@guiie/buda-mcp 1.5.2 → 1.5.3

package/CHANGELOG.md

@@ -11,6 +11,32 @@ This project uses [Semantic Versioning](https://semver.org/).
 
 ---
 
+## [1.5.3] – 2026-04-11
+
+### Security
+
+- **Upstream API errors no longer forwarded to MCP clients** — `BudaClient.handleResponse` now logs the full Buda API error detail (status, path, message) to `process.stderr` as structured JSON and returns only a generic message to the MCP caller (e.g. `"Buda API error 404 on /path."`). Previously, raw upstream error messages including potential internal details were forwarded directly to clients.
+
+- **Audit log transport field corrected for HTTP** — nine destructive tool handlers (`place_order`, `cancel_order`, `cancel_all_orders`, `cancel_order_by_client_id`, `place_batch_orders`, `create_withdrawal`, `lightning_withdrawal`, `create_receive_address`, `quote_remittance`, `accept_remittance_quote`) now correctly log `transport: "http"` when invoked via the HTTP server. Previously their `register()` functions defaulted to `"stdio"`, making all HTTP audit events appear as stdio traffic.
+
+- **HTTP security headers via `helmet`** — Express HTTP server now applies `helmet()` as the first middleware, adding `X-Content-Type-Options`, `X-Frame-Options`, `Referrer-Policy`, `X-DNS-Prefetch-Control`, `X-Download-Options`, and removing `X-Powered-By`.
+
+- **Request body size limit** — `express.json()` now enforces an explicit `limit: "10kb"` on the `/mcp` endpoint, reducing the memory/CPU surface for oversized body attacks in combination with the existing rate limiter.
+
+- **Rate limiting extended to `/health` and `/.well-known/mcp/server-card.json`** — a `staticRateLimiter` (60 req/min) now protects these endpoints, which previously had no throttling. Sufficient for all legitimate uptime monitors and Smithery discovery.
+
+- **`trust proxy` topology documented** — added inline comment to `app.set("trust proxy", 1)` explaining the single-hop assumption (Railway), the impact on `req.ip` and `express-rate-limit` client IP detection, and the action required if an additional proxy layer is added.
+
+### Pending (manual)
+
+- **CI binary pinning** — `publish.yml` should pin `mcp-publisher` to a fixed version with SHA256 verification instead of downloading `releases/latest`. Target version: `v1.5.0`, SHA256: `79bbb73ba048c5906034f73ef6286d7763bd53cf368ea0b358fc593ed360cbd5`. See `PUBLISH_CHECKLIST.md` for the exact step.
+
+### Added
+
+- `helmet` dependency (v8.x) — HTTP security headers middleware.
+
+---
+
 ## [1.5.2] – 2026-04-11
 
 ### Security

package/PUBLISH_CHECKLIST.md

@@ -1,6 +1,6 @@
-# Publish Checklist — buda-mcp v1.5.2
+# Publish Checklist — buda-mcp v1.5.3
 
-Steps to publish `v1.5.2` to npm, the MCP registry, and notify community directories.
+Steps to publish `v1.5.3` to npm, the MCP registry, and notify community directories.
 
 ---
 
@@ -8,7 +8,7 @@ Steps to publish `v1.5.2` to npm, the MCP registry, and notify community directo
 
 ```bash
 # Confirm version
-node -e "console.log(require('./package.json').version)"  # should print 1.5.2
+node -e "console.log(require('./package.json').version)"  # should print 1.5.3
 
 # Build and test
 npm run build
@@ -37,9 +37,9 @@ Verify: https://www.npmjs.com/package/@guiie/buda-mcp
 
 ## 3. GitHub release
 
-Tag and release already created via `gh release create v1.5.2`. Verify at:
+Tag and release already created via `gh release create v1.5.3`. Verify at:
 
-https://github.com/gtorreal/buda-mcp/releases/tag/v1.5.2
+https://github.com/gtorreal/buda-mcp/releases/tag/v1.5.3
 
 ---
 
@@ -64,23 +64,18 @@ Verify: https://smithery.ai/server/@guiie/buda-mcp
 **Email/message template:**
 
 ```
-Subject: [Update] buda-mcp v1.5.2 — Security hardening (second pass)
+Subject: [Update] buda-mcp v1.5.3 — Security hardening (third pass)
 
 Hi mcp.so team,
 
-I've released v1.5.2 of buda-mcp (@guiie/buda-mcp on npm).
+I've released v1.5.3 of buda-mcp (@guiie/buda-mcp on npm).
 
