@guiie/buda-mcp 1.5.0 → 1.5.1

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAKA,qBAAa,YAAa,SAAQ,KAAK;aAEnB,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM;aAEZ,YAAY,CAAC,EAAE,MAAM;gBAHrB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM,EACC,YAAY,CAAC,EAAE,MAAM,YAAA;CAKxC;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;gBAG7C,OAAO,GAAE,MAAiB,EAC1B,MAAM,CAAC,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM;IAOpB,OAAO,IAAI,OAAO;IAIlB,OAAO,CAAC,KAAK;IAIb,OAAO,CAAC,IAAI;IASZ,OAAO,CAAC,WAAW;IAWnB;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAOzB;;;;OAIG;YACW,cAAc;YA2Bd,cAAc;IActB,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAoB1E,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAmBnD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAmBlD,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAmBpF"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAKA,qBAAa,YAAa,SAAQ,KAAK;aAEnB,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM;aAEZ,YAAY,CAAC,EAAE,MAAM;gBAHrB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM,EACC,YAAY,CAAC,EAAE,MAAM,YAAA;CAKxC;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;gBAG7C,OAAO,GAAE,MAAiB,EAC1B,MAAM,CAAC,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM;IAOpB,OAAO,IAAI,OAAO;IAIlB,OAAO,CAAC,aAAa,CAAK;IAE1B,OAAO,CAAC,KAAK;IAIb,OAAO,CAAC,IAAI;IASZ,OAAO,CAAC,WAAW;IAWnB;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAOzB;;;;OAIG;YACW,cAAc;YA2Bd,cAAc;IActB,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAoB1E,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAmBnD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAmBlD,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAmBpF"}

package/dist/client.js

@@ -25,8 +25,9 @@ export class BudaClient {
     hasAuth() {
         return Boolean(this.apiKey && this.apiSecret);
     }
+    _nonceCounter = 0;
     nonce() {
-        return String(Math.floor(Date.now() * 1000));
+        return String(Date.now() * 1000 + (this._nonceCounter++ % 1000));
     }
     sign(method, pathWithQuery, body, nonce) {
         const encodedBody = body ? Buffer.from(body).toString("base64") : "";

