@goplausible/algorand-mcp 4.2.5 → 4.2.7

package/README.md

@@ -14,7 +14,7 @@ Algorand is a carbon-negative, pure proof-of-stake Layer 1 blockchain with insta
 ## Features
 
 - Secure wallet management via OS keychain — private keys never exposed to agents or LLMs
-- Wallet accounts nicknames, allowances, and daily limits for safe spending control
+- Wallet accounts with human-readable nicknames
 - Account creation, key management, and rekeying
 - Transaction building, signing, and submission (payments, assets, applications, key registration)
 - Atomic transaction groups
@@ -276,7 +276,7 @@ The wallet system has two layers of storage, each with a distinct security role:
 | Layer | What it stores | Where | Encryption |
 |---|---|---|---|
 | **OS Keychain** | Mnemonics (secret keys) | macOS Keychain / Linux libsecret / Windows Credential Manager | OS-managed, hardware-backed where available |
-| **Embedded SQLite** | Account metadata (nicknames, allowances, spend tracking) | `~/.algorand-mcp/wallet.db` | Plaintext (no secrets) |
+| **Embedded SQLite** | Account metadata (nicknames, active-account index) | `~/.algorand-mcp/wallet.db` | Plaintext (no secrets) |
 
 **Private key material never appears in tool responses, MCP config files, environment variables, or logs.** The agent only sees addresses, public keys, and signed transaction blobs.
 
@@ -290,31 +290,23 @@ The wallet system has two layers of storage, each with a distinct security role:
        │  { nickname: "main" }        │                              │
        │ ──────────────────────────►  │  generate keypair            │
        │                              │  store mnemonic ──────────►  │  OS Keychain (encrypted)
-       │                              │  store metadata ──────────►  │  SQLite (nickname, limits)
+       │                              │  store metadata ──────────►  │  SQLite (nickname)
        │  ◄─ { address, publicKey }   │                              │
        │                              │                              │
        │  wallet_sign_transaction     │                              │
        │  { transaction: {...} }      │                              │
-       │ ──────────────────────────►  │  check spending limits       │
-       │                              │  retrieve mnemonic ◄──────  │  OS Keychain
+       │ ──────────────────────────►  │  retrieve mnemonic ◄──────  │  OS Keychain
        │                              │  sign in memory              │
        │  ◄─ { txID, blob }          │  (key discarded)             │
        │                              │                              │
 ```
 
-1. **Account creation** (`wallet_add_account`) — Generates a keypair, stores the mnemonic in the OS keychain, and stores metadata (nickname, spending limits) in SQLite. Returns **only** address and public key.
+1. **Account creation** (`wallet_add_account`) — Generates a keypair, stores the mnemonic in the OS keychain, and stores the nickname in SQLite. Returns **only** address and public key.
 2. **Active account** — One account is active at a time. `wallet_switch_account` changes it by nickname or index. All signing and query tools operate on the active account.
-3. **Transaction signing** (`wallet_sign_transaction`) — Checks per-transaction and daily spending limits, retrieves the key from the keychain, signs in memory, discards the key. Returns only the signed blob.
+3. **Transaction signing** (`wallet_sign_transaction`) — Retrieves the key from the keychain, signs in memory, discards the key. Returns only the signed blob.
 4. **Data signing** (`wallet_sign_data`) — Signs arbitrary hex data using raw Ed25519 via the [`@noble/curves`](https://github.com/paulmillr/noble-curves) library (no Algorand SDK prefix). Useful for off-chain authentication.
 5. **Asset opt-in** (`wallet_optin_asset`) — Creates, signs, and submits an opt-in transaction for the active account in one step.
 
-### Spending limits
-
-Each account has two configurable limits (in microAlgos, 0 = unlimited):
-
-- **`allowance`** — Maximum amount per single transaction. Rejects any transaction exceeding this.
-- **`dailyAllowance`** — Maximum total spend per calendar day across all transactions. Automatically resets at midnight. Tracked in SQLite.
-
 ### Platform keychain support
 
 The keychain backend is provided by [`@napi-rs/keyring`](https://github.com/nicolo-ribaudo/napi-keyring) (Rust-based, prebuilt binaries):
@@ -365,13 +357,13 @@ See [Secure Wallet](#secure-wallet) for full architecture details.