 Key changes (security hardening, no new tools):
-- Constant-time token comparison (timing-safe Bearer token auth)
-- Strict environment variable validation (PORT, MCP_RATE_LIMIT) with safe exit on bad config
-- MCP_AUTH_TOKEN entropy warning (< 32 chars)
-- trust proxy support for correct client IP detection behind reverse proxies
-- Audit logging for all 11 destructive tool handlers (structured JSON to stderr)
-- Dead man's switch: renew/disarm also blocked on HTTP transport
-- validateCurrency() added to compare_markets tool
-- Stronger BOLT-11 regex validation in lightning_withdrawal
-- Internal API paths redacted from all error responses (31 tool handlers)
-- 28 new unit tests (total now 184)
+- Upstream API errors no longer forwarded to MCP clients (generic messages only, detail logged server-side)
+- Audit log transport field corrected for HTTP (9 handlers previously showed "stdio" for HTTP traffic)
+- HTTP security headers via helmet (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, etc.)
+- Request body size limit enforced (10kb) on /mcp endpoint
+- Rate limiting extended to /health and /.well-known/mcp/server-card.json endpoints
 
 Links:
 - npm: https://www.npmjs.com/package/@guiie/buda-mcp
@@ -99,24 +94,22 @@ Thank you!
 **Message template:**
 
 ```
-Subject: [Update] buda-mcp v1.5.2
+Subject: [Update] buda-mcp v1.5.3
 
 Hi Glama team,
 
-buda-mcp has been updated to v1.5.2.
+buda-mcp has been updated to v1.5.3.
 
 Package: @guiie/buda-mcp (npm)
 Registry: io.github.gtorreal/buda-mcp (MCP Registry)
-Version: 1.5.2
-
-Changes (security hardening, second pass):
-- Constant-time token comparison (timing-safe auth)
-- Strict env var validation (PORT, MCP_RATE_LIMIT)
-- Audit logging for all destructive handlers
-- Dead man's switch: renew/disarm also blocked on HTTP
-- validateCurrency() in compare_markets
-- Stronger BOLT-11 regex
-- Internal paths redacted from error responses
+Version: 1.5.3
+
+Changes (security hardening, third pass):
+- Upstream API errors no longer forwarded to MCP clients
+- Audit log transport field corrected for HTTP (9 handlers)
+- HTTP security headers via helmet
+- Request body size limit (10kb) on /mcp endpoint
+- Rate limiting on /health and server-card endpoints
 - 184 unit tests
 
 Quick start:
@@ -132,25 +125,45 @@ Thank you!
 
 ## 8. Post-publish verification
 
-- [ ] `npx @guiie/buda-mcp@1.5.2` starts successfully
-- [ ] `npm info @guiie/buda-mcp version` returns `1.5.2`
-- [ ] GitHub release tag `v1.5.2` is visible
-- [ ] MCP Registry entry reflects v1.5.2
+- [ ] `npx @guiie/buda-mcp@1.5.3` starts successfully
+- [ ] `npm info @guiie/buda-mcp version` returns `1.5.3`
+- [ ] GitHub release tag `v1.5.3` is visible
+- [ ] MCP Registry entry reflects v1.5.3
 - [ ] Smithery server card lists all tools
-- [ ] `GET /health` returns `"version":"1.5.2"` on Railway deployment
-- [ ] HTTP server exits if `BUDA_API_KEY` set but `MCP_AUTH_TOKEN` is absent
-- [ ] `create_withdrawal` rejects a truncated BTC address with `INVALID_ADDRESS`
-- [ ] `lightning_withdrawal` rejects a non-BOLT11 string with `INVALID_INVOICE`
-- [ ] `place_batch_orders` with `max_notional` rejects over-cap batch before API call
-- [ ] `schedule_cancel_all` via HTTP returns `TRANSPORT_NOT_SUPPORTED`
-- [ ] `renew_cancel_timer` via HTTP returns `TRANSPORT_NOT_SUPPORTED`
-- [ ] Error responses do NOT include internal `path` field
-- [ ] Audit events appear in stderr as JSON with `audit: true`
+- [ ] `GET /health` returns `"version":"1.5.3"` on Railway deployment
+- [ ] `GET /health` responds with `X-Content-Type-Options: nosniff` header (helmet active)
+- [ ] `GET /health` rate-limited at 60 req/min
+- [ ] Error responses from the MCP server show generic message (not raw Buda API detail)
+- [ ] Audit log shows `"transport":"http"` for HTTP-triggered destructive tools
+- [ ] Pending: manually apply CI binary pinning to `publish.yml` (see CHANGELOG v1.5.3)
 - [ ] mcp.so listing updated
 - [ ] Glama.ai listing updated
 
 ---
 
+---
+
+## 9. Pending manual fix — CI binary pinning
+
+Edit `.github/workflows/publish.yml`, replace the `Install mcp-publisher` step with:
+
+```yaml
+- name: Install mcp-publisher
+  env:
+    MCP_PUBLISHER_VERSION: "v1.5.0"
+    MCP_PUBLISHER_SHA256: "79bbb73ba048c5906034f73ef6286d7763bd53cf368ea0b358fc593ed360cbd5"
