@guiie/buda-mcp 1.5.0 → 1.5.2

package/dist/audit.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Structured audit logging for destructive MCP tool calls.
+ *
+ * Writes newline-delimited JSON to stderr so it never pollutes the stdio MCP transport
+ * and is captured by Railway / any log aggregator attached to the process.
+ *
+ * Rules for args_summary:
+ *   - Include: market_id, currency, price_type, type, amount ranges
+ *   - NEVER include: confirmation_token, invoice, address, bank_account_id
+ */
+export interface AuditEvent {
+    ts: string;
+    tool: string;
+    transport: "http" | "stdio";
+    ip?: string;
+    args_summary: Record<string, unknown>;
+    success: boolean;
+    error_code?: string | number;
+}
+export declare function logAudit(event: AuditEvent): void;
+//# sourceMappingURL=audit.d.ts.map

package/dist/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IAC5B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAC9B;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAEhD"}

package/dist/audit.js

@@ -0,0 +1,14 @@
+/**
+ * Structured audit logging for destructive MCP tool calls.
+ *
+ * Writes newline-delimited JSON to stderr so it never pollutes the stdio MCP transport
+ * and is captured by Railway / any log aggregator attached to the process.
+ *
+ * Rules for args_summary:
+ *   - Include: market_id, currency, price_type, type, amount ranges
+ *   - NEVER include: confirmation_token, invoice, address, bank_account_id
+ */
+export function logAudit(event) {
+    process.stderr.write(JSON.stringify({ audit: true, ...event }) + "\n");
+}
+//# sourceMappingURL=audit.js.map

package/dist/client.d.ts

@@ -10,6 +10,7 @@ export declare class BudaClient {
     private readonly apiSecret;
     constructor(baseUrl?: string, apiKey?: string, apiSecret?: string);
     hasAuth(): boolean;
+    private _nonceCounter;
     private nonce;
     private sign;
     private authHeaders;

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAKA,qBAAa,YAAa,SAAQ,KAAK;aAEnB,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM;aAEZ,YAAY,CAAC,EAAE,MAAM;gBAHrB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM,EACC,YAAY,CAAC,EAAE,MAAM,YAAA;CAKxC;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;gBAG7C,OAAO,GAAE,MAAiB,EAC1B,MAAM,CAAC,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM;IAOpB,OAAO,IAAI,OAAO;IAIlB,OAAO,CAAC,KAAK;IAIb,OAAO,CAAC,IAAI;IASZ,OAAO,CAAC,WAAW;IAWnB;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAOzB;;;;OAIG;YACW,cAAc;YA2Bd,cAAc;IActB,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAoB1E,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAmBnD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAmBlD,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAmBpF"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAKA,qBAAa,YAAa,SAAQ,KAAK;aAEnB,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM;aAEZ,YAAY,CAAC,EAAE,MAAM;gBAHrB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM,EACC,YAAY,CAAC,EAAE,MAAM,YAAA;CAKxC;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;gBAG7C,OAAO,GAAE,MAAiB,EAC1B,MAAM,CAAC,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM;IAOpB,OAAO,IAAI,OAAO;IAIlB,OAAO,CAAC,aAAa,CAAK;IAE1B,OAAO,CAAC,KAAK;IAIb,OAAO,CAAC,IAAI;IASZ,OAAO,CAAC,WAAW;IAWnB;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAOzB;;;;OAIG;YACW,cAAc;YA2Bd,cAAc;IActB,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAoB1E,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAmBnD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAmBlD,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAmBpF"}

package/dist/client.js

@@ -25,8 +25,9 @@ export class BudaClient {
     hasAuth() {
         return Boolean(this.apiKey && this.apiSecret);
     }
+    _nonceCounter = 0;
     nonce() {
-        return String(Math.floor(Date.now() * 1000));
+        return String(Date.now() * 1000 + (this._nonceCounter++ % 1000));
     }
     sign(method, pathWithQuery, body, nonce) {
         const encodedBody = body ? Buffer.from(body).toString("base64") : "";