package/dist/http.js

@@ -1,9 +1,11 @@
 import express from "express";
+import rateLimit from "express-rate-limit";
 import { McpServer, ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { BudaClient } from "./client.js";
 import { MemoryCache, CACHE_TTL } from "./cache.js";
 import { VERSION } from "./version.js";
+import { validateMarketId } from "./validation.js";
 import * as markets from "./tools/markets.js";
 import * as ticker from "./tools/ticker.js";
 import * as orderbook from "./tools/orderbook.js";
@@ -119,7 +121,7 @@ function createServer() {
         orders.register(server, client);
         placeOrder.register(server, client);
         cancelOrder.register(server, client);
-        deadMansSwitch.register(server, client);
+        deadMansSwitch.register(server, client, "http");
         account.register(server, client);
         balance.register(server, client);
         orderLookup.register(server, client);
@@ -148,7 +150,11 @@ function createServer() {
         };
     });
     server.resource("buda-ticker", new ResourceTemplate("buda://ticker/{market}", { list: undefined }), async (uri, params) => {
-        const marketId = params.market.toLowerCase();
+        const raw = params.market;
+        const validationError = validateMarketId(raw);
+        if (validationError)
+            throw new Error(validationError);
+        const marketId = raw.toLowerCase();
         const data = await reqCache.getOrFetch(`ticker:${marketId}`, CACHE_TTL.TICKER, () => client.get(`/markets/${marketId}/ticker`));
         return {
             contents: [
@@ -161,9 +167,13 @@ function createServer() {
         };
     });
     server.resource("buda-summary", new ResourceTemplate("buda://summary/{market}", { list: undefined }), async (uri, params) => {
-        const marketId = params.market.toUpperCase();
+        const raw = params.market;
+        const validationError = validateMarketId(raw);
+        if (validationError)
+            throw new Error(validationError);
+        const marketId = raw.toUpperCase();
         const result = await handleMarketSummary({ market_id: marketId }, client, reqCache);
-        const text = result.content[0].text;
+        const text = result.content[0]?.text ?? JSON.stringify({ error: "No content returned" });
         return {
             contents: [
                 {
@@ -178,6 +188,32 @@ function createServer() {
 }
 const app = express();
 app.use(express.json());
+const MCP_AUTH_TOKEN = process.env.MCP_AUTH_TOKEN;
+if (authEnabled && !MCP_AUTH_TOKEN) {
+    console.error("[buda-mcp] FATAL: BUDA_API_KEY/BUDA_API_SECRET are set but MCP_AUTH_TOKEN is not.\n" +
+        "  The /mcp endpoint would be publicly accessible with full account access.\n" +
+        "  Set MCP_AUTH_TOKEN to a long random secret, or run in stdio mode instead.");
+    process.exit(1);
+}
+const mcpRateLimiter = rateLimit({
+    windowMs: 60_000,
+    max: parseInt(process.env.MCP_RATE_LIMIT ?? "120", 10),
+    standardHeaders: true,
+    legacyHeaders: false,
+    message: { error: "Too many requests. Retry after 60 seconds.", code: "RATE_LIMITED" },
+});
+function mcpAuthMiddleware(req, res, next) {
+    if (!MCP_AUTH_TOKEN) {
+        next();
+        return;
+    }
+    const auth = req.headers.authorization ?? "";
+    if (auth !== `Bearer ${MCP_AUTH_TOKEN}`) {
+        res.status(401).json({ error: "Unauthorized" });
+        return;
+    }
+    next();
+}
 // Health check for Railway / uptime monitors
 app.get("/health", (_req, res) => {
     res.json({
@@ -203,7 +239,7 @@ app.get("/.well-known/mcp/server-card.json", (_req, res) => {
     });
 });
 // Stateless StreamableHTTP — new server instance per request (no session state needed)
-app.post("/mcp", async (req, res) => {
+app.post("/mcp", mcpRateLimiter, mcpAuthMiddleware, async (req, res) => {
     const transport = new StreamableHTTPServerTransport({
         sessionIdGenerator: undefined,
     });
@@ -215,7 +251,7 @@ app.post("/mcp", async (req, res) => {
     await transport.handleRequest(req, res, req.body);
 });
 // SSE upgrade for clients that prefer streaming
-app.get("/mcp", async (req, res) => {
+app.get("/mcp", mcpRateLimiter, mcpAuthMiddleware, async (req, res) => {
     const transport = new StreamableHTTPServerTransport({
         sessionIdGenerator: undefined,
     });

package/dist/index.js

@@ -5,6 +5,7 @@ import { ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { BudaClient } from "./client.js";
 import { cache, CACHE_TTL } from "./cache.js";
 import { VERSION } from "./version.js";
+import { validateMarketId } from "./validation.js";
 import * as markets from "./tools/markets.js";
 import * as ticker from "./tools/ticker.js";
 import * as orderbook from "./tools/orderbook.js";
@@ -97,7 +98,11 @@ server.resource("buda-markets", "buda://markets", async (uri) => {
     };
 });
 server.resource("buda-ticker", new ResourceTemplate("buda://ticker/{market}", { list: undefined }), async (uri, params) => {
-    const marketId = params.market.toLowerCase();
+    const raw = params.market;
+    const validationError = validateMarketId(raw);
+    if (validationError)
+        throw new Error(validationError);
+    const marketId = raw.toLowerCase();
     const data = await cache.getOrFetch(`ticker:${marketId}`, CACHE_TTL.TICKER, () => client.get(`/markets/${marketId}/ticker`));
     return {
         contents: [
@@ -110,9 +115,13 @@ server.resource("buda-ticker", new ResourceTemplate("buda://ticker/{market}", {
     };
 });
 server.resource("buda-summary", new ResourceTemplate("buda://summary/{market}", { list: undefined }), async (uri, params) => {
-    const marketId = params.market.toUpperCase();
+    const raw = params.market;
+    const validationError = validateMarketId(raw);
+    if (validationError)
+        throw new Error(validationError);
+    const marketId = raw.toUpperCase();
     const result = await handleMarketSummary({ market_id: marketId }, client, cache);
-    const text = result.content[0].text;
+    const text = result.content[0]?.text ?? JSON.stringify({ error: "No content returned" });
     return {
         contents: [
             {