+  run: |
+    curl -fsSL "https://github.com/modelcontextprotocol/registry/releases/download/${MCP_PUBLISHER_VERSION}/mcp-publisher_linux_amd64.tar.gz" \
+      -o mcp-publisher.tar.gz
+    echo "${MCP_PUBLISHER_SHA256}  mcp-publisher.tar.gz" | sha256sum --check
+    tar xz -f mcp-publisher.tar.gz mcp-publisher
+    sudo mv mcp-publisher /usr/local/bin/
+```
+
+SHA256 verified against GitHub release `v1.5.0` on 2026-04-11. Update both values when bumping `mcp-publisher`.
+
+---
+
 ## ARCHIVED: previous checklists
 
 See git tags `v1.5.0`, `v1.5.1`, `v1.4.0`, `v1.4.1`, `v1.4.2` for previous release notes and verification steps.

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAKA,qBAAa,YAAa,SAAQ,KAAK;aAEnB,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM;aAEZ,YAAY,CAAC,EAAE,MAAM;gBAHrB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM,EACC,YAAY,CAAC,EAAE,MAAM,YAAA;CAKxC;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;gBAG7C,OAAO,GAAE,MAAiB,EAC1B,MAAM,CAAC,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM;IAOpB,OAAO,IAAI,OAAO;IAIlB,OAAO,CAAC,aAAa,CAAK;IAE1B,OAAO,CAAC,KAAK;IAIb,OAAO,CAAC,IAAI;IASZ,OAAO,CAAC,WAAW;IAWnB;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAOzB;;;;OAIG;YACW,cAAc;YA2Bd,cAAc;IActB,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAoB1E,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAmBnD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAmBlD,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAmBpF"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAKA,qBAAa,YAAa,SAAQ,KAAK;aAEnB,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM;aAEZ,YAAY,CAAC,EAAE,MAAM;gBAHrB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM,EACC,YAAY,CAAC,EAAE,MAAM,YAAA;CAKxC;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;gBAG7C,OAAO,GAAE,MAAiB,EAC1B,MAAM,CAAC,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM;IAOpB,OAAO,IAAI,OAAO;IAIlB,OAAO,CAAC,aAAa,CAAK;IAE1B,OAAO,CAAC,KAAK;IAIb,OAAO,CAAC,IAAI;IASZ,OAAO,CAAC,WAAW;IAWnB;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAOzB;;;;OAIG;YACW,cAAc;YA2Bd,cAAc;IAsBtB,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAoB1E,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAmBnD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAmBlD,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAmBpF"}

package/dist/client.js

@@ -90,7 +90,12 @@ export class BudaClient {
             catch {
                 // ignore parse error, use statusText
             }
-            throw new BudaApiError(response.status, path, `Buda API ${response.status}: ${detail}`);
+            // Log full upstream detail server-side only — never forward to MCP caller
+            process.stderr.write(JSON.stringify({ buda_api_error: true, status: response.status, path, detail }) + "\n");
+            const clientMsg = response.status === 429
+                ? `Rate limit exceeded on ${path}. Retry later.`
+                : `Buda API error ${response.status} on ${path}.`;
+            throw new BudaApiError(response.status, path, clientMsg);
         }
         return response.json();
     }

package/dist/http.js

@@ -1,4 +1,5 @@
 import express from "express";
+import helmet from "helmet";
 import rateLimit from "express-rate-limit";
 import { McpServer, ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
@@ -127,22 +128,22 @@ function createServer() {
     if (authEnabled) {
         balances.register(server, client);
         orders.register(server, client);
-        placeOrder.register(server, client);
-        cancelOrder.register(server, client);
+        placeOrder.register(server, client, "http");
+        cancelOrder.register(server, client, "http");
         deadMansSwitch.register(server, client, "http");
         account.register(server, client);
         balance.register(server, client);
         orderLookup.register(server, client);
         networkFees.register(server, client);
         deposits.register(server, client);
-        withdrawals.register(server, client);
-        receiveAddresses.register(server, client);
-        remittances.register(server, client);
+        withdrawals.register(server, client, "http");
+        receiveAddresses.register(server, client, "http");