package/dist/http.js

@@ -1,9 +1,12 @@
 import express from "express";
+import rateLimit from "express-rate-limit";
 import { McpServer, ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { BudaClient } from "./client.js";
 import { MemoryCache, CACHE_TTL } from "./cache.js";
+import { safeTokenEqual, parseEnvInt } from "./utils.js";
 import { VERSION } from "./version.js";
+import { validateMarketId } from "./validation.js";
 import * as markets from "./tools/markets.js";
 import * as ticker from "./tools/ticker.js";
 import * as orderbook from "./tools/orderbook.js";
@@ -39,7 +42,14 @@ import * as cancelOrderByClientId from "./tools/cancel_order_by_client_id.js";
 import * as batchOrders from "./tools/batch_orders.js";
 import * as lightning from "./tools/lightning.js";
 import { handleMarketSummary } from "./tools/market_summary.js";
-const PORT = parseInt(process.env.PORT ?? "3000", 10);
+let PORT;
+try {
+    PORT = parseEnvInt(process.env.PORT, 3000, 1, 65535, "PORT");
+}
+catch (err) {
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+}
 const client = new BudaClient(undefined, process.env.BUDA_API_KEY, process.env.BUDA_API_SECRET);
 const authEnabled = client.hasAuth();
 // Schemas for the Smithery server-card — assembled from the same definitions used in register().
@@ -119,7 +129,7 @@ function createServer() {
         orders.register(server, client);
         placeOrder.register(server, client);
         cancelOrder.register(server, client);
-        deadMansSwitch.register(server, client);
+        deadMansSwitch.register(server, client, "http");
         account.register(server, client);
         balance.register(server, client);
         orderLookup.register(server, client);
@@ -148,7 +158,11 @@ function createServer() {
         };
     });
     server.resource("buda-ticker", new ResourceTemplate("buda://ticker/{market}", { list: undefined }), async (uri, params) => {
-        const marketId = params.market.toLowerCase();
+        const raw = params.market;
+        const validationError = validateMarketId(raw);
+        if (validationError)
+            throw new Error(validationError);
+        const marketId = raw.toLowerCase();
         const data = await reqCache.getOrFetch(`ticker:${marketId}`, CACHE_TTL.TICKER, () => client.get(`/markets/${marketId}/ticker`));
         return {
             contents: [
@@ -161,9 +175,13 @@ function createServer() {
         };
     });
     server.resource("buda-summary", new ResourceTemplate("buda://summary/{market}", { list: undefined }), async (uri, params) => {
-        const marketId = params.market.toUpperCase();
+        const raw = params.market;
+        const validationError = validateMarketId(raw);
+        if (validationError)
+            throw new Error(validationError);
+        const marketId = raw.toUpperCase();
         const result = await handleMarketSummary({ market_id: marketId }, client, reqCache);
-        const text = result.content[0].text;
+        const text = result.content[0]?.text ?? JSON.stringify({ error: "No content returned" });
         return {
             contents: [
                 {
@@ -177,7 +195,47 @@ function createServer() {
     return server;
 }
 const app = express();
+// Required for correct client IP detection behind Railway's reverse proxy.
+// Without this, express-rate-limit sees the proxy IP instead of the real client.
+app.set("trust proxy", 1);
 app.use(express.json());
+const MCP_AUTH_TOKEN = process.env.MCP_AUTH_TOKEN;
+if (authEnabled && !MCP_AUTH_TOKEN) {
+    console.error("[buda-mcp] FATAL: BUDA_API_KEY/BUDA_API_SECRET are set but MCP_AUTH_TOKEN is not.\n" +
+        "  The /mcp endpoint would be publicly accessible with full account access.\n" +
+        "  Set MCP_AUTH_TOKEN to a long random secret, or run in stdio mode instead.");
+    process.exit(1);
+}
+if (MCP_AUTH_TOKEN && MCP_AUTH_TOKEN.length < 32) {
+    console.warn("[buda-mcp] WARNING: MCP_AUTH_TOKEN has fewer than 32 characters. Use a longer random secret.");
+}
+let rateLimitMax;
+try {
+    rateLimitMax = parseEnvInt(process.env.MCP_RATE_LIMIT, 120, 1, 10_000, "MCP_RATE_LIMIT");
+}
+catch (err) {
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+}
+const mcpRateLimiter = rateLimit({
+    windowMs: 60_000,
+    max: rateLimitMax,
+    standardHeaders: true,
+    legacyHeaders: false,
+    message: { error: "Too many requests. Retry after 60 seconds.", code: "RATE_LIMITED" },
+});
+function mcpAuthMiddleware(req, res, next) {
+    if (!MCP_AUTH_TOKEN) {
+        next();
+        return;
+    }
+    const auth = req.headers.authorization ?? "";
+    if (!safeTokenEqual(auth, `Bearer ${MCP_AUTH_TOKEN}`)) {
+        res.status(401).json({ error: "Unauthorized" });
+        return;
+    }
+    next();
+}
 // Health check for Railway / uptime monitors
 app.get("/health", (_req, res) => {
     res.json({
@@ -203,7 +261,7 @@ app.get("/.well-known/mcp/server-card.json", (_req, res) => {
     });
 });
 // Stateless StreamableHTTP — new server instance per request (no session state needed)
-app.post("/mcp", async (req, res) => {
+app.post("/mcp", mcpRateLimiter, mcpAuthMiddleware, async (req, res) => {
     const transport = new StreamableHTTPServerTransport({
         sessionIdGenerator: undefined,
     });
@@ -215,7 +273,7 @@ app.post("/mcp", async (req, res) => {
     await transport.handleRequest(req, res, req.body);
 });
 // SSE upgrade for clients that prefer streaming
-app.get("/mcp", async (req, res) => {
+app.get("/mcp", mcpRateLimiter, mcpAuthMiddleware, async (req, res) => {
     const transport = new StreamableHTTPServerTransport({
         sessionIdGenerator: undefined,
     });