 
 | Tool | Description |
 |---|---|
-| `wallet_add_account` | Create a new Algorand account with nickname and spending limits (returns address + public key only) |
+| `wallet_add_account` | Create a new Algorand account with nickname (returns address + public key only) |
 | `wallet_remove_account` | Remove an account from the wallet by nickname or index |
-| `wallet_list_accounts` | List all accounts with nicknames, addresses, and limits |
+| `wallet_list_accounts` | List all accounts with nicknames and addresses |
 | `wallet_switch_account` | Switch the active account by nickname or index |
-| `wallet_get_info` | Get info for the **active account this MCP server owns** (keychain-backed): address, public key, balance, opted-in counts, plus wallet-only fields (allowance, daily allowance, daily spent). For arbitrary on-chain accounts use `api_algod_get_account_info`. |
+| `wallet_get_info` | Get info for the **active account this MCP server owns** (keychain-backed): address, public key, balance, opted-in counts. For arbitrary on-chain accounts use `api_algod_get_account_info`. |
 | `wallet_get_assets` | Get all ASA holdings for the **active account this MCP server owns**. For arbitrary on-chain accounts use `api_algod_get_account_info` or `api_algod_get_account_asset_info`. |
-| `wallet_sign_transaction` | Sign a single transaction with the active account (enforces spending limits) |
+| `wallet_sign_transaction` | Sign a single transaction with the active account |
 | `wallet_sign_transaction_group` | Sign a group of transactions with the active account (auto-assigns group ID) |
 | `wallet_sign_data` | Sign arbitrary hex data with raw Ed25519 (noble, no SDK prefix) |
 | `wallet_optin_asset` | Opt the active account into an asset (creates, signs, and submits) |

package/dist/tools/apiManager/hayrouter/swap.js

@@ -83,10 +83,7 @@ export async function handleSwapTools(args) {
             if (maxDepth !== undefined)
                 quoteParams.maxDepth = maxDepth;
             const quote = await router.newQuote(quoteParams);
-            // 4. Check spending limits (estimate based on input amount for ALGO sends)
-            const estimatedSpend = fromASAID === 0 ? Number(amount) : 0;
-            WalletManager.checkWalletSpendingLimits(account, estimatedSpend);
-            // 5. Build and execute swap
+            // 4. Build and execute swap
             const swapConfig = {
                 quote,
                 address,
@@ -98,12 +95,10 @@ export async function handleSwapTools(args) {
             }
             const swap = await router.newSwap(swapConfig);
             const result = await swap.execute();
-            // 6. Record spend
-            await WalletManager.recordWalletSpend(address, estimatedSpend);
-            // 7. Get swap summary
+            // 5. Get swap summary
             const summary = swap.getSummary();
             const inputTxnId = swap.getInputTransactionId();
-            // 8. Build response
+            // 6. Build response
             const response = {
                 status: 'confirmed',
                 confirmedRound: result.confirmedRound.toString(),

package/dist/tools/utilityManager.js

@@ -86,7 +86,7 @@ export class UtilityManager {
                                 type: 'text',
                                 text: JSON.stringify({
                                     name: 'Algorand MCP Server',
-                                    version: '4.2.5',
+                                    version: '4.2.7',
                                     builder: 'GoPlausible',
                                     description: 'A Model Context Protocol (MCP) server providing comprehensive access to the Algorand blockchain. Supports account management, transaction building and signing, smart contract interaction, asset operations, ARC-26 URI generation, and deep integration with Algorand ecosystem services including NFDomains, Tinyman, Vestige, and Ultrade.',
                                     blockchain: 'Algorand — a carbon-negative, pure proof-of-stake Layer 1 blockchain delivering instant finality, low fees, and advanced smart contract capabilities via AVM (Algorand Virtual Machine).',

package/dist/tools/walletManager.d.ts

@@ -3,10 +3,6 @@ export interface AccountRow {
     address: string;
     public_key: string;
     nickname: string;
-    allowance: number;
-    daily_allowance: number;
-    daily_spent: number;
-    last_spend_date: string;
     created_at: string;
 }
 export declare class WalletManager {
@@ -24,15 +20,12 @@ export declare class WalletManager {
     private static getMnemonic;
     private static deleteMnemonic;
     private static getActiveSecretKey;
-    private static checkSpendingLimits;
-    private static recordSpend;
     /**
      * Converts flat JSON transaction format (as returned by make_*_txn / assign_group_id)
      * into an algosdk v3 Transaction object. Handles genesisHash in base64 string,
      * Uint8Array, or JSON-round-tripped {0:byte,...} object form.