+        remittances.register(server, client, "http");
         remittanceRecipients.register(server, client);
-        cancelAllOrders.register(server, client);
-        cancelOrderByClientId.register(server, client);
-        batchOrders.register(server, client);
-        lightning.register(server, client);
+        cancelAllOrders.register(server, client, "http");
+        cancelOrderByClientId.register(server, client, "http");
+        batchOrders.register(server, client, "http");
+        lightning.register(server, client, "http");
     }
     // MCP Resources
     server.resource("buda-markets", "buda://markets", async (uri) => {
@@ -195,10 +196,12 @@ function createServer() {
     return server;
 }
 const app = express();
-// Required for correct client IP detection behind Railway's reverse proxy.
-// Without this, express-rate-limit sees the proxy IP instead of the real client.
+app.use(helmet());
+// trust proxy: 1 = trust exactly one hop (Railway's reverse proxy).
+// If Cloudflare or another proxy is added in front, increment this value.
+// Affects: req.ip and express-rate-limit client IP detection.
 app.set("trust proxy", 1);
-app.use(express.json());
+app.use(express.json({ limit: "10kb" }));
 const MCP_AUTH_TOKEN = process.env.MCP_AUTH_TOKEN;
 if (authEnabled && !MCP_AUTH_TOKEN) {
     console.error("[buda-mcp] FATAL: BUDA_API_KEY/BUDA_API_SECRET are set but MCP_AUTH_TOKEN is not.\n" +
@@ -224,6 +227,13 @@ const mcpRateLimiter = rateLimit({
     legacyHeaders: false,
     message: { error: "Too many requests. Retry after 60 seconds.", code: "RATE_LIMITED" },
 });
+const staticRateLimiter = rateLimit({
+    windowMs: 60_000,
+    max: 60,
+    standardHeaders: true,
+    legacyHeaders: false,
+    message: { error: "Too many requests.", code: "RATE_LIMITED" },
+});
 function mcpAuthMiddleware(req, res, next) {
     if (!MCP_AUTH_TOKEN) {
         next();
@@ -237,7 +247,7 @@ function mcpAuthMiddleware(req, res, next) {
     next();
 }
 // Health check for Railway / uptime monitors
-app.get("/health", (_req, res) => {
+app.get("/health", staticRateLimiter, (_req, res) => {
     res.json({
         status: "ok",
         server: "buda-mcp",
@@ -247,7 +257,7 @@ app.get("/health", (_req, res) => {
 });
 // Smithery static server card — assembled programmatically from tool definitions.
 // Adding a new tool only requires exporting its toolSchema; this handler needs no changes.
-app.get("/.well-known/mcp/server-card.json", (_req, res) => {
+app.get("/.well-known/mcp/server-card.json", staticRateLimiter, (_req, res) => {
     res.json({
         serverInfo: { name: "buda-mcp", version: VERSION },
         authentication: { required: authEnabled },

package/dist/tools/batch_orders.d.ts

@@ -77,6 +77,6 @@ export declare function handlePlaceBatchOrders(args: BatchOrdersArgs, client: Bu
     }>;
     isError?: boolean;
 }>;
-export declare function register(server: McpServer, client: BudaClient): void;
+export declare function register(server: McpServer, client: BudaClient, transport?: "http" | "stdio"): void;
 export {};
 //# sourceMappingURL=batch_orders.d.ts.map

package/dist/tools/batch_orders.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"batch_orders.d.ts","sourceRoot":"","sources":["../../src/tools/batch_orders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAKxD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0CtB,CAAC;AAEF,QAAA,MAAM,UAAU;;;;;;;;;;;;iBAMd,CAAC;AAEH,KAAK,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAWnD,KAAK,eAAe,GAAG;IACrB,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA2IhF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CA2BpE"}
+{"version":3,"file":"batch_orders.d.ts","sourceRoot":"","sources":["../../src/tools/batch_orders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAKxD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0CtB,CAAC;AAEF,QAAA,MAAM,UAAU;;;;;;;;;;;;iBAMd,CAAC;AAEH,KAAK,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAWnD,KAAK,eAAe,GAAG;IACrB,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA2IhF;AAED,wBAAgB,QAAQ,CACtB,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,IAAI,CA2BN"}

package/dist/tools/batch_orders.js

@@ -176,7 +176,7 @@ export async function handlePlaceBatchOrders(args, client, transport = "stdio")