package/dist/index.js

@@ -5,6 +5,7 @@ import { ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { BudaClient } from "./client.js";
 import { cache, CACHE_TTL } from "./cache.js";
 import { VERSION } from "./version.js";
+import { validateMarketId } from "./validation.js";
 import * as markets from "./tools/markets.js";
 import * as ticker from "./tools/ticker.js";
 import * as orderbook from "./tools/orderbook.js";
@@ -97,7 +98,11 @@ server.resource("buda-markets", "buda://markets", async (uri) => {
     };
 });
 server.resource("buda-ticker", new ResourceTemplate("buda://ticker/{market}", { list: undefined }), async (uri, params) => {
-    const marketId = params.market.toLowerCase();
+    const raw = params.market;
+    const validationError = validateMarketId(raw);
+    if (validationError)
+        throw new Error(validationError);
+    const marketId = raw.toLowerCase();
     const data = await cache.getOrFetch(`ticker:${marketId}`, CACHE_TTL.TICKER, () => client.get(`/markets/${marketId}/ticker`));
     return {
         contents: [
@@ -110,9 +115,13 @@ server.resource("buda-ticker", new ResourceTemplate("buda://ticker/{market}", {
     };
 });
 server.resource("buda-summary", new ResourceTemplate("buda://summary/{market}", { list: undefined }), async (uri, params) => {
-    const marketId = params.market.toUpperCase();
+    const raw = params.market;
+    const validationError = validateMarketId(raw);
+    if (validationError)
+        throw new Error(validationError);
+    const marketId = raw.toUpperCase();
     const result = await handleMarketSummary({ market_id: marketId }, client, cache);
-    const text = result.content[0].text;
+    const text = result.content[0]?.text ?? JSON.stringify({ error: "No content returned" });
     return {
         contents: [
             {

package/dist/tools/account.js

@@ -35,7 +35,7 @@ export async function handleGetAccountInfo(client) {
     }
     catch (err) {
         const msg = err instanceof BudaApiError
-            ? { error: err.message, code: err.status, path: err.path }
+            ? { error: err.message, code: err.status }
             : { error: String(err), code: "UNKNOWN" };
         return {
             content: [{ type: "text", text: JSON.stringify(msg) }],

package/dist/tools/arbitrage.js

@@ -118,7 +118,7 @@ export async function handleArbitrageOpportunities({ base_currency, threshold_pc
     }
     catch (err) {
         const msg = err instanceof BudaApiError
-            ? { error: err.message, code: err.status, path: err.path }
+            ? { error: err.message, code: err.status }
             : { error: String(err), code: "UNKNOWN" };
         return {
             content: [{ type: "text", text: JSON.stringify(msg) }],

package/dist/tools/balance.js

@@ -56,7 +56,7 @@ export async function handleGetBalance(args, client) {
     }
     catch (err) {
         const msg = err instanceof BudaApiError
-            ? { error: err.message, code: err.status, path: err.path }
+            ? { error: err.message, code: err.status }
             : { error: String(err), code: "UNKNOWN" };
         return {
             content: [{ type: "text", text: JSON.stringify(msg) }],