package/dist/tools/batch_orders.d.ts

@@ -39,6 +39,10 @@ export declare const toolSchema: {
                     required: string[];
                 };
             };
+            max_notional: {
+                type: string;
+                description: string;
+            };
             confirmation_token: {
                 type: string;
                 description: string;
@@ -63,6 +67,7 @@ declare const orderShape: z.ZodObject<{
 type SingleOrderInput = z.infer<typeof orderShape>;
 type BatchOrdersArgs = {
     orders: SingleOrderInput[];
+    max_notional?: number;
     confirmation_token: string;
 };
 export declare function handlePlaceBatchOrders(args: BatchOrdersArgs, client: BudaClient): Promise<{

package/dist/tools/batch_orders.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"batch_orders.d.ts","sourceRoot":"","sources":["../../src/tools/batch_orders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAIxD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkCtB,CAAC;AAEF,QAAA,MAAM,UAAU;;;;;;;;;;;;iBAMd,CAAC;AAEH,KAAK,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAWnD,KAAK,eAAe,GAAG;IACrB,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA6GhF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAkBpE"}
+{"version":3,"file":"batch_orders.d.ts","sourceRoot":"","sources":["../../src/tools/batch_orders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAIxD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0CtB,CAAC;AAEF,QAAA,MAAM,UAAU;;;;;;;;;;;;iBAMd,CAAC;AAEH,KAAK,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAWnD,KAAK,eAAe,GAAG;IACrB,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAkIhF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CA2BpE"}

package/dist/tools/batch_orders.js

@@ -6,6 +6,7 @@ export const toolSchema = {
     description: "Place multiple orders sequentially on Buda.com (up to 20). " +
         "All orders are pre-validated before any API call — a validation failure stops execution with zero orders placed. " +
         "Partial API failures do NOT roll back already-placed orders. " +
+        "Use max_notional to cap total exposure (computed as sum of amount × limit_price for limit orders; market orders contribute 0). " +
         "IMPORTANT: Pass confirmation_token='CONFIRM' to execute. " +
         "Requires BUDA_API_KEY and BUDA_API_SECRET.",
     inputSchema: {
@@ -26,6 +27,12 @@ export const toolSchema = {
                     required: ["market_id", "type", "price_type", "amount"],
                 },
             },
+            max_notional: {
+                type: "number",
+                description: "Optional spending cap: total notional (sum of amount × limit_price for limit orders). " +
+                    "Batch is rejected before any API call if the sum exceeds this value. " +
+                    "Market orders contribute 0 to the notional since their execution price is unknown.",
+            },
             confirmation_token: {
                 type: "string",
                 description: "Safety confirmation. Must equal exactly 'CONFIRM' (case-sensitive) to execute.",
@@ -42,7 +49,7 @@ const orderShape = z.object({
     limit_price: z.number().positive().optional(),
 });
 export async function handlePlaceBatchOrders(args, client) {
-    const { orders, confirmation_token } = args;
+    const { orders, max_notional, confirmation_token } = args;
     if (confirmation_token !== "CONFIRM") {
         return {
             content: [
@@ -94,6 +101,26 @@ export async function handlePlaceBatchOrders(args, client) {
             };
         }
     }
+    // Notional cap check (limit orders only; market orders have unknown execution price)
+    if (max_notional !== undefined) {
+        const totalNotional = orders.reduce((sum, o) => {
+            return sum + (o.price_type === "limit" && o.limit_price ? o.amount * o.limit_price : 0);
+        }, 0);
+        if (totalNotional > max_notional) {
+            return {
+                content: [{
+                        type: "text",
+                        text: JSON.stringify({
+                            error: `Total notional ${totalNotional} exceeds max_notional cap of ${max_notional}. No orders were placed.`,
+                            code: "NOTIONAL_CAP_EXCEEDED",
+                            total_notional: totalNotional,
+                            max_notional,
+                        }),
+                    }],
+                isError: true,
+            };
+        }
+    }
     // Execute sequentially
     const results = [];
     for (let i = 0; i < orders.length; i++) {
@@ -146,6 +173,13 @@ export function register(server, client) {
             .min(1)
             .max(20)
             .describe("Array of 1–20 orders to place."),
+        max_notional: z
+            .number()
+            .positive()
+            .optional()
+            .describe("Optional spending cap: total notional (sum of amount × limit_price for limit orders). " +
+            "Batch is rejected before any API call if the sum exceeds this value. " +
+            "Market orders contribute 0 to the notional since their execution price is unknown."),
         confirmation_token: z
             .string()
             .describe("Safety confirmation. Must equal exactly 'CONFIRM' (case-sensitive) to execute."),

