@guiie/buda-mcp 1.5.0 → 1.5.2

package/src/tools/compare_markets.ts

@@ -2,6 +2,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 import { BudaClient, BudaApiError } from "../client.js";
 import { MemoryCache, CACHE_TTL } from "../cache.js";
+import { validateCurrency } from "../validation.js";
 import type { AllTickersResponse } from "../types.js";
 
 export const toolSchema = {
@@ -24,6 +25,82 @@ export const toolSchema = {
   },
 };
 
+export async function handleCompareMarkets(
+  args: { base_currency: string },
+  client: BudaClient,
+  cache: MemoryCache,
+): Promise<{ content: Array<{ type: "text"; text: string }>; isError?: boolean }> {
+  const { base_currency } = args;
+
+  const currencyError = validateCurrency(base_currency);
+  if (currencyError) {
+    return {
+      content: [{ type: "text", text: JSON.stringify({ error: currencyError, code: "INVALID_CURRENCY" }) }],
+      isError: true,
+    };
+  }
+
+  try {
+    const base = base_currency.toUpperCase();
+    const data = await cache.getOrFetch<AllTickersResponse>(
+      "tickers:all",
+      CACHE_TTL.TICKER,
+      () => client.get<AllTickersResponse>("/tickers"),
+    );
+
+    const matching = data.tickers.filter((t) => {
+      const [tickerBase] = t.market_id.split("-");
+      return tickerBase === base;
+    });
+
+    if (matching.length === 0) {
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({
+              error: `No markets found for base currency '${base}'.`,
+              code: "NOT_FOUND",
+            }),
+          },
+        ],
+        isError: true,
+      };
+    }
+
+    const result = {
+      base_currency: base,
+      markets: matching.map((t) => ({
+        market_id: t.market_id,
+        last_price: parseFloat(t.last_price[0]),
+        last_price_currency: t.last_price[1],
+        best_bid: t.max_bid ? parseFloat(t.max_bid[0]) : null,
+        best_ask: t.min_ask ? parseFloat(t.min_ask[0]) : null,
+        volume_24h: t.volume ? parseFloat(t.volume[0]) : null,
+        price_change_24h: t.price_variation_24h
+          ? parseFloat((parseFloat(t.price_variation_24h) * 100).toFixed(4))
+          : null,
+        price_change_7d: t.price_variation_7d
+          ? parseFloat((parseFloat(t.price_variation_7d) * 100).toFixed(4))
+          : null,
+      })),
+    };
+
+    return {
+      content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+    };
+  } catch (err) {
+    const msg =
+      err instanceof BudaApiError
+        ? { error: err.message, code: err.status }
+        : { error: String(err), code: "UNKNOWN" };
+    return {
+      content: [{ type: "text", text: JSON.stringify(msg) }],
+      isError: true,
+    };
+  }
+}
+
 export function register(server: McpServer, client: BudaClient, cache: MemoryCache): void {
   server.tool(
     toolSchema.name,
@@ -35,66 +112,6 @@ export function register(server: McpServer, client: BudaClient, cache: MemoryCac
           "Base currency to compare across all available markets (e.g. 'BTC', 'ETH', 'XRP').",
         ),
     },
-    async ({ base_currency }) => {
-      try {
-        const base = base_currency.toUpperCase();
-        const data = await cache.getOrFetch<AllTickersResponse>(
-          "tickers:all",
-          CACHE_TTL.TICKER,
-          () => client.get<AllTickersResponse>("/tickers"),
-        );
-
-        const matching = data.tickers.filter((t) => {
-          const [tickerBase] = t.market_id.split("-");
-          return tickerBase === base;
-        });
-
-        if (matching.length === 0) {
-          return {
-            content: [
-              {
-                type: "text",
-                text: JSON.stringify({
-                  error: `No markets found for base currency '${base}'.`,
-                  code: "NOT_FOUND",
-                }),
-              },
-            ],
-            isError: true,
-          };
-        }
-
-        const result = {
-          base_currency: base,
-          markets: matching.map((t) => ({
-            market_id: t.market_id,
-            last_price: parseFloat(t.last_price[0]),
-            last_price_currency: t.last_price[1],
-            best_bid: t.max_bid ? parseFloat(t.max_bid[0]) : null,
-            best_ask: t.min_ask ? parseFloat(t.min_ask[0]) : null,
-            volume_24h: t.volume ? parseFloat(t.volume[0]) : null,
-            price_change_24h: t.price_variation_24h
-              ? parseFloat((parseFloat(t.price_variation_24h) * 100).toFixed(4))
-              : null,
-            price_change_7d: t.price_variation_7d
-              ? parseFloat((parseFloat(t.price_variation_7d) * 100).toFixed(4))
-              : null,
-          })),
-        };
-
-        return {
-          content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
-        };
-      } catch (err) {
-        const msg =
-          err instanceof BudaApiError
-            ? { error: err.message, code: err.status, path: err.path }
-            : { error: String(err), code: "UNKNOWN" };
-        return {
-          content: [{ type: "text", text: JSON.stringify(msg) }],
-          isError: true,
-        };
-      }
-    },
+    (args) => handleCompareMarkets(args, client, cache),
   );
 }