         isError,
     };
 }
-export function register(server, client) {
+export function register(server, client, transport = "stdio") {
     server.tool(toolSchema.name, toolSchema.description, {
         orders: z
             .array(orderShape)
@@ -193,6 +193,6 @@ export function register(server, client) {
         confirmation_token: z
             .string()
             .describe("Safety confirmation. Must equal exactly 'CONFIRM' (case-sensitive) to execute."),
-    }, (args) => handlePlaceBatchOrders(args, client));
+    }, (args) => handlePlaceBatchOrders(args, client, transport));
 }
 //# sourceMappingURL=batch_orders.js.map

package/dist/tools/cancel_all_orders.d.ts

@@ -29,6 +29,6 @@ export declare function handleCancelAllOrders(args: CancelAllOrdersArgs, client:
     }>;
     isError?: boolean;
 }>;
-export declare function register(server: McpServer, client: BudaClient): void;
+export declare function register(server: McpServer, client: BudaClient, transport?: "http" | "stdio"): void;
 export {};
 //# sourceMappingURL=cancel_all_orders.d.ts.map

package/dist/tools/cancel_all_orders.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cancel_all_orders.d.ts","sourceRoot":"","sources":["../../src/tools/cancel_all_orders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAKxD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;CAuBtB,CAAC;AAEF,KAAK,mBAAmB,GAAG;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAqDhF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAkBpE"}
+{"version":3,"file":"cancel_all_orders.d.ts","sourceRoot":"","sources":["../../src/tools/cancel_all_orders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAKxD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;CAuBtB,CAAC;AAEF,KAAK,mBAAmB,GAAG;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAqDhF;AAED,wBAAgB,QAAQ,CACtB,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,IAAI,CAkBN"}

package/dist/tools/cancel_all_orders.js

@@ -71,7 +71,7 @@ export async function handleCancelAllOrders(args, client, transport = "stdio") {
         return result;
     }
 }
-export function register(server, client) {
+export function register(server, client, transport = "stdio") {
     server.tool(toolSchema.name, toolSchema.description, {
         market_id: z
             .string()
@@ -81,6 +81,6 @@ export function register(server, client) {
             .string()
             .describe("Safety confirmation. Must equal exactly 'CONFIRM' (case-sensitive) to execute. " +
             "Any other value will reject the request without canceling."),
-    }, (args) => handleCancelAllOrders(args, client));
+    }, (args) => handleCancelAllOrders(args, client, transport));
 }
 //# sourceMappingURL=cancel_all_orders.js.map

package/dist/tools/cancel_order.d.ts

@@ -29,6 +29,6 @@ export declare function handleCancelOrder(args: CancelOrderArgs, client: BudaCli
     }>;
     isError?: boolean;
 }>;
-export declare function register(server: McpServer, client: BudaClient): void;
+export declare function register(server: McpServer, client: BudaClient, transport?: "http" | "stdio"): void;
 export {};
 //# sourceMappingURL=cancel_order.d.ts.map

package/dist/tools/cancel_order.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cancel_order.d.ts","sourceRoot":"","sources":["../../src/tools/cancel_order.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAIxD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;CAuBtB,CAAC;AAEF,KAAK,eAAe,GAAG;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAsChF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAmBpE"}
+{"version":3,"file":"cancel_order.d.ts","sourceRoot":"","sources":["../../src/tools/cancel_order.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAIxD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;CAuBtB,CAAC;AAEF,KAAK,eAAe,GAAG;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAsChF;AAED,wBAAgB,QAAQ,CACtB,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,IAAI,CAmBN"}

package/dist/tools/cancel_order.js

@@ -58,7 +58,7 @@ export async function handleCancelOrder(args, client, transport = "stdio") {
         return result;
     }
 }
-export function register(server, client) {
+export function register(server, client, transport = "stdio") {