package/dist/tools/balances.js

@@ -39,7 +39,7 @@ export function register(server, client) {
         }
         catch (err) {
             const msg = err instanceof BudaApiError
-                ? { error: err.message, code: err.status, path: err.path }
+                ? { error: err.message, code: err.status }
                 : { error: String(err), code: "UNKNOWN" };
             return {
                 content: [{ type: "text", text: JSON.stringify(msg) }],

package/dist/tools/banks.js

@@ -52,7 +52,7 @@ export async function handleGetAvailableBanks(args, client, cache) {
             };
         }
         const msg = err instanceof BudaApiError
-            ? { error: err.message, code: err.status, path: err.path }
+            ? { error: err.message, code: err.status }
             : { error: String(err), code: "UNKNOWN" };
         return {
             content: [{ type: "text", text: JSON.stringify(msg) }],

package/dist/tools/batch_orders.d.ts

@@ -39,6 +39,10 @@ export declare const toolSchema: {
                     required: string[];
                 };
             };
+            max_notional: {
+                type: string;
+                description: string;
+            };
             confirmation_token: {
                 type: string;
                 description: string;
@@ -63,9 +67,10 @@ declare const orderShape: z.ZodObject<{
 type SingleOrderInput = z.infer<typeof orderShape>;
 type BatchOrdersArgs = {
     orders: SingleOrderInput[];
+    max_notional?: number;
     confirmation_token: string;
 };
-export declare function handlePlaceBatchOrders(args: BatchOrdersArgs, client: BudaClient): Promise<{
+export declare function handlePlaceBatchOrders(args: BatchOrdersArgs, client: BudaClient, transport?: "http" | "stdio"): Promise<{
     content: Array<{
         type: "text";
         text: string;

package/dist/tools/batch_orders.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"batch_orders.d.ts","sourceRoot":"","sources":["../../src/tools/batch_orders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAIxD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkCtB,CAAC;AAEF,QAAA,MAAM,UAAU;;;;;;;;;;;;iBAMd,CAAC;AAEH,KAAK,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAWnD,KAAK,eAAe,GAAG;IACrB,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA6GhF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAkBpE"}
+{"version":3,"file":"batch_orders.d.ts","sourceRoot":"","sources":["../../src/tools/batch_orders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAKxD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0CtB,CAAC;AAEF,QAAA,MAAM,UAAU;;;;;;;;;;;;iBAMd,CAAC;AAEH,KAAK,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAWnD,KAAK,eAAe,GAAG;IACrB,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA2IhF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CA2BpE"}