package/src/tools/dead_mans_switch.ts

@@ -2,6 +2,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 import { BudaClient, BudaApiError } from "../client.js";
 import { validateMarketId } from "../validation.js";
+import { logAudit } from "../audit.js";
 import type { OrdersResponse, OrderResponse } from "../types.js";
 
 // ---- Module-level timer state (persists across HTTP requests / tool invocations) ----
@@ -23,7 +24,7 @@ async function cancelAllOrdersForMarket(marketId: string, client: BudaClient): P
     const orders = data.orders ?? [];
     await Promise.allSettled(
       orders.map((order) =>
-        client.put<OrderResponse>(`/orders/${order.id}`, { state: "canceling" }),
+        client.put<OrderResponse>(`/orders/${order.id}`, { order: { state: "canceling" } }),
       ),
     );
     timers.delete(marketId);
@@ -125,6 +126,7 @@ type ScheduleArgs = {
 export async function handleScheduleCancelAll(
   args: ScheduleArgs,
   client: BudaClient,
+  transport: "http" | "stdio" = "stdio",
 ): Promise<{ content: Array<{ type: "text"; text: string }>; isError?: boolean }> {
   const { market_id, ttl_seconds, confirmation_token } = args;
 
@@ -155,9 +157,25 @@ export async function handleScheduleCancelAll(
     };
   }
 
+  if (!Number.isInteger(ttl_seconds) || ttl_seconds < 10 || ttl_seconds > 300) {
+    return {
+      content: [
+        {
+          type: "text",
+          text: JSON.stringify({
+            error: "ttl_seconds must be an integer between 10 and 300.",
+            code: "VALIDATION_ERROR",
+          }),
+        },
+      ],
+      isError: true,
+    };
+  }
+
   const id = market_id.toLowerCase();
   const entry = armTimer(id, ttl_seconds, client);
 
+  logAudit({ ts: new Date().toISOString(), tool: "schedule_cancel_all", transport, args_summary: { market_id: market_id.toUpperCase(), ttl_seconds }, success: true });
   return {
     content: [
       {
@@ -269,7 +287,11 @@ export function handleDisarmCancelTimer(
 
 // ---- Registration ----
 
-export function register(server: McpServer, client: BudaClient): void {
+export function register(
+  server: McpServer,
+  client: BudaClient,
+  transport: "stdio" | "http" = "stdio",
+): void {
   server.tool(
     toolSchema.name,
     toolSchema.description,
@@ -287,7 +309,24 @@ export function register(server: McpServer, client: BudaClient): void {
         .string()
         .describe("Must equal exactly 'CONFIRM' (case-sensitive) to arm the switch."),
     },
-    (args) => handleScheduleCancelAll(args, client),
+    (args) => {
+      if (transport === "http") {
+        return Promise.resolve({
+          content: [{
+            type: "text" as const,
+            text: JSON.stringify({
+              error:
+                "schedule_cancel_all is not available on the HTTP transport. " +
+                "Timer state is lost on every server restart or deploy. " +
+                "Run buda-mcp in stdio mode on a persistent local process to use this feature.",
+              code: "TRANSPORT_NOT_SUPPORTED",
+            }),
+          }],
+          isError: true,
+        });
+      }
+      return handleScheduleCancelAll(args, client);
+    },
   );
 
