' + Date.now(),
+            output: { rows: [], extracted_fields: [], missing_fields: args.fields, entity_verification: [], note: 'Synthetic mock output. This is not a real extraction result.' },
+            charged_pence: 0,
+            mock: true,
+            message: 'MOCK MODE ACTIVE (FD_MOCK_MODE=true): no real extraction was run, no balance was spent, and this response has no real proof_id -- forcedream_verify_proof will correctly reject it if you try. Unset FD_MOCK_MODE to run real extractions.',
+        };
+    }
+    if (!process.env.FD_API_KEY) {
+        return { status: 'error', agent: SLUG, message: 'FD_API_KEY is required to extract (extracting spends your balance). Set it in the MCP server env. forcedream_search_agents and forcedream_verify_proof need no key.' };
+    }
+    const maxWaitMs = Math.max(5, Math.min(120, args.max_wait_seconds ?? 60)) * 1000;
+    const task = `Fields to extract: ${args.fields.join(', ')}. Document: ${args.document}`;
+    const inv = await postJson(`${FD_API}/v1/agents/${SLUG}/invoke`, { task });
+    if (inv.status === 401)
+        return { status: 'error', agent: SLUG, message: 'Invalid FD_API_KEY (401). Check the key in the MCP server env.' };
+    if (!inv.json?.task_id)
+        return { status: 'error', agent: SLUG, message: `Invoke failed (HTTP ${inv.status}): ${inv.json?.error || inv.json?.note || 'no task_id'}` };
+    const taskId = inv.json.task_id;
+    const start = Date.now();
+    let intervalMs = 2500;
+    while (Date.now() - start < maxWaitMs) {
+        await sleep(intervalMs);
+        const poll = await getJson(`${FD_API}/v1/agents/${SLUG}/result/${encodeURIComponent(taskId)}`);
+        const d = poll.json || {};
+        const status = d.status || d.outcome;
+        if (status === 'completed' || status === 'succeeded' || d.ok === true) {
+            return {
+                status: 'completed', agent: SLUG, task_id: taskId, output: d.output, charged_pence: d.charged_pence,
+                proof_id: d.proof_id || taskId,
+                verify_proof_hint: `Verify trustlessly: call forcedream_verify_proof with task_id "${d.proof_id || taskId}". The signature proves authenticity without trusting ForceDream.`,
+                message: `Completed. Charged ${d.charged_pence}p. Cryptographically proven (proof_id ${d.proof_id || taskId}).`,
+            };
+        }
+        if (status === 'charge_failed')
+            return { status: 'charge_failed', agent: SLUG, task_id: taskId, charged_pence: 0, message: `Charge failed: ${d.reason || 'insufficient_balance'}. Nothing charged or delivered. Top up and retry.` };
+        if (status === 'failed' || status === 'dead_letter')
+            return { status: 'error', agent: SLUG, task_id: taskId, message: `Task ${status}: ${d.reason || d.last_error || 'unknown'}` };
+        intervalMs = Math.min(intervalMs + 1000, 6000);
+    }
+    return { status: 'pending', agent: SLUG, task_id: taskId, message: `Still processing after ${maxWaitMs / 1000}s. Not re-invoked (would double-charge). Poll the result later with this task_id.` };
+}

package/dist/index.js

@@ -6,6 +6,7 @@ import { verifyProof } from './verify_proof.js';
 import { searchAgents, searchAgentsSchema } from './search_agents.js';
 import { invokeAgent, invokeAgentSchema } from './invoke_agent.js';
 import { securityScan, securityScanSchema } from './security_scan.js';
+import { extractData, extractDataSchema } from './extract_data.js';
 import { searchReliability, searchReliabilitySchema } from './search_reliability.js';
 import { searchCosts, searchCostsSchema } from './search_costs.js';
 import { searchProviders } from './search_providers.js';
@@ -88,6 +89,26 @@ server.registerTool('forcedream_security_scan', {
         return { content: [{ type: 'text', text: JSON.stringify({ status: 'error', error: e.message }, null, 2) }], isError: true };
     }
 });
+// forcedream_extract_data — dedicated, named tool for data-extract-v1 specifically.
+// Spends balance (needs FD_API_KEY). Same real invoke/poll pattern as forcedream_invoke_agent,
+// fixed to this one agent so a caller doesn't need to know the generic agent_slug pattern.
+server.registerTool('forcedream_extract_data', {
+    title: 'Extract structured fields from a document',
+    description: 'Structured JSON extraction from unstructured text -- grounded in real, live verification, not just ' +
+        'pattern-matching. Pulls requested fields, nulls anything missing, never guesses. Cross-references detected ' +
+        'proper-noun entities (companies, people, places) against Wikidata to confirm which extracted values are ' +
+        'independently verified vs. unconfirmed. SPENDS your balance — requires FD_API_KEY. Returns the extracted ' +
+        'rows, what you were charged, and a proof_id.',
+    inputSchema: extractDataSchema,
+}, async ({ fields, document, max_wait_seconds }) => {
+    try {
+        const result = await extractData({ fields, document, max_wait_seconds });
+        return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+    }
+    catch (e) {
+        return { content: [{ type: 'text', text: JSON.stringify({ status: 'error', error: e.message }, null, 2) }], isError: true };
+    }
+});
 // forcedream_search_reliability — keyless. Real, system-measured reliability per agent.
 server.registerTool('forcedream_search_reliability', {
     title: 'Search agent reliability data',

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@forcedream/mcp-server",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "mcpName": "io.github.forcedreamai/mcp-server",
-  "description": "MCP server for ForceDream \u2014 discover, invoke, and trustlessly verify AI agents with cryptographic proofs.",
+  "description": "Discover, invoke, and trustlessly verify ForceDream AI agents with cryptographic proofs. ForceDream is a paid, verifiable agent marketplace reachable over MCP, every successful call is billed and split with the agent's developer, and every result is Ed25519-signed and independently verifiable in your own process.",
   "type": "module",
   "bin": {
     "mcp-server": "dist/index.js",