package/dist/tools/batch_orders.js

@@ -1,11 +1,13 @@
 import { z } from "zod";
 import { BudaApiError } from "../client.js";
 import { validateMarketId } from "../validation.js";
+import { logAudit } from "../audit.js";
 export const toolSchema = {
     name: "place_batch_orders",
     description: "Place multiple orders sequentially on Buda.com (up to 20). " +
         "All orders are pre-validated before any API call — a validation failure stops execution with zero orders placed. " +
         "Partial API failures do NOT roll back already-placed orders. " +
+        "Use max_notional to cap total exposure (computed as sum of amount × limit_price for limit orders; market orders contribute 0). " +
         "IMPORTANT: Pass confirmation_token='CONFIRM' to execute. " +
         "Requires BUDA_API_KEY and BUDA_API_SECRET.",
     inputSchema: {
@@ -26,6 +28,12 @@ export const toolSchema = {
                     required: ["market_id", "type", "price_type", "amount"],
                 },
             },
+            max_notional: {
+                type: "number",
+                description: "Optional spending cap: total notional (sum of amount × limit_price for limit orders). " +
+                    "Batch is rejected before any API call if the sum exceeds this value. " +
+                    "Market orders contribute 0 to the notional since their execution price is unknown.",
+            },
             confirmation_token: {
                 type: "string",
                 description: "Safety confirmation. Must equal exactly 'CONFIRM' (case-sensitive) to execute.",
@@ -41,8 +49,8 @@ const orderShape = z.object({
     amount: z.number().positive(),
     limit_price: z.number().positive().optional(),
 });
-export async function handlePlaceBatchOrders(args, client) {
-    const { orders, confirmation_token } = args;
+export async function handlePlaceBatchOrders(args, client, transport = "stdio") {
+    const { orders, max_notional, confirmation_token } = args;
     if (confirmation_token !== "CONFIRM") {
         return {
             content: [
@@ -94,6 +102,26 @@ export async function handlePlaceBatchOrders(args, client) {
             };
         }
     }
+    // Notional cap check (limit orders only; market orders have unknown execution price)
+    if (max_notional !== undefined) {
+        const totalNotional = orders.reduce((sum, o) => {
+            return sum + (o.price_type === "limit" && o.limit_price ? o.amount * o.limit_price : 0);
+        }, 0);
+        if (totalNotional > max_notional) {
+            return {
+                content: [{
+                        type: "text",
+                        text: JSON.stringify({
+                            error: `Total notional ${totalNotional} exceeds max_notional cap of ${max_notional}. No orders were placed.`,
+                            code: "NOTIONAL_CAP_EXCEEDED",
+                            total_notional: totalNotional,
+                            max_notional,
+                        }),
+                    }],
+                isError: true,
+            };
+        }
+    }
     // Execute sequentially
     const results = [];
     for (let i = 0; i < orders.length; i++) {
@@ -134,9 +162,18 @@ export async function handlePlaceBatchOrders(args, client) {
     if (failed > 0 && succeeded > 0) {
         response.warning = "Some orders failed. Already-placed orders were NOT rolled back.";
     }
+    const isError = failed > 0 && succeeded === 0 ? true : undefined;
+    logAudit({
+        ts: new Date().toISOString(),
+        tool: "place_batch_orders",
+        transport,
+        args_summary: { order_count: orders.length, succeeded, failed },
+        success: !isError,
+        error_code: isError ? "PARTIAL_OR_FULL_FAILURE" : undefined,
+    });
     return {
         content: [{ type: "text", text: JSON.stringify(response, null, 2) }],
-        isError: failed > 0 && succeeded === 0 ? true : undefined,
+        isError,
     };
 }
 export function register(server, client) {
@@ -146,6 +183,13 @@ export function register(server, client) {
             .min(1)
             .max(20)
             .describe("Array of 1–20 orders to place."),
+        max_notional: z
+            .number()
+            .positive()
+            .optional()
+            .describe("Optional spending cap: total notional (sum of amount × limit_price for limit orders). " +
+            "Batch is rejected before any API call if the sum exceeds this value. " +
+            "Market orders contribute 0 to the notional since their execution price is unknown."),
         confirmation_token: z
             .string()
             .describe("Safety confirmation. Must equal exactly 'CONFIRM' (case-sensitive) to execute."),

package/dist/tools/cancel_all_orders.d.ts

@@ -22,7 +22,7 @@ type CancelAllOrdersArgs = {
     market_id: string;
     confirmation_token: string;
 };
-export declare function handleCancelAllOrders(args: CancelAllOrdersArgs, client: BudaClient): Promise<{
+export declare function handleCancelAllOrders(args: CancelAllOrdersArgs, client: BudaClient, transport?: "http" | "stdio"): Promise<{
     content: Array<{
         type: "text";
         text: string;

package/dist/tools/cancel_all_orders.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cancel_all_orders.d.ts","sourceRoot":"","sources":["../../src/tools/cancel_all_orders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAIxD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;CAuBtB,CAAC;AAEF,KAAK,mBAAmB,GAAG;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAyDhF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAkBpE"}
+{"version":3,"file":"cancel_all_orders.d.ts","sourceRoot":"","sources":["../../src/tools/cancel_all_orders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAKxD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;CAuBtB,CAAC;AAEF,KAAK,mBAAmB,GAAG;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAqDhF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAkBpE"}