   server.tool(
@@ -298,7 +337,23 @@ export function register(server: McpServer, client: BudaClient): void {
         .string()
         .describe("Market ID whose timer should be renewed (e.g. 'BTC-CLP')."),
     },
-    (args) => handleRenewCancelTimer(args, client),
+    (args) => {
+      if (transport === "http") {
+        return Promise.resolve({
+          content: [{
+            type: "text" as const,
+            text: JSON.stringify({
+              error:
+                "renew_cancel_timer is not available on the HTTP transport. " +
+                "Timer state is process-local and only meaningful in stdio mode on a persistent local process.",
+              code: "TRANSPORT_NOT_SUPPORTED",
+            }),
+          }],
+          isError: true,
+        });
+      }
+      return Promise.resolve(handleRenewCancelTimer(args, client));
+    },
   );
 
   server.tool(
@@ -309,6 +364,22 @@ export function register(server: McpServer, client: BudaClient): void {
         .string()
         .describe("Market ID whose timer should be disarmed (e.g. 'BTC-CLP')."),
     },
-    (args) => handleDisarmCancelTimer(args),
+    (args) => {
+      if (transport === "http") {
+        return Promise.resolve({
+          content: [{
+            type: "text" as const,
+            text: JSON.stringify({
+              error:
+                "disarm_cancel_timer is not available on the HTTP transport. " +
+                "Timer state is process-local and only meaningful in stdio mode on a persistent local process.",
+              code: "TRANSPORT_NOT_SUPPORTED",
+            }),
+          }],
+          isError: true,
+        });
+      }
+      return Promise.resolve(handleDisarmCancelTimer(args));
+    },
   );
 }

package/src/tools/deposits.ts

@@ -104,7 +104,7 @@ export async function handleGetDepositHistory(
   } catch (err) {
     const msg =
       err instanceof BudaApiError
-        ? { error: err.message, code: err.status, path: err.path }
+        ? { error: err.message, code: err.status }
         : { error: String(err), code: "UNKNOWN" };
     return {
       content: [{ type: "text", text: JSON.stringify(msg) }],
@@ -189,7 +189,7 @@ export async function handleCreateFiatDeposit(
   } catch (err) {
     const msg =
       err instanceof BudaApiError
-        ? { error: err.message, code: err.status, path: err.path }
+        ? { error: err.message, code: err.status }
         : { error: String(err), code: "UNKNOWN" };
     return {
       content: [{ type: "text", text: JSON.stringify(msg) }],

package/src/tools/fees.ts

@@ -69,7 +69,7 @@ export async function handleGetNetworkFees(
   } catch (err) {
     const msg =
       err instanceof BudaApiError
-        ? { error: err.message, code: err.status, path: err.path }
+        ? { error: err.message, code: err.status }
         : { error: String(err), code: "UNKNOWN" };
     return {
       content: [{ type: "text", text: JSON.stringify(msg) }],

package/src/tools/lightning.ts

@@ -2,6 +2,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 import { BudaClient, BudaApiError } from "../client.js";
 import { flattenAmount } from "../utils.js";
+import { logAudit } from "../audit.js";
 import type { LightningWithdrawalResponse, LightningInvoiceResponse } from "../types.js";
 
 export const lightningWithdrawalToolSchema = {
@@ -69,6 +70,7 @@ type CreateLightningInvoiceArgs = {
 export async function handleLightningWithdrawal(
   args: LightningWithdrawalArgs,
   client: BudaClient,
+  transport: "http" | "stdio" = "stdio",
 ): Promise<{ content: Array<{ type: "text"; text: string }>; isError?: boolean }> {
   const { invoice, confirmation_token } = args;
 
@@ -91,6 +93,22 @@ export async function handleLightningWithdrawal(
     };
   }
 
+  const BOLT11_RE = /^ln(bc|tb|bcrt)\d*[munp]?1[a-z0-9]{20,}$/i;
+  if (!BOLT11_RE.test(invoice)) {
+    return {
+      content: [{
+        type: "text",
+        text: JSON.stringify({
+          error:
+            "Invalid Lightning invoice format. " +
+            "Expected a BOLT-11 string starting with 'lnbc', 'lntb', or 'lnbcrt'.",
+          code: "INVALID_INVOICE",
+        }),
+      }],
+      isError: true,
+    };
+  }
+
   try {
     const data = await client.post<LightningWithdrawalResponse>(
       `/reserves/ln-btc/withdrawals`,
@@ -101,10 +119,10 @@ export async function handleLightningWithdrawal(
     const amount = flattenAmount(lw.amount);
     const fee = flattenAmount(lw.fee);
 