     server.tool(toolSchema.name, toolSchema.description, {
         order_id: z
             .number()
@@ -69,6 +69,6 @@ export function register(server, client) {
             .string()
             .describe("Safety confirmation. Must equal exactly 'CONFIRM' (case-sensitive) to cancel the order. " +
             "Any other value will reject the request without canceling."),
-    }, (args) => handleCancelOrder(args, client));
+    }, (args) => handleCancelOrder(args, client, transport));
 }
 //# sourceMappingURL=cancel_order.js.map

package/dist/tools/cancel_order_by_client_id.d.ts

@@ -29,6 +29,6 @@ export declare function handleCancelOrderByClientId(args: CancelOrderByClientIdA
     }>;
     isError?: boolean;
 }>;
-export declare function register(server: McpServer, client: BudaClient): void;
+export declare function register(server: McpServer, client: BudaClient, transport?: "http" | "stdio"): void;
 export {};
 //# sourceMappingURL=cancel_order_by_client_id.d.ts.map

package/dist/tools/cancel_order_by_client_id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cancel_order_by_client_id.d.ts","sourceRoot":"","sources":["../../src/tools/cancel_order_by_client_id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAKxD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;CAsBtB,CAAC;AAEF,KAAK,yBAAyB,GAAG;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAmCF,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,yBAAyB,EAC/B,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAuChF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAkBpE"}
+{"version":3,"file":"cancel_order_by_client_id.d.ts","sourceRoot":"","sources":["../../src/tools/cancel_order_by_client_id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAKxD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;CAsBtB,CAAC;AAEF,KAAK,yBAAyB,GAAG;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAmCF,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,yBAAyB,EAC/B,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAuChF;AAED,wBAAgB,QAAQ,CACtB,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,IAAI,CAkBN"}

package/dist/tools/cancel_order_by_client_id.js

@@ -87,7 +87,7 @@ export async function handleCancelOrderByClientId(args, client, transport = "std
         return result;
     }
 }
-export function register(server, client) {
+export function register(server, client, transport = "stdio") {
     server.tool(toolSchema.name, toolSchema.description, {
         client_id: z
             .string()
@@ -97,6 +97,6 @@ export function register(server, client) {
             .string()
             .describe("Safety confirmation. Must equal exactly 'CONFIRM' (case-sensitive) to execute. " +
             "Any other value will reject the request without canceling."),
-    }, (args) => handleCancelOrderByClientId(args, client));
+    }, (args) => handleCancelOrderByClientId(args, client, transport));
 }
 //# sourceMappingURL=cancel_order_by_client_id.js.map

package/dist/tools/lightning.d.ts

@@ -63,6 +63,6 @@ export declare function handleCreateLightningInvoice(args: CreateLightningInvoic
     }>;
     isError?: boolean;
 }>;
-export declare function register(server: McpServer, client: BudaClient): void;
+export declare function register(server: McpServer, client: BudaClient, transport?: "http" | "stdio"): void;
 export {};
 //# sourceMappingURL=lightning.d.ts.map

package/dist/tools/lightning.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lightning.d.ts","sourceRoot":"","sources":["../../src/tools/lightning.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAKxD,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;CAuBzC,CAAC;AAEF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;CAwB5C,CAAC;AAEF,KAAK,uBAAuB,GAAG;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,KAAK,0BAA0B,GAAG;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,uBAAuB,EAC7B,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAgFhF;AAED,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,0BAA0B,EAChC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA8ChF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CA2CpE"}