package/dist/tools/cancel_order.js

@@ -42,7 +42,7 @@ export async function handleCancelOrder(args, client) {
     }
     try {
         const data = await client.put(`/orders/${order_id}`, {
-            state: "canceling",
+            order: { state: "canceling" },
         });
         return {
             content: [{ type: "text", text: JSON.stringify(data.order, null, 2) }],

package/dist/tools/dead_mans_switch.d.ts

@@ -79,6 +79,6 @@ export declare function handleDisarmCancelTimer({ market_id }: MarketOnlyArgs):
     }>;
     isError?: boolean;
 };
-export declare function register(server: McpServer, client: BudaClient): void;
+export declare function register(server: McpServer, client: BudaClient, transport?: "stdio" | "http"): void;
 export {};
 //# sourceMappingURL=dead_mans_switch.d.ts.map

package/dist/tools/dead_mans_switch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dead_mans_switch.d.ts","sourceRoot":"","sources":["../../src/tools/dead_mans_switch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAiDxD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;CA2BtB,CAAC;AAEF,eAAO,MAAM,eAAe;;;;;;;;;;;;;CAgB3B,CAAC;AAEF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;CAgB5B,CAAC;AAIF,KAAK,YAAY,GAAG;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA+ChF;AAED,KAAK,cAAc,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5C,wBAAgB,sBAAsB,CACpC,EAAE,SAAS,EAAE,EAAE,cAAc,EAC7B,MAAM,EAAE,UAAU,GACjB;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CA0CvE;AAED,wBAAgB,uBAAuB,CACrC,EAAE,SAAS,EAAE,EAAE,cAAc,GAC5B;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAwCvE;AAID,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CA0CpE"}
+{"version":3,"file":"dead_mans_switch.d.ts","sourceRoot":"","sources":["../../src/tools/dead_mans_switch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAiDxD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;CA2BtB,CAAC;AAEF,eAAO,MAAM,eAAe;;;;;;;;;;;;;CAgB3B,CAAC;AAEF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;CAgB5B,CAAC;AAIF,KAAK,YAAY,GAAG;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA8DhF;AAED,KAAK,cAAc,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5C,wBAAgB,sBAAsB,CACpC,EAAE,SAAS,EAAE,EAAE,cAAc,EAC7B,MAAM,EAAE,UAAU,GACjB;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CA0CvE;AAED,wBAAgB,uBAAuB,CACrC,EAAE,SAAS,EAAE,EAAE,cAAc,GAC5B;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAwCvE;AAID,wBAAgB,QAAQ,CACtB,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,OAAO,GAAG,MAAgB,GACpC,IAAI,CA2DN"}