-    return {
+    const result = {
       content: [
         {
-          type: "text",
+          type: "text" as const,
           text: JSON.stringify(
             {
               id: lw.id,
@@ -122,15 +140,16 @@ export async function handleLightningWithdrawal(
         },
       ],
     };
+    logAudit({ ts: new Date().toISOString(), tool: "lightning_withdrawal", transport, args_summary: {}, success: true });
+    return result;
   } catch (err) {
     const msg =
       err instanceof BudaApiError
-        ? { error: err.message, code: err.status, path: err.path }
+        ? { error: err.message, code: err.status }
         : { error: String(err), code: "UNKNOWN" };
-    return {
-      content: [{ type: "text", text: JSON.stringify(msg) }],
-      isError: true,
-    };
+    const result = { content: [{ type: "text" as const, text: JSON.stringify(msg) }], isError: true as const };
+    logAudit({ ts: new Date().toISOString(), tool: "lightning_withdrawal", transport, args_summary: {}, success: false, error_code: msg.code });
+    return result;
   }
 }
 
@@ -176,7 +195,7 @@ export async function handleCreateLightningInvoice(
   } catch (err) {
     const msg =
       err instanceof BudaApiError
-        ? { error: err.message, code: err.status, path: err.path }
+        ? { error: err.message, code: err.status }
         : { error: String(err), code: "UNKNOWN" };
     return {
       content: [{ type: "text", text: JSON.stringify(msg) }],
@@ -192,7 +211,7 @@ export function register(server: McpServer, client: BudaClient): void {
     {
       invoice: z
         .string()
-        .min(1)
+        .min(50)
         .describe("BOLT-11 Lightning invoice string (starts with 'lnbc', 'lntb', etc.)."),
       confirmation_token: z
         .string()

package/src/tools/market_sentiment.ts

@@ -118,7 +118,7 @@ export async function handleMarketSentiment(
   } catch (err) {
     const msg =
       err instanceof BudaApiError
-        ? { error: err.message, code: err.status, path: err.path }
+        ? { error: err.message, code: err.status }
         : { error: String(err), code: "UNKNOWN" };
     return {
       content: [{ type: "text", text: JSON.stringify(msg) }],

package/src/tools/market_summary.ts

@@ -101,7 +101,7 @@ export async function handleMarketSummary(
   } catch (err) {
     const msg =
       err instanceof BudaApiError
-        ? { error: err.message, code: err.status, path: err.path }
+        ? { error: err.message, code: err.status }
         : { error: String(err), code: "UNKNOWN" };
     return {
       content: [{ type: "text", text: JSON.stringify(msg) }],

package/src/tools/markets.ts

@@ -68,7 +68,7 @@ export function register(server: McpServer, client: BudaClient, cache: MemoryCac
       } catch (err) {
         const msg =
           err instanceof BudaApiError
-            ? { error: err.message, code: err.status, path: err.path }
+            ? { error: err.message, code: err.status }
             : { error: String(err), code: "UNKNOWN" };
         return {
           content: [{ type: "text", text: JSON.stringify(msg) }],

package/src/tools/order_lookup.ts

@@ -88,7 +88,7 @@ export async function handleGetOrder(
   } catch (err) {
     const msg =
       err instanceof BudaApiError
-        ? { error: err.message, code: err.status, path: err.path }
+        ? { error: err.message, code: err.status }
         : { error: String(err), code: "UNKNOWN" };
     return {
       content: [{ type: "text", text: JSON.stringify(msg) }],
@@ -109,7 +109,7 @@ export async function handleGetOrderByClientId(
   } catch (err) {
     const msg =
       err instanceof BudaApiError
-        ? { error: err.message, code: err.status, path: err.path }
+        ? { error: err.message, code: err.status }
         : { error: String(err), code: "UNKNOWN" };
     return {
       content: [{ type: "text", text: JSON.stringify(msg) }],