package/dist/tools/cancel_all_orders.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { BudaApiError } from "../client.js";
 import { validateMarketId } from "../validation.js";
+import { logAudit } from "../audit.js";
 export const toolSchema = {
     name: "cancel_all_orders",
     description: "Cancel all open orders on Buda.com, optionally filtered by a specific market. " +
@@ -23,7 +24,7 @@ export const toolSchema = {
         required: ["market_id", "confirmation_token"],
     },
 };
-export async function handleCancelAllOrders(args, client) {
+export async function handleCancelAllOrders(args, client, transport = "stdio") {
     const { market_id, confirmation_token } = args;
     if (confirmation_token !== "CONFIRM") {
         return {
@@ -55,23 +56,19 @@ export async function handleCancelAllOrders(args, client) {
     try {
         const params = market_id !== "*" ? { market_id: market_id.toLowerCase() } : undefined;
         const data = await client.delete(`/orders`, params);
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: JSON.stringify({ canceled_count: data.canceled_count, market_id }),
-                },
-            ],
+        const result = {
+            content: [{ type: "text", text: JSON.stringify({ canceled_count: data.canceled_count, market_id }) }],
         };
+        logAudit({ ts: new Date().toISOString(), tool: "cancel_all_orders", transport, args_summary: { market_id }, success: true });
+        return result;
     }
     catch (err) {
         const msg = err instanceof BudaApiError
-            ? { error: err.message, code: err.status, path: err.path }
+            ? { error: err.message, code: err.status }
             : { error: String(err), code: "UNKNOWN" };
-        return {
-            content: [{ type: "text", text: JSON.stringify(msg) }],
-            isError: true,
-        };
+        const result = { content: [{ type: "text", text: JSON.stringify(msg) }], isError: true };
+        logAudit({ ts: new Date().toISOString(), tool: "cancel_all_orders", transport, args_summary: { market_id }, success: false, error_code: msg.code });
+        return result;
     }
 }
 export function register(server, client) {

package/dist/tools/cancel_order.d.ts

@@ -22,7 +22,7 @@ type CancelOrderArgs = {
     order_id: number;
     confirmation_token: string;
 };
-export declare function handleCancelOrder(args: CancelOrderArgs, client: BudaClient): Promise<{
+export declare function handleCancelOrder(args: CancelOrderArgs, client: BudaClient, transport?: "http" | "stdio"): Promise<{
     content: Array<{
         type: "text";
         text: string;

package/dist/tools/cancel_order.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cancel_order.d.ts","sourceRoot":"","sources":["../../src/tools/cancel_order.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAGxD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;CAuBtB,CAAC;AAEF,KAAK,eAAe,GAAG;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAuChF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAmBpE"}
+{"version":3,"file":"cancel_order.d.ts","sourceRoot":"","sources":["../../src/tools/cancel_order.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAIxD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;CAuBtB,CAAC;AAEF,KAAK,eAAe,GAAG;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAsChF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAmBpE"}

package/dist/tools/cancel_order.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { BudaApiError } from "../client.js";
+import { logAudit } from "../audit.js";
 export const toolSchema = {
     name: "cancel_order",
     description: "Cancel an open order by ID on Buda.com. " +
@@ -22,7 +23,7 @@ export const toolSchema = {
         required: ["order_id", "confirmation_token"],
     },
 };
-export async function handleCancelOrder(args, client) {
+export async function handleCancelOrder(args, client, transport = "stdio") {
     const { order_id, confirmation_token } = args;
     if (confirmation_token !== "CONFIRM") {
         return {
@@ -42,20 +43,19 @@ export async function handleCancelOrder(args, client) {
     }
     try {
         const data = await client.put(`/orders/${order_id}`, {
-            state: "canceling",
+            order: { state: "canceling" },
         });
-        return {
-            content: [{ type: "text", text: JSON.stringify(data.order, null, 2) }],
-        };
+        const result = { content: [{ type: "text", text: JSON.stringify(data.order, null, 2) }] };
+        logAudit({ ts: new Date().toISOString(), tool: "cancel_order", transport, args_summary: { order_id }, success: true });
+        return result;
     }
     catch (err) {
         const msg = err instanceof BudaApiError
-            ? { error: err.message, code: err.status, path: err.path }
+            ? { error: err.message, code: err.status }
             : { error: String(err), code: "UNKNOWN" };
-        return {
-            content: [{ type: "text", text: JSON.stringify(msg) }],
-            isError: true,
-        };
+        const result = { content: [{ type: "text", text: JSON.stringify(msg) }], isError: true };
+        logAudit({ ts: new Date().toISOString(), tool: "cancel_order", transport, args_summary: { order_id }, success: false, error_code: msg.code });
+        return result;
     }
 }
 export function register(server, client) {