+{"version":3,"file":"lightning.d.ts","sourceRoot":"","sources":["../../src/tools/lightning.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAKxD,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;CAuBzC,CAAC;AAEF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;CAwB5C,CAAC;AAEF,KAAK,uBAAuB,GAAG;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,KAAK,0BAA0B,GAAG;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,uBAAuB,EAC7B,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAgFhF;AAED,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,0BAA0B,EAChC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA8ChF;AAED,wBAAgB,QAAQ,CACtB,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,IAAI,CA2CN"}

package/dist/tools/lightning.js

@@ -153,7 +153,7 @@ export async function handleCreateLightningInvoice(args, client) {
         };
     }
 }
-export function register(server, client) {
+export function register(server, client, transport = "stdio") {
     server.tool(lightningWithdrawalToolSchema.name, lightningWithdrawalToolSchema.description, {
         invoice: z
             .string()
@@ -163,7 +163,7 @@ export function register(server, client) {
             .string()
             .describe("Safety confirmation. Must equal exactly 'CONFIRM' (case-sensitive) to execute. " +
             "Any other value will reject the request without paying."),
-    }, (args) => handleLightningWithdrawal(args, client));
+    }, (args) => handleLightningWithdrawal(args, client, transport));
     server.tool(createLightningInvoiceToolSchema.name, createLightningInvoiceToolSchema.description, {
         amount_satoshis: z
             .number()

package/dist/tools/place_order.d.ts

@@ -79,6 +79,6 @@ export declare function handlePlaceOrder(args: PlaceOrderArgs, client: BudaClien
     }>;
     isError?: boolean;
 }>;
-export declare function register(server: McpServer, client: BudaClient): void;
+export declare function register(server: McpServer, client: BudaClient, transport?: "http" | "stdio"): void;
 export {};
 //# sourceMappingURL=place_order.d.ts.map

package/dist/tools/place_order.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"place_order.d.ts","sourceRoot":"","sources":["../../src/tools/place_order.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAKxD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmEtB,CAAC;AAEF,KAAK,cAAc,GAAG;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,KAAK,GAAG,KAAK,CAAC;IACpB,UAAU,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAsLhF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CA4DpE"}
+{"version":3,"file":"place_order.d.ts","sourceRoot":"","sources":["../../src/tools/place_order.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAKxD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmEtB,CAAC;AAEF,KAAK,cAAc,GAAG;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,KAAK,GAAG,KAAK,CAAC;IACpB,UAAU,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAsLhF;AAED,wBAAgB,QAAQ,CACtB,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,IAAI,CA4DN"}

package/dist/tools/place_order.js

@@ -226,7 +226,7 @@ export async function handlePlaceOrder(args, client, transport = "stdio") {
         return result;
     }
 }
-export function register(server, client) {
+export function register(server, client, transport = "stdio") {
     server.tool(toolSchema.name, toolSchema.description, {
         market_id: z
             .string()
@@ -276,6 +276,6 @@ export function register(server, client) {
             .string()
             .describe("Safety confirmation. Must equal exactly 'CONFIRM' (case-sensitive) to execute the order. " +
             "Any other value will reject the request without placing an order."),
-    }, (args) => handlePlaceOrder(args, client));
+    }, (args) => handlePlaceOrder(args, client, transport));
 }
 //# sourceMappingURL=place_order.js.map

package/dist/tools/receive_addresses.d.ts

@@ -79,5 +79,5 @@ export declare function handleCreateReceiveAddress(args: {
     }>;
     isError?: boolean;
 }>;
-export declare function register(server: McpServer, client: BudaClient): void;
+export declare function register(server: McpServer, client: BudaClient, transport?: "http" | "stdio"): void;
 //# sourceMappingURL=receive_addresses.d.ts.map