package/src/tools/orderbook.ts

@@ -83,7 +83,7 @@ export function register(server: McpServer, client: BudaClient, cache: MemoryCac
       } catch (err) {
         const msg =
           err instanceof BudaApiError
-            ? { error: err.message, code: err.status, path: err.path }
+            ? { error: err.message, code: err.status }
             : { error: String(err), code: "UNKNOWN" };
         return {
           content: [{ type: "text", text: JSON.stringify(msg) }],

package/src/tools/orders.ts

@@ -135,7 +135,7 @@ export function register(server: McpServer, client: BudaClient): void {
       } catch (err) {
         const msg =
           err instanceof BudaApiError
-            ? { error: err.message, code: err.status, path: err.path }
+            ? { error: err.message, code: err.status }
             : { error: String(err), code: "UNKNOWN" };
         return {
           content: [{ type: "text", text: JSON.stringify(msg) }],

package/src/tools/place_order.ts

@@ -2,6 +2,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 import { BudaClient, BudaApiError } from "../client.js";
 import { validateMarketId } from "../validation.js";
+import { logAudit } from "../audit.js";
 import type { OrderResponse } from "../types.js";
 
 export const toolSchema = {
@@ -91,6 +92,7 @@ type PlaceOrderArgs = {
 export async function handlePlaceOrder(
   args: PlaceOrderArgs,
   client: BudaClient,
+  transport: "http" | "stdio" = "stdio",
 ): Promise<{ content: Array<{ type: "text"; text: string }>; isError?: boolean }> {
   const {
     market_id,
@@ -191,6 +193,38 @@ export async function handlePlaceOrder(
         };
       }
 
+      if (gtd_timestamp !== undefined) {
+        const ts = new Date(gtd_timestamp).getTime();
+        if (isNaN(ts)) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify({
+                  error: "gtd_timestamp must be a valid ISO 8601 datetime string.",
+                  code: "VALIDATION_ERROR",
+                }),
+              },
+            ],
+            isError: true,
+          };
+        }
+        if (ts <= Date.now()) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify({
+                  error: "gtd_timestamp must be a future datetime.",
+                  code: "VALIDATION_ERROR",
+                }),
+              },
+            ],
+            isError: true,
+          };
+        }
+      }
+
       let limitType = "gtc";
       if (ioc) limitType = "ioc";
       else if (fok) limitType = "fok";
@@ -211,18 +245,35 @@ export async function handlePlaceOrder(
       payload,
     );
 
-    return {
-      content: [{ type: "text", text: JSON.stringify(data.order, null, 2) }],
+    const result = {
+      content: [{ type: "text" as const, text: JSON.stringify(data.order, null, 2) }],
     };
+    logAudit({
+      ts: new Date().toISOString(),
+      tool: "place_order",
+      transport,
+      args_summary: { market_id, type, price_type, amount },
+      success: true,
+    });
+    return result;
   } catch (err) {
     const msg =
       err instanceof BudaApiError
-        ? { error: err.message, code: err.status, path: err.path }
+        ? { error: err.message, code: err.status }
         : { error: String(err), code: "UNKNOWN" };
-    return {
-      content: [{ type: "text", text: JSON.stringify(msg) }],
+    const result = {
+      content: [{ type: "text" as const, text: JSON.stringify(msg) }],
       isError: true,
     };
+    logAudit({
+      ts: new Date().toISOString(),
+      tool: "place_order",
+      transport,
+      args_summary: { market_id, type, price_type, amount },
+      success: false,
+      error_code: msg.code,
+    });
+    return result;
   }
 }
 

package/src/tools/price_history.ts

@@ -108,7 +108,7 @@ export function register(server: McpServer, client: BudaClient, _cache: MemoryCa
       } catch (err) {
         const msg =
           err instanceof BudaApiError
-            ? { error: err.message, code: err.status, path: err.path }
+            ? { error: err.message, code: err.status }
             : { error: String(err), code: "UNKNOWN" };
         return {
           content: [{ type: "text", text: JSON.stringify(msg) }],

package/src/tools/quotation.ts

@@ -100,7 +100,7 @@ export async function handleGetRealQuotation(
   } catch (err) {
     const msg =
       err instanceof BudaApiError
-        ? { error: err.message, code: err.status, path: err.path }
+        ? { error: err.message, code: err.status }
         : { error: String(err), code: "UNKNOWN" };
     return {
       content: [{ type: "text", text: JSON.stringify(msg) }],