package/dist/tools/dead_mans_switch.js

@@ -5,7 +5,7 @@ async function cancelAllOrdersForMarket(marketId, client) {
     try {
         const data = await client.get(`/markets/${marketId}/orders`, { state: "pending", per: 300 });
         const orders = data.orders ?? [];
-        await Promise.allSettled(orders.map((order) => client.put(`/orders/${order.id}`, { state: "canceling" })));
+        await Promise.allSettled(orders.map((order) => client.put(`/orders/${order.id}`, { order: { state: "canceling" } })));
         timers.delete(marketId);
     }
     catch {
@@ -111,6 +111,20 @@ export async function handleScheduleCancelAll(args, client) {
             isError: true,
         };
     }
+    if (!Number.isInteger(ttl_seconds) || ttl_seconds < 10 || ttl_seconds > 300) {
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: JSON.stringify({
+                        error: "ttl_seconds must be an integer between 10 and 300.",
+                        code: "VALIDATION_ERROR",
+                    }),
+                },
+            ],
+            isError: true,
+        };
+    }
     const id = market_id.toLowerCase();
     const entry = armTimer(id, ttl_seconds, client);
     return {
@@ -207,7 +221,7 @@ export function handleDisarmCancelTimer({ market_id }) {
     };
 }
 // ---- Registration ----
-export function register(server, client) {
+export function register(server, client, transport = "stdio") {
     server.tool(toolSchema.name, toolSchema.description, {
         market_id: z
             .string()
@@ -221,7 +235,23 @@ export function register(server, client) {
         confirmation_token: z
             .string()
             .describe("Must equal exactly 'CONFIRM' (case-sensitive) to arm the switch."),
-    }, (args) => handleScheduleCancelAll(args, client));
+    }, (args) => {
+        if (transport === "http") {
+            return Promise.resolve({
+                content: [{
+                        type: "text",
+                        text: JSON.stringify({
+                            error: "schedule_cancel_all is not available on the HTTP transport. " +
+                                "Timer state is lost on every server restart or deploy. " +
+                                "Run buda-mcp in stdio mode on a persistent local process to use this feature.",
+                            code: "TRANSPORT_NOT_SUPPORTED",
+                        }),
+                    }],
+                isError: true,
+            });
+        }
+        return handleScheduleCancelAll(args, client);
+    });
     server.tool(renewToolSchema.name, renewToolSchema.description, {
         market_id: z
             .string()

package/dist/tools/lightning.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lightning.d.ts","sourceRoot":"","sources":["../../src/tools/lightning.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAIxD,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;CAuBzC,CAAC;AAEF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;CAwB5C,CAAC;AAEF,KAAK,uBAAuB,GAAG;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,KAAK,0BAA0B,GAAG;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,uBAAuB,EAC7B,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA+DhF;AAED,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,0BAA0B,EAChC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA8ChF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CA2CpE"}
+{"version":3,"file":"lightning.d.ts","sourceRoot":"","sources":["../../src/tools/lightning.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAIxD,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;CAuBzC,CAAC;AAEF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;CAwB5C,CAAC;AAEF,KAAK,uBAAuB,GAAG;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,KAAK,0BAA0B,GAAG;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,uBAAuB,EAC7B,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA+EhF;AAED,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,0BAA0B,EAChC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA8ChF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CA2CpE"}

package/dist/tools/lightning.js

@@ -66,6 +66,20 @@ export async function handleLightningWithdrawal(args, client) {
             isError: true,
         };
     }
+    const BOLT11_RE = /^ln(bc|tb|bcrt)\d/i;
+    if (!BOLT11_RE.test(invoice)) {
+        return {
+            content: [{
+                    type: "text",
+                    text: JSON.stringify({
+                        error: "Invalid Lightning invoice format. " +
+                            "Expected a BOLT-11 string starting with 'lnbc', 'lntb', or 'lnbcrt'.",
+                        code: "INVALID_INVOICE",
+                    }),
+                }],
+            isError: true,
+        };
+    }
     try {
         const data = await client.post(`/reserves/ln-btc/withdrawals`, { invoice });
         const lw = data.lightning_withdrawal;
@@ -141,7 +155,7 @@ export function register(server, client) {
     server.tool(lightningWithdrawalToolSchema.name, lightningWithdrawalToolSchema.description, {
         invoice: z
             .string()
-            .min(1)
+            .min(50)
             .describe("BOLT-11 Lightning invoice string (starts with 'lnbc', 'lntb', etc.)."),
         confirmation_token: z
             .string()

package/dist/tools/place_order.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"place_order.d.ts","sourceRoot":"","sources":["../../src/tools/place_order.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAIxD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmEtB,CAAC;AAEF,KAAK,cAAc,GAAG;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,KAAK,GAAG,KAAK,CAAC;IACpB,UAAU,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAqIhF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CA4DpE"}
+{"version":3,"file":"place_order.d.ts","sourceRoot":"","sources":["../../src/tools/place_order.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAIxD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmEtB,CAAC;AAEF,KAAK,cAAc,GAAG;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,KAAK,GAAG,KAAK,CAAC;IACpB,UAAU,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAqKhF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CA4DpE"}

