@forgemeshlabs/utility-grid-mcp 0.1.0 → 0.1.2

package/CHANGELOG.md

@@ -0,0 +1,11 @@
+# Changelog
+
+## 0.1.1
+
+- Updated MCP dependencies to resolve security advisories.
+- Added Glama, Docker, Smithery, and official MCP Registry metadata.
+- Clarified free discovery and paid execution behavior.
+
+## 0.1.0
+
+- Initial release with six tools for discovering and calling Utility Grid APIs.

package/Dockerfile

@@ -1,11 +1,11 @@
-FROM node:20-slim
+FROM node:22-bookworm-slim
 
 WORKDIR /app
 
 COPY package.json package-lock.json ./
 RUN npm ci --omit=dev
 
-COPY index.js README.md LICENSE server.json glama.json GLAMA.md smithery.yaml ./
+COPY index.js README.md LICENSE SECURITY.md CHANGELOG.md server.json glama.json GLAMA.md smithery.yaml ./
 RUN chmod +x /app/index.js
 
 ENV NODE_ENV=production \
@@ -13,4 +13,4 @@ ENV NODE_ENV=production \
 
 USER node
 
-ENTRYPOINT ["node", "index.js"]
+CMD ["node", "index.js"]

package/README.md

@@ -1,8 +1,8 @@
-# ForgeMesh Utility Grid — Agent Utility APIs via x402
+# ForgeMesh Utility Grid MCP
 
 *A [ForgeMesh Labs](https://forgemesh.io) product.*
 
-**415+ small agent utility jobs behind 6 tools, not 415.** OCR, vision, audio, embeddings, web extraction, dictionary and slang lookups, chess/legal-move logic, math, conversions, time, geo/space data, and x402 ecosystem intelligence — all paid per call in USDC on Base via [x402](https://x402.org). No API key, no account.
+Search and use more than 400 practical APIs without loading hundreds of tools into your agent. Utility Grid exposes six compact MCP tools for OCR, image and audio processing, web extraction, math, conversions, geodata, and more. Catalog discovery is free; API execution is paid per call in USDC on Base through [x402](https://x402.org). No account or API key is required.
 
 Rather than exposing one MCP tool per route (unmanageable at this scale and growing), this server exposes a handful of **meta-tools**: browse/search the live catalog, fetch a route's exact call spec, then call any route generically. New routes on the upstream service show up automatically — nothing here is hardcoded to today's catalog.
 

package/SECURITY.md

@@ -0,0 +1,15 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please report security issues privately through GitHub's security advisory
+feature for this repository. Do not open a public issue for a suspected
+vulnerability.
+
+Never include wallet private keys, payment signatures, API credentials, or
+other secrets in reports, logs, screenshots, or example configuration.
+
+## Wallet safety
+
+Paid tools require a dedicated, low-balance Base wallet. Never use a primary
+wallet. The three discovery tools work without any wallet configuration.

package/glama.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://glama.ai/mcp/schemas/server.json",
   "name": "@forgemeshlabs/utility-grid-mcp",
-  "description": "415+ agent utility jobs (OCR, vision, audio, math, conversions, geo/space, x402 intelligence) behind 6 meta-tools with free discovery and generic paid calling via x402.",
+  "description": "Discover and call 400+ practical APIs through six MCP tools. Search the catalog free, then pay per call with x402 USDC on Base.",
   "maintainers": [
     "clawdbotworker"
   ],

package/index.js

@@ -11,7 +11,7 @@ const { privateKeyToAccount } = require("viem/accounts");
 const { createPublicClient, http } = require("viem");
 const { base } = require("viem/chains");
 
-const VERSION = "0.1.0";
+const VERSION = "0.1.2";
 const BASE_URL = (process.env.UTILITY_GRID_BASE_URL || "https://x402.forgemesh.io").replace(/\/$/, "");
 const BASE_RPC_URL = process.env.BASE_RPC_URL || "https://mainnet.base.org";
 