package/dist/tools/cancel_order_by_client_id.d.ts

@@ -22,7 +22,7 @@ type CancelOrderByClientIdArgs = {
     client_id: string;
     confirmation_token: string;
 };
-export declare function handleCancelOrderByClientId(args: CancelOrderByClientIdArgs, client: BudaClient): Promise<{
+export declare function handleCancelOrderByClientId(args: CancelOrderByClientIdArgs, client: BudaClient, transport?: "http" | "stdio"): Promise<{
     content: Array<{
         type: "text";
         text: string;

package/dist/tools/cancel_order_by_client_id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cancel_order_by_client_id.d.ts","sourceRoot":"","sources":["../../src/tools/cancel_order_by_client_id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAIxD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;CAsBtB,CAAC;AAEF,KAAK,yBAAyB,GAAG;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAmCF,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,yBAAyB,EAC/B,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAwChF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAkBpE"}
+{"version":3,"file":"cancel_order_by_client_id.d.ts","sourceRoot":"","sources":["../../src/tools/cancel_order_by_client_id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAKxD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;CAsBtB,CAAC;AAEF,KAAK,yBAAyB,GAAG;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAmCF,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,yBAAyB,EAC/B,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAuChF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAkBpE"}

package/dist/tools/cancel_order_by_client_id.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { BudaApiError } from "../client.js";
 import { flattenAmount } from "../utils.js";
+import { logAudit } from "../audit.js";
 export const toolSchema = {
     name: "cancel_order_by_client_id",
     description: "Cancel an open order by its client-assigned ID on Buda.com. " +
@@ -53,7 +54,7 @@ function normalizeOrder(o) {
         paid_fee_currency: paidFee.currency,
     };
 }
-export async function handleCancelOrderByClientId(args, client) {
+export async function handleCancelOrderByClientId(args, client, transport = "stdio") {
     const { client_id, confirmation_token } = args;
     if (confirmation_token !== "CONFIRM") {
         return {
@@ -73,18 +74,17 @@ export async function handleCancelOrderByClientId(args, client) {
     }
     try {
         const data = await client.put(`/orders/by-client-id/${encodeURIComponent(client_id)}`, { order: { state: "canceling" } });
-        return {
-            content: [{ type: "text", text: JSON.stringify(normalizeOrder(data.order), null, 2) }],
-        };
+        const result = { content: [{ type: "text", text: JSON.stringify(normalizeOrder(data.order), null, 2) }] };
+        logAudit({ ts: new Date().toISOString(), tool: "cancel_order_by_client_id", transport, args_summary: {}, success: true });
+        return result;
     }
     catch (err) {
         const msg = err instanceof BudaApiError
-            ? { error: err.message, code: err.status, path: err.path }
+            ? { error: err.message, code: err.status }
             : { error: String(err), code: "UNKNOWN" };
-        return {
-            content: [{ type: "text", text: JSON.stringify(msg) }],
-            isError: true,
-        };
+        const result = { content: [{ type: "text", text: JSON.stringify(msg) }], isError: true };
+        logAudit({ ts: new Date().toISOString(), tool: "cancel_order_by_client_id", transport, args_summary: {}, success: false, error_code: msg.code });
+        return result;
     }
 }
 export function register(server, client) {

package/dist/tools/compare_markets.d.ts

@@ -15,5 +15,14 @@ export declare const toolSchema: {
         required: string[];
     };
 };
+export declare function handleCompareMarkets(args: {
+    base_currency: string;
+}, client: BudaClient, cache: MemoryCache): Promise<{
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    isError?: boolean;
+}>;
 export declare function register(server: McpServer, client: BudaClient, cache: MemoryCache): void;
 //# sourceMappingURL=compare_markets.d.ts.map

package/dist/tools/compare_markets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compare_markets.d.ts","sourceRoot":"","sources":["../../src/tools/compare_markets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,WAAW,EAAa,MAAM,aAAa,CAAC;AAGrD,eAAO,MAAM,UAAU;;;;;;;;;;;;;CAkBtB,CAAC;AAEF,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAyExF"}
+{"version":3,"file":"compare_markets.d.ts","sourceRoot":"","sources":["../../src/tools/compare_markets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,WAAW,EAAa,MAAM,aAAa,CAAC;AAIrD,eAAO,MAAM,UAAU;;;;;;;;;;;;;CAkBtB,CAAC;AAEF,wBAAsB,oBAAoB,CACxC,IAAI,EAAE;IAAE,aAAa,EAAE,MAAM,CAAA;CAAE,EAC/B,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAsEhF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAaxF"}