package/dist/tools/place_order.js

@@ -145,6 +145,37 @@ export async function handlePlaceOrder(args, client) {
                     isError: true,
                 };
             }
+            if (gtd_timestamp !== undefined) {
+                const ts = new Date(gtd_timestamp).getTime();
+                if (isNaN(ts)) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: JSON.stringify({
+                                    error: "gtd_timestamp must be a valid ISO 8601 datetime string.",
+                                    code: "VALIDATION_ERROR",
+                                }),
+                            },
+                        ],
+                        isError: true,
+                    };
+                }
+                if (ts <= Date.now()) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: JSON.stringify({
+                                    error: "gtd_timestamp must be a future datetime.",
+                                    code: "VALIDATION_ERROR",
+                                }),
+                            },
+                        ],
+                        isError: true,
+                    };
+                }
+            }
             let limitType = "gtc";
             if (ioc)
                 limitType = "ioc";

package/dist/tools/receive_addresses.d.ts

@@ -10,6 +10,10 @@ export declare const createReceiveAddressToolSchema: {
                 type: string;
                 description: string;
             };
+            confirmation_token: {
+                type: string;
+                description: string;
+            };
         };
         required: string[];
     };
@@ -67,6 +71,7 @@ export declare function handleGetReceiveAddress(args: {
 }>;
 export declare function handleCreateReceiveAddress(args: {
     currency: string;
+    confirmation_token: string;
 }, client: BudaClient): Promise<{
     content: Array<{
         type: "text";

package/dist/tools/receive_addresses.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"receive_addresses.d.ts","sourceRoot":"","sources":["../../src/tools/receive_addresses.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAIxD,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;CAmB1C,CAAC;AAEF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;CAiB1C,CAAC;AAEF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;CAoBvC,CAAC;AAYF,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,EAC1B,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAqChF;AAED,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,EACtC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA4BhF;AAED,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,EAC1B,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA6BhF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CA4BpE"}
+{"version":3,"file":"receive_addresses.d.ts","sourceRoot":"","sources":["../../src/tools/receive_addresses.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAIxD,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;CAwB1C,CAAC;AAEF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;CAiB1C,CAAC;AAEF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;CAoBvC,CAAC;AAYF,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,EAC1B,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAqChF;AAED,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,EACtC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA4BhF;AAED,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,EACtD,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA+ChF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CA+BpE"}

package/dist/tools/receive_addresses.js

@@ -6,6 +6,7 @@ export const createReceiveAddressToolSchema = {
     description: "Generates a new receive address for a crypto currency. " +
         "Creates a new blockchain deposit address for the given currency. " +
         "Each call generates a distinct address. Not idempotent. " +
+        "IMPORTANT: Pass confirmation_token='CONFIRM' to execute. " +
         "Only applicable to crypto currencies (BTC, ETH, etc.). " +
         "Requires BUDA_API_KEY and BUDA_API_SECRET. " +
         "Example: 'Give me a fresh Bitcoin deposit address.'",
@@ -16,8 +17,12 @@ export const createReceiveAddressToolSchema = {
                 type: "string",
                 description: "Currency code (e.g. 'BTC', 'ETH').",
             },
+            confirmation_token: {
+                type: "string",
+                description: "Safety confirmation. Must equal exactly 'CONFIRM' (case-sensitive) to generate a new address.",
+            },
         },
-        required: ["currency"],
+        required: ["currency", "confirmation_token"],
     },
 };
 export const listReceiveAddressesToolSchema = {
@@ -122,7 +127,23 @@ export async function handleGetReceiveAddress(args, client) {
     }
 }
 export async function handleCreateReceiveAddress(args, client) {
-    const { currency } = args;
+    const { currency, confirmation_token } = args;
+    if (confirmation_token !== "CONFIRM") {
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: JSON.stringify({
+                        error: "Address not generated. confirmation_token must equal 'CONFIRM' to execute. " +
+                            "Each call creates a distinct address — review and set confirmation_token='CONFIRM' to proceed.",
+                        code: "CONFIRMATION_REQUIRED",
+                        preview: { currency },
+                    }),
+                },
+            ],
+            isError: true,
+        };
+    }
     const validationError = validateCurrency(currency);
     if (validationError) {
         return {
@@ -156,6 +177,9 @@ export function register(server, client) {
     }, (args) => handleGetReceiveAddress(args, client));
     server.tool(createReceiveAddressToolSchema.name, createReceiveAddressToolSchema.description, {
         currency: z.string().min(2).max(10).describe("Currency code (e.g. 'BTC', 'ETH')."),
+        confirmation_token: z
+            .string()
+            .describe("Safety confirmation. Must equal exactly 'CONFIRM' (case-sensitive) to generate a new address."),
     }, (args) => handleCreateReceiveAddress(args, client));
 }
 //# sourceMappingURL=receive_addresses.js.map