      */
     private static prepareTransaction;
-    private static extractTxnAmount;
     static handleTool(name: string, args: Record<string, unknown>): Promise<{
         content: {
             type: string;
@@ -42,12 +35,8 @@ export declare class WalletManager {
     static getAccounts(): Promise<AccountRow[]>;
     static hasAccounts(): Promise<boolean>;
     static getActiveAccountInfo(): Promise<AccountRow | null>;
-    /** Get active account details (address, nickname, spending limits). */
+    /** Get active account details (address, nickname). */
     static getActiveWalletAccount(): Promise<AccountRow>;
     /** Get active account's secret key from OS keychain. */
     static getActiveWalletSecretKey(): Promise<Uint8Array>;
-    /** Check if transaction amount is within spending limits. Throws on violation. */
-    static checkWalletSpendingLimits(account: AccountRow, amountMicroAlgos: number): void;
-    /** Record a spend against the account's daily allowance tracker. */
-    static recordWalletSpend(address: string, amountMicroAlgos: number): Promise<void>;
 }

package/dist/tools/walletManager.js

@@ -35,10 +35,6 @@ async function getDb() {
       address TEXT UNIQUE NOT NULL,
       public_key TEXT NOT NULL,
       nickname TEXT UNIQUE NOT NULL,
-      allowance INTEGER DEFAULT 0,
-      daily_allowance INTEGER DEFAULT 0,
-      daily_spent INTEGER DEFAULT 0,
-      last_spend_date TEXT DEFAULT '',
       created_at TEXT NOT NULL
     )
   `);
@@ -67,9 +63,7 @@ const walletToolSchemas = {
     addAccount: {
         type: 'object',
         properties: {
-            nickname: { type: 'string', description: 'Human-readable nickname for this account' },
-            allowance: { type: 'number', description: 'Max per-transaction amount in microAlgos (0 = unlimited)' },
-            dailyAllowance: { type: 'number', description: 'Max daily spending total in microAlgos (0 = unlimited)' }
+            nickname: { type: 'string', description: 'Human-readable nickname for this account' }
         },
         required: ['nickname']
     },
@@ -221,35 +215,6 @@ export class WalletManager {
         const mnemonic = WalletManager.getMnemonic(account.address);
         return algosdk.mnemonicToSecretKey(mnemonic).sk;
     }
-    // ── Spending Limit Enforcement ─────────────────────────────────────────────
-    static checkSpendingLimits(account, amountMicroAlgos) {
-        if (amountMicroAlgos <= 0)
-            return;
-        if (account.allowance > 0 && amountMicroAlgos > account.allowance) {
-            throw new McpError(ErrorCode.InvalidRequest, `Transaction amount ${amountMicroAlgos} microAlgos exceeds per-transaction allowance of ${account.allowance} for account "${account.nickname}"`);
-        }
-        if (account.daily_allowance > 0) {
-            const today = new Date().toISOString().split('T')[0];
-            const spent = account.last_spend_date === today ? account.daily_spent : 0;
-            if (spent + amountMicroAlgos > account.daily_allowance) {
-                throw new McpError(ErrorCode.InvalidRequest, `Would exceed daily allowance: ${spent} spent + ${amountMicroAlgos} = ${spent + amountMicroAlgos} > limit ${account.daily_allowance} for "${account.nickname}"`);
-            }
-        }
-    }
-    static async recordSpend(address, amountMicroAlgos) {
-        if (amountMicroAlgos <= 0)
-            return;
-        const database = await getDb();
-        const today = new Date().toISOString().split('T')[0];
-        // Reset if new day, then add
-        database.run(`
-      UPDATE accounts SET
-        daily_spent = CASE WHEN last_spend_date = ? THEN daily_spent + ? ELSE ? END,
-        last_spend_date = ?
-      WHERE address = ?