@@ -240,6 +240,12 @@ async function paidPost(ctx, path, body) {
 const TOOLS = [
   {
     name: "list_capabilities",
+    annotations: {
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true,
+    },
     description:
       `FREE — no wallet needed. Browse the ForgeMesh Utility Grid catalog (415+ POST routes and growing, covering ${CATEGORY_EXAMPLES}). Call with no arguments for a category overview with route counts, or pass a category to list every route in it with price and description. Always reads the live /openapi.json — never a stale/hardcoded list.`,
     inputSchema: {
@@ -251,6 +257,12 @@ const TOOLS = [
   },
   {
     name: "search_capabilities",
+    annotations: {
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true,
+    },
     description:
       "FREE — no wallet needed. Keyword search across every route's path, operation id, and description (e.g. 'chess', 'timezone', 'background removal'). Use this when you don't know the exact route name or category.",
     inputSchema: {
@@ -264,6 +276,12 @@ const TOOLS = [
   },
   {
     name: "get_endpoint_spec",
+    annotations: {
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true,
+    },
     description:
       "FREE — no wallet needed. Full call spec for one route: price, input JSON schema, a worked request example, and a worked response example, straight from the live OpenAPI discovery doc. Pass the route path (with or without a leading slash, e.g. 'chess-moves' or '/chess-moves'). Use this before call_endpoint to know exactly what body to send.",
     inputSchema: {
@@ -276,6 +294,12 @@ const TOOLS = [
   },
   {
     name: "call_endpoint",
+    annotations: {
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: false,
+      openWorldHint: true,
+    },
     description:
       "PAID (price varies by route, $0.001-$0.05) — the generic way to call ANY route in the Utility Grid. Pass the route path and a JSON body matching its input schema (use get_endpoint_spec first if unsure). Handles the full x402 payment flow automatically: fetches the 402 challenge, signs a USDC payment on Base, retries, and returns the result. Requires WALLET_PRIVATE_KEY.",
     inputSchema: {
@@ -289,6 +313,12 @@ const TOOLS = [
   },
   {
     name: "daily_402",
+    annotations: {
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: false,
+      openWorldHint: true,
+    },
     description:
       "PAID ($0.001) — the Daily 402: one featured x402 endpoint per UTC day, rotated deterministically through every paid route in the 12-service ForgeMesh fleet (500+ routes). Returns what it does, its price, input schema, and a worked example. Optional date override to replay a past day's pick. Requires WALLET_PRIVATE_KEY.",
     inputSchema: {
@@ -300,6 +330,12 @@ const TOOLS = [
   },
   {
     name: "agent_service_directory",
+    annotations: {
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: false,
+      openWorldHint: true,
+    },
     description:
       "PAID ($0.05) — machine-readable registry of every production x402 service in the ForgeMesh fleet: name, category, live route count, and price range per service. Useful for an agent deciding which paid tool/service to reach for next. Optional category filter (onchain-intel, voice, travel, econ-intel, commerce, infra, media, utility-grid). Requires WALLET_PRIVATE_KEY.",
     inputSchema: {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@forgemeshlabs/utility-grid-mcp",
-  "version": "0.1.0",
-  "description": "ForgeMesh Utility Grid, by ForgeMesh Labs — 415+ small agent utility jobs (OCR, vision, audio, embeddings, web extraction, dictionary/slang, chess, math, conversions, time, geo/space data, and x402 ecosystem intelligence) behind 6 meta-tools instead of one tool per route. Free discovery (browse/search the live catalog, fetch a route's full call spec), paid generic call via x402 USDC micropayments on Base. No API key, no account.",
+  "version": "0.1.2",
+  "description": "Discover and call 400+ practical APIs through six MCP tools. Search OCR, image, audio, web, math, conversion, and geodata utilities for free, then pay per call with x402 USDC on Base—no account or API key.",
   "main": "index.js",
   "bin": {
     "utility-grid-mcp": "index.js"
@@ -15,13 +15,15 @@
     "Dockerfile",
     ".dockerignore",
     "smithery.yaml",
+    "SECURITY.md",
+    "CHANGELOG.md",
     "LICENSE"
   ],
   "mcpName": "io.github.forgemeshlabs/utility-grid-mcp",
   "scripts": {
     "start": "node index.js",
     "build": "echo \"no build step required\"",
-    "test": "node --test test/"
+    "test": "node --test test/*.test.js"
   },
   "keywords": [
     "mcp",
@@ -50,7 +52,7 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.10.1",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "@x402/core": "^2.17.0",
     "@x402/evm": "^2.17.0",
     "viem": "^2.0.0"

package/server.json

@@ -1,17 +1,17 @@
 {
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.forgemeshlabs/utility-grid-mcp",
-  "description": "415+ agent utility jobs (OCR, vision, audio, math, conversions, geo/space, x402 intelligence) behind 6 meta-tools with free discovery and generic paid calling via x402.",
+  "description": "Discover and call 400+ practical APIs through six MCP tools with free search and x402 payments.",
   "repository": {
     "url": "https://github.com/forgemeshlabs/utility-grid-mcp",
     "source": "github"
   },
-  "version": "0.1.0",
+  "version": "0.1.2",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@forgemeshlabs/utility-grid-mcp",
-      "version": "0.1.0",
+      "version": "0.1.2",
       "transport": {
         "type": "stdio"
       },