package/dist/tools/remittances.d.ts

@@ -35,6 +35,10 @@ export declare const quoteRemittanceToolSchema: {
                 type: string;
                 description: string;
             };
+            confirmation_token: {
+                type: string;
+                description: string;
+            };
         };
         required: string[];
     };
@@ -94,6 +98,7 @@ export declare function handleQuoteRemittance(args: {
     currency: string;
     amount: number;
     recipient_id: number;
+    confirmation_token: string;
 }, client: BudaClient): Promise<{
     content: Array<{
         type: "text";

package/dist/tools/remittances.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remittances.d.ts","sourceRoot":"","sources":["../../src/tools/remittances.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAKxD,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;CAoBrC,CAAC;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;CA4BrC,CAAC;AAEF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;CAuB3C,CAAC;AAEF,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;CAiBnC,CAAC;AAgBF,wBAAsB,qBAAqB,CACzC,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EACrC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAoChF;AAED,wBAAsB,mBAAmB,CACvC,IAAI,EAAE;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EACpB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAgBhF;AAED,wBAAsB,qBAAqB,CACzC,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,EAChE,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAgChF;AAED,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,EAChD,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAqChF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAwCpE"}
+{"version":3,"file":"remittances.d.ts","sourceRoot":"","sources":["../../src/tools/remittances.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAKxD,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;CAoBrC,CAAC;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;CAiCrC,CAAC;AAEF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;CAuB3C,CAAC;AAEF,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;CAiBnC,CAAC;AAgBF,wBAAsB,qBAAqB,CACzC,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EACrC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAoChF;AAED,wBAAsB,mBAAmB,CACvC,IAAI,EAAE;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EACpB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAgBhF;AAED,wBAAsB,qBAAqB,CACzC,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,EAC5F,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAkDhF;AAED,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,EAChD,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAqChF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CA2CpE"}

