@goplausible/algorand-mcp 4.2.9 → 4.3.0

package/dist/tools/utilityManager.js

@@ -86,7 +86,7 @@ export class UtilityManager {
                                 type: 'text',
                                 text: JSON.stringify({
                                     name: 'Algorand MCP Server',
-                                    version: '4.2.8',
+                                    version: '4.3.0',
                                     builder: 'GoPlausible',
                                     description: 'A Model Context Protocol (MCP) server providing comprehensive access to the Algorand blockchain. Supports account management, transaction building and signing, smart contract interaction, asset operations, ARC-26 URI generation, and deep integration with Algorand ecosystem services including NFDomains, Tinyman, Vestige, and Ultrade.',
                                     blockchain: 'Algorand — a carbon-negative, pure proof-of-stake Layer 1 blockchain delivering instant finality, low fees, and advanced smart contract capabilities via AVM (Algorand Virtual Machine).',

package/dist/tools/walletManager.d.ts

@@ -3,6 +3,7 @@ export interface AccountRow {
     address: string;
     public_key: string;
     nickname: string;
+    mnemonic: string | null;
     created_at: string;
 }
 export declare class WalletManager {

package/dist/tools/walletManager.js

@@ -5,7 +5,7 @@ import { McpError, ErrorCode } from '@modelcontextprotocol/sdk/types.js';
 import { withCommonParams } from './commonParams.js';
 import { getAlgodClient, extractNetwork } from '../algorand-client.js';
 import initSqlJs from 'sql.js';
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
+import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from 'fs';
 import { homedir } from 'os';
 import { join } from 'path';
 // ── Constants ────────────────────────────────────────────────────────────────
@@ -35,6 +35,7 @@ async function getDb() {
       address TEXT UNIQUE NOT NULL,
       public_key TEXT NOT NULL,
       nickname TEXT UNIQUE NOT NULL,
+      mnemonic TEXT,
       created_at TEXT NOT NULL
     )
   `);
@@ -44,19 +45,56 @@ async function getDb() {
       value TEXT NOT NULL
     )
   `);
+    // Idempotent schema migration: ensure `mnemonic` column exists on pre-existing DBs.
+    ensureMnemonicColumn(db);
     // Initialize active index if not set
     const row = db.exec("SELECT value FROM wallet_state WHERE key = 'active_account_index'");
     if (row.length === 0) {
         db.run("INSERT INTO wallet_state (key, value) VALUES ('active_account_index', '0')");
     }
+    // Eager keychain → DB migration for any pre-existing accounts whose mnemonic
+    // still lives in the OS keychain. Runs once per startup; idempotent (rows
+    // already populated are skipped).
+    migrateKeychainToDb(db);
     persistDb();
     return db;
 }
+function ensureMnemonicColumn(database) {
+    const info = database.exec('PRAGMA table_info(accounts)');
+    if (!info.length)
+        return;
+    const cols = info[0].values.map(r => r[1]);
+    if (!cols.includes('mnemonic')) {
+        database.run('ALTER TABLE accounts ADD COLUMN mnemonic TEXT');
+    }
+}
+function migrateKeychainToDb(database) {
+    const result = database.exec("SELECT address FROM accounts WHERE mnemonic IS NULL OR mnemonic = ''");
+    if (!result.length || !result[0].values.length)
+        return;
+    for (const row of result[0].values) {
+        const address = row[0];
+        try {
+            const mnemonic = new Entry(KEYCHAIN_SERVICE, address).getPassword();
+            if (mnemonic) {
+                database.run('UPDATE accounts SET mnemonic = ? WHERE address = ?', [mnemonic, address]);
+            }
+        }
+        catch {
+            // No keychain entry for this address (or keychain unavailable). Leave
+            // mnemonic NULL — the row remains until the user re-imports or replaces it.
+        }
+    }
+}
 function persistDb() {
     if (!db)
         return;
     const data = db.export();
-    writeFileSync(DB_PATH, Buffer.from(data));
+    writeFileSync(DB_PATH, Buffer.from(data), { mode: 0o600 });
+    try {
+        chmodSync(DB_PATH, 0o600);
+    }
+    catch { /* best-effort on platforms that don't support it */ }
 }
 // ── Tool Schemas ─────────────────────────────────────────────────────────────
 const walletToolSchemas = {
@@ -184,35 +222,59 @@ export class WalletManager {
         }
         throw new McpError(ErrorCode.InvalidParams, 'Provide either nickname or index');
     }
-    // ── Keychain Access ────────────────────────────────────────────────────────
-    static storeMnemonic(address, mnemonic) {
-        const entry = new Entry(KEYCHAIN_SERVICE, address);
-        entry.setPassword(mnemonic);
+    // ── Mnemonic Storage ───────────────────────────────────────────────────────
+    //
+    // Mnemonics live in the `accounts.mnemonic` column of wallet.db. The OS
+    // keychain (@napi-rs/keyring) is kept only as a backward-compatibility read
+    // fallback for accounts that pre-date this change; the eager migration in
+    // getDb() copies any such mnemonics into the DB at startup, and the fallback
+    // below catches the rare case where the keychain was unavailable at startup