-    `, [today, amountMicroAlgos, amountMicroAlgos, today, address]);
-        persistDb();
-    }
     // ── Transaction Helpers ────────────────────────────────────────────────────
     /**
      * Converts flat JSON transaction format (as returned by make_*_txn / assign_group_id)
@@ -384,13 +349,6 @@ export class WalletManager {
         }
         return txn;
     }
-    static extractTxnAmount(txnObj) {
-        if (typeof txnObj.amount === 'number')
-            return txnObj.amount;
-        if (typeof txnObj.amt === 'number')
-            return txnObj.amt;
-        return 0;
-    }
     // ── Tool Handler ───────────────────────────────────────────────────────────
     static async handleTool(name, args) {
         try {
@@ -420,9 +378,7 @@ export class WalletManager {
                     }
                     // Store mnemonic in OS keychain
                     WalletManager.storeMnemonic(address, mnemonic);
-                    const allowance = typeof args.allowance === 'number' ? args.allowance : 0;
-                    const dailyAllowance = typeof args.dailyAllowance === 'number' ? args.dailyAllowance : 0;
-                    database.run('INSERT INTO accounts (address, public_key, nickname, allowance, daily_allowance, daily_spent, last_spend_date, created_at) VALUES (?, ?, ?, ?, ?, 0, \'\', ?)', [address, publicKey, args.nickname, allowance, dailyAllowance, new Date().toISOString()]);
+                    database.run('INSERT INTO accounts (address, public_key, nickname, created_at) VALUES (?, ?, ?, ?)', [address, publicKey, args.nickname, new Date().toISOString()]);
                     persistDb();
                     const accounts = await WalletManager.getAllAccounts();
                     const newIndex = accounts.findIndex(a => a.address === address);
@@ -438,8 +394,6 @@ export class WalletManager {
                                     publicKey,
                                     nickname: args.nickname,
                                     index: newIndex,
-                                    allowance,
-                                    dailyAllowance,
                                 }, null, 2),
                             }],
                     };
@@ -480,7 +434,6 @@ export class WalletManager {
                 case 'wallet_list_accounts': {
                     const accounts = await WalletManager.getAllAccounts();
                     const activeIdx = await WalletManager.getActiveIndex();
-                    const today = new Date().toISOString().split('T')[0];
                     return {
                         content: [{
                                 type: 'text',
@@ -493,9 +446,6 @@ export class WalletManager {
                                         nickname: a.nickname,
                                         address: a.address,
                                         publicKey: a.public_key,
-                                        allowance: a.allowance,
-                                        dailyAllowance: a.daily_allowance,
-                                        dailySpent: a.last_spend_date === today ? a.daily_spent : 0,
                                         createdAt: a.created_at,
                                     })),
                                 }, null, 2),
@@ -529,7 +479,6 @@ export class WalletManager {
                     const account = await WalletManager.getActiveAccount();
                     const network = extractNetwork(args);
                     const algodClient = getAlgodClient(network);
-                    const today = new Date().toISOString().split('T')[0];
                     let onChainInfo = {};
                     try {
                         const info = await algodClient.accountInformation(account.address).do();
@@ -554,9 +503,6 @@ export class WalletManager {
                                     publicKey: account.public_key,
                                     network,
                                     ...onChainInfo,
-                                    allowance: account.allowance,
-                                    dailyAllowance: account.daily_allowance,
-                                    dailySpent: account.last_spend_date === today ? account.daily_spent : 0,
                                 }, null, 2),
                             }],
                     };
@@ -591,12 +537,9 @@ export class WalletManager {
                     }
                     const account = await WalletManager.getActiveAccount();
                     const txnObj = args.transaction;
-                    const amount = WalletManager.extractTxnAmount(txnObj);
-                    WalletManager.checkSpendingLimits(account, amount);
                     const txn = WalletManager.prepareTransaction(txnObj);
                     const sk = await WalletManager.getActiveSecretKey();
                     const signedTxn = algosdk.signTransaction(txn, sk);
-                    await WalletManager.recordSpend(account.address, amount);
                     return {
                         content: [{
                                 type: 'text',
@@ -615,11 +558,6 @@ export class WalletManager {
                         throw new McpError(ErrorCode.InvalidParams, 'Non-empty transactions array is required');
                     }
                     const account = await WalletManager.getActiveAccount();
-                    let totalAmount = 0;
-                    for (const txnObj of args.transactions) {
-                        totalAmount += WalletManager.extractTxnAmount(txnObj);