package/dist/tools/remittances.js

@@ -28,7 +28,8 @@ export const quoteRemittanceToolSchema = {
         "Requests a price quote for a fiat remittance to a saved recipient. " +
         "Returns a remittance object in 'quoted' state with an expiry timestamp. " +
         "NOT idempotent — creates a new remittance record each call. " +
-        "To execute, call accept_remittance_quote with the returned ID before it expires. " +
+        "IMPORTANT: Pass confirmation_token='CONFIRM' to execute. " +
+        "To execute the transfer, call accept_remittance_quote with the returned ID before it expires. " +
         "Requires BUDA_API_KEY and BUDA_API_SECRET. " +
         "Example: 'Get a remittance quote to send 100000 CLP to recipient 5.'",
     inputSchema: {
@@ -46,8 +47,12 @@ export const quoteRemittanceToolSchema = {
                 type: "number",
                 description: "ID of the saved remittance recipient.",
             },
+            confirmation_token: {
+                type: "string",
+                description: "Safety confirmation. Must equal exactly 'CONFIRM' (case-sensitive) to create the quote.",
+            },
         },
-        required: ["currency", "amount", "recipient_id"],
+        required: ["currency", "amount", "recipient_id", "confirmation_token"],
     },
 };
 export const acceptRemittanceQuoteToolSchema = {
@@ -151,7 +156,23 @@ export async function handleGetRemittance(args, client) {
     }
 }
 export async function handleQuoteRemittance(args, client) {
-    const { currency, amount, recipient_id } = args;
+    const { currency, amount, recipient_id, confirmation_token } = args;
+    if (confirmation_token !== "CONFIRM") {
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: JSON.stringify({
+                        error: "Remittance quote not created. confirmation_token must equal 'CONFIRM' to execute. " +
+                            "Review the details and set confirmation_token='CONFIRM' to proceed.",
+                        code: "CONFIRMATION_REQUIRED",
+                        preview: { currency, amount, recipient_id },
+                    }),
+                },
+            ],
+            isError: true,
+        };
+    }
     const validationError = validateCurrency(currency);
     if (validationError) {
         return {
@@ -228,6 +249,9 @@ export function register(server, client) {
         currency: z.string().min(2).max(10).describe("Fiat currency code (e.g. 'CLP', 'COP')."),
         amount: z.number().positive().describe("Amount to remit (positive number)."),
         recipient_id: z.number().int().positive().describe("ID of the saved remittance recipient."),
+        confirmation_token: z
+            .string()
+            .describe("Safety confirmation. Must equal exactly 'CONFIRM' (case-sensitive) to create the quote."),
     }, (args) => handleQuoteRemittance(args, client));
     server.tool(acceptRemittanceQuoteToolSchema.name, acceptRemittanceQuoteToolSchema.description, {
         id: z.number().int().positive().describe("The numeric ID of the remittance quote to accept."),

package/dist/tools/technical_indicators.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"technical_indicators.d.ts","sourceRoot":"","sources":["../../src/tools/technical_indicators.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAKxD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;CA8BtB,CAAC;AAsGF,KAAK,uBAAuB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,uBAAuB,EAC7B,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA2GhF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAyBpE"}
+{"version":3,"file":"technical_indicators.d.ts","sourceRoot":"","sources":["../../src/tools/technical_indicators.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAKxD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;CA8BtB,CAAC;AAsGF,KAAK,uBAAuB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,uBAAuB,EAC7B,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA4GhF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAyBpE"}

package/dist/tools/technical_indicators.js

@@ -146,7 +146,7 @@ export async function handleTechnicalIndicators(args, client) {
         const macdResult = macd(closes, 12, 26, 9);
         const bbResult = bollingerBands(closes, 20, 2);
         const sma20 = parseFloat(sma(closes, 20).toFixed(2));
-        const sma50 = parseFloat(sma(closes, 50).toFixed(2));
+        const sma50 = closes.length >= 50 ? parseFloat(sma(closes, 50).toFixed(2)) : null;
         const lastClose = closes[closes.length - 1];
         // Signal interpretations
         const rsiSignal = rsiValue !== null && rsiValue > 70
@@ -180,6 +180,7 @@ export async function handleTechnicalIndicators(args, client) {
                 bollinger_bands: bbResult,
                 sma_20: sma20,
                 sma_50: sma50,
+                sma_50_warning: sma50 === null ? `insufficient data (need 50 candles, have ${closes.length})` : undefined,
             },
             signals: {
                 rsi_signal: rsiSignal,

package/dist/tools/withdrawals.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"withdrawals.d.ts","sourceRoot":"","sources":["../../src/tools/withdrawals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAKxD,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;CA8B1C,CAAC;AAEF,KAAK,wBAAwB,GAAG;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,mBAAmB,GAAG,SAAS,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,CAAC;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAqBF,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,wBAAwB,EAC9B,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA+ChF;AAED,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsBtC,CAAC;AAEF,KAAK,oBAAoB,GAAG;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,oBAAoB,EAC1B,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAyFhF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CA+BpE"}
+{"version":3,"file":"withdrawals.d.ts","sourceRoot":"","sources":["../../src/tools/withdrawals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAKxD,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;CA8B1C,CAAC;AAEF,KAAK,wBAAwB,GAAG;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,mBAAmB,GAAG,SAAS,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,CAAC;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAqBF,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,wBAAwB,EAC9B,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA+ChF;AAED,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuBtC,CAAC;AAEF,KAAK,oBAAoB,GAAG;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,oBAAoB,EAC1B,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAmGhF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CA+BpE"}