+    // but becomes available later. New mnemonics are never written to the
+    // keychain.
+    static async storeMnemonic(address, mnemonic) {
+        const database = await getDb();
+        database.run('UPDATE accounts SET mnemonic = ? WHERE address = ?', [mnemonic, address]);
+        persistDb();
     }
-    static getMnemonic(address) {
+    static async getMnemonic(address) {
+        const database = await getDb();
+        const result = database.exec('SELECT mnemonic FROM accounts WHERE address = ?', [address]);
+        if (result.length && result[0].values.length) {
+            const m = result[0].values[0][0];
+            if (typeof m === 'string' && m.length > 0)
+                return m;
+        }
+        // Fallback: read from keychain (handles the case where eager migration
+        // missed this address because the keychain wasn't available at startup).
+        // On success, copy into the DB so future reads are DB-native.
         try {
-            const entry = new Entry(KEYCHAIN_SERVICE, address);
-            const mnemonic = entry.getPassword();
-            if (!mnemonic)
-                throw new Error('No mnemonic found');
-            return mnemonic;
+            const m = new Entry(KEYCHAIN_SERVICE, address).getPassword();
+            if (m) {
+                database.run('UPDATE accounts SET mnemonic = ? WHERE address = ?', [m, address]);
+                persistDb();
+                return m;
+            }
         }
         catch {
-            throw new McpError(ErrorCode.InvalidParams, `No keychain entry found for address: ${address}`);
+            // No keychain entry / keychain unavailable.
         }
+        throw new McpError(ErrorCode.InvalidParams, `No mnemonic found for address: ${address}`);
     }
-    static deleteMnemonic(address) {
+    static async deleteMnemonic(address) {
+        const database = await getDb();
+        database.run('UPDATE accounts SET mnemonic = NULL WHERE address = ?', [address]);
+        persistDb();
+        // Best-effort cleanup of any stale keychain entry left over from a
+        // pre-migration install. Failure here is harmless.
         try {
-            const entry = new Entry(KEYCHAIN_SERVICE, address);
-            return entry.deleteCredential();
-        }
-        catch {
-            return false;
+            new Entry(KEYCHAIN_SERVICE, address).deleteCredential();
         }
+        catch { /* ignore */ }
+        return true;
     }
     static async getActiveSecretKey() {
         const account = await WalletManager.getActiveAccount();
-        const mnemonic = WalletManager.getMnemonic(account.address);
+        const mnemonic = await WalletManager.getMnemonic(account.address);
         return algosdk.mnemonicToSecretKey(mnemonic).sk;
     }
     // ── Transaction Helpers ────────────────────────────────────────────────────
@@ -376,9 +438,7 @@ export class WalletManager {
                     if (addrExists.length > 0 && addrExists[0].values.length > 0) {
                         throw new McpError(ErrorCode.InvalidParams, `Account with address ${address} already exists in wallet`);
                     }
-                    // Store mnemonic in OS keychain
-                    WalletManager.storeMnemonic(address, mnemonic);
-                    database.run('INSERT INTO accounts (address, public_key, nickname, created_at) VALUES (?, ?, ?, ?)', [address, publicKey, args.nickname, new Date().toISOString()]);
+                    database.run('INSERT INTO accounts (address, public_key, nickname, mnemonic, created_at) VALUES (?, ?, ?, ?, ?)', [address, publicKey, args.nickname, mnemonic, new Date().toISOString()]);
                     persistDb();
                     const accounts = await WalletManager.getAllAccounts();
                     const newIndex = accounts.findIndex(a => a.address === address);
@@ -406,7 +466,7 @@ export class WalletManager {
                     }
                     const idx = await WalletManager.resolveAccountIndex(args);
                     const removed = accounts[idx];
-                    WalletManager.deleteMnemonic(removed.address);
+                    await WalletManager.deleteMnemonic(removed.address);
                     const database = await getDb();
                     database.run('DELETE FROM accounts WHERE address = ?', [removed.address]);
                     // Adjust active index
@@ -675,7 +735,7 @@ export class WalletManager {
 WalletManager.walletTools = [
     {
         name: 'wallet_add_account',
-        description: 'Create a new Algorand account and store it securely in the OS keychain with a nickname. Returns only address and public key.',
+        description: 'Create a new Algorand account, store it in the agent-wallet database with a nickname, and auto-switch to it if it is the first account. Returns address, public key, nickname, and index. The mnemonic is held internally by the MCP server and never returned to the agent.',
         inputSchema: withCommonParams(walletToolSchemas.addAccount),
     },
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goplausible/algorand-mcp",
-  "version": "4.2.9",
+  "version": "4.3.0",
   "publishConfig": {
     "access": "public"
   },