-                    }
-                    WalletManager.checkSpendingLimits(account, totalAmount);
                     const txns = args.transactions.map((txnObj) => WalletManager.prepareTransaction(txnObj));
                     const groupedTxns = algosdk.assignGroupID(txns);
                     const sk = await WalletManager.getActiveSecretKey();
@@ -630,7 +568,6 @@ export class WalletManager {
                             blob: algosdk.bytesToBase64(signed.blob),
                         };
                     });
-                    await WalletManager.recordSpend(account.address, totalAmount);
                     return {
                         content: [{
                                 type: 'text',
@@ -726,7 +663,7 @@ export class WalletManager {
         }
     }
     // ── Public accessors for external tool integration (e.g., haystack-router) ──
-    /** Get active account details (address, nickname, spending limits). */
+    /** Get active account details (address, nickname). */
     static async getActiveWalletAccount() {
         return WalletManager.getActiveAccount();
     }
@@ -734,19 +671,11 @@ export class WalletManager {
     static async getActiveWalletSecretKey() {
         return WalletManager.getActiveSecretKey();
     }
-    /** Check if transaction amount is within spending limits. Throws on violation. */
-    static checkWalletSpendingLimits(account, amountMicroAlgos) {
-        return WalletManager.checkSpendingLimits(account, amountMicroAlgos);
-    }
-    /** Record a spend against the account's daily allowance tracker. */
-    static async recordWalletSpend(address, amountMicroAlgos) {
-        return WalletManager.recordSpend(address, amountMicroAlgos);
-    }
 }
 WalletManager.walletTools = [
     {
         name: 'wallet_add_account',
-        description: 'Create a new Algorand account and store it securely in the OS keychain with a nickname and spending limits. Returns only address and public key.',
+        description: 'Create a new Algorand account and store it securely in the OS keychain with a nickname. Returns only address and public key.',
         inputSchema: withCommonParams(walletToolSchemas.addAccount),
     },
     {
@@ -756,7 +685,7 @@ WalletManager.walletTools = [
     },
     {
         name: 'wallet_list_accounts',
-        description: 'List all wallet accounts with their nicknames, addresses, and spending limits.',
+        description: 'List all wallet accounts with their nicknames and addresses.',
         inputSchema: withCommonParams(walletToolSchemas.listAccounts),
     },
     {
@@ -766,7 +695,7 @@ WalletManager.walletTools = [
     },
     {
         name: 'wallet_get_info',
-        description: 'Get info for the ACTIVE wallet account (an account whose private key this MCP server owns in the OS keychain). Returns nickname, address, public key, network, on-chain balance, min-balance, opted-in apps/assets counts, plus wallet-only fields: per-tx allowance, daily allowance, and daily-spent counter. Use this when you want to know the state of "the wallet you control." For an arbitrary on-chain account that this wallet does NOT own, use api_algod_get_account_info instead.',
+        description: 'Get info for the ACTIVE wallet account (an account whose private key this MCP server owns in the OS keychain). Returns nickname, address, public key, network, on-chain balance, min-balance, opted-in apps/assets counts. Use this when you want to know the state of "the wallet you control." For an arbitrary on-chain account that this wallet does NOT own, use api_algod_get_account_info instead.',
         inputSchema: withCommonParams(walletToolSchemas.getInfo),
     },
     {
@@ -776,12 +705,12 @@ WalletManager.walletTools = [
     },
     {
         name: 'wallet_sign_transaction',
-        description: 'Sign a single transaction with the active wallet account. Enforces per-transaction and daily spending limits.',
+        description: 'Sign a single transaction with the active wallet account.',
         inputSchema: withCommonParams(walletToolSchemas.signTransaction),
     },
     {
         name: 'wallet_sign_transaction_group',
-        description: 'Sign a group of transactions with the active wallet account. Assigns group ID automatically and enforces spending limits.',
+        description: 'Sign a group of transactions with the active wallet account. Assigns group ID automatically.',
         inputSchema: withCommonParams(walletToolSchemas.signTransactionGroup),
     },
     {

package/dist/utils/responseProcessor.js

@@ -6,7 +6,10 @@
 BigInt.prototype.toJSON = function () {
     return Number(this);
 };
-const DEFAULT_ITEMS_PER_PAGE = 10;
+const DEFAULT_ITEMS_PER_PAGE = (() => {
+    const fromEnv = parseInt(process.env.ITEMS_PER_PAGE ?? '', 10);
+    return Number.isFinite(fromEnv) && fromEnv > 0 ? fromEnv : 10;
+})();
 export class ResponseProcessor {
     static generateNextPageToken(page) {
         return btoa(`page_${page}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goplausible/algorand-mcp",
-  "version": "4.2.5",
+  "version": "4.2.7",
   "publishConfig": {
     "access": "public"
   },
@@ -15,7 +15,7 @@
     "typecheck": "tsc --noEmit",
     "tag": "git tag v$npm_package_version && git push origin v$npm_package_version",
     "retag": "git tag -f v$npm_package_version && git push -f origin v$npm_package_version",
-    "publish:npm": "npm publish",
+    "publish:npm": "npm publish --access public",
     "prepublishOnly": "npm run clean && npm run build"
   },
   "keywords": [