package/dist/tools/receive_addresses.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"receive_addresses.d.ts","sourceRoot":"","sources":["../../src/tools/receive_addresses.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAKxD,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;CAwB1C,CAAC;AAEF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;CAiB1C,CAAC;AAEF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;CAoBvC,CAAC;AAYF,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,EAC1B,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAqChF;AAED,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,EACtC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA4BhF;AAED,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,EACtD,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA8ChF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CA+BpE"}
+{"version":3,"file":"receive_addresses.d.ts","sourceRoot":"","sources":["../../src/tools/receive_addresses.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAKxD,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;CAwB1C,CAAC;AAEF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;CAiB1C,CAAC;AAEF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;CAoBvC,CAAC;AAYF,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,EAC1B,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAqChF;AAED,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,EACtC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA4BhF;AAED,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,EACtD,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA8ChF;AAED,wBAAgB,QAAQ,CACtB,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,IAAI,CA+BN"}

package/dist/tools/receive_addresses.js

@@ -167,7 +167,7 @@ export async function handleCreateReceiveAddress(args, client, transport = "stdi
         return result;
     }
 }
-export function register(server, client) {
+export function register(server, client, transport = "stdio") {
     server.tool(listReceiveAddressesToolSchema.name, listReceiveAddressesToolSchema.description, {
         currency: z.string().min(2).max(10).describe("Currency code (e.g. 'BTC', 'ETH')."),
     }, (args) => handleListReceiveAddresses(args, client));
@@ -180,6 +180,6 @@ export function register(server, client) {
         confirmation_token: z
             .string()
             .describe("Safety confirmation. Must equal exactly 'CONFIRM' (case-sensitive) to generate a new address."),
-    }, (args) => handleCreateReceiveAddress(args, client));
+    }, (args) => handleCreateReceiveAddress(args, client, transport));
 }
 //# sourceMappingURL=receive_addresses.js.map

package/dist/tools/remittances.d.ts

@@ -116,5 +116,5 @@ export declare function handleAcceptRemittanceQuote(args: {
     }>;
     isError?: boolean;
 }>;
-export declare function register(server: McpServer, client: BudaClient): void;
+export declare function register(server: McpServer, client: BudaClient, transport?: "http" | "stdio"): void;
 //# sourceMappingURL=remittances.d.ts.map

package/dist/tools/remittances.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remittances.d.ts","sourceRoot":"","sources":["../../src/tools/remittances.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAMxD,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;CAoBrC,CAAC;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;CAiCrC,CAAC;AAEF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;CAuB3C,CAAC;AAEF,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;CAiBnC,CAAC;AAgBF,wBAAsB,qBAAqB,CACzC,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EACrC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAoChF;AAED,wBAAsB,mBAAmB,CACvC,IAAI,EAAE;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EACpB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAgBhF;AAED,wBAAsB,qBAAqB,CACzC,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,EAC5F,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAiDhF;AAED,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,EAChD,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAoChF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CA2CpE"}
+{"version":3,"file":"remittances.d.ts","sourceRoot":"","sources":["../../src/tools/remittances.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAMxD,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;CAoBrC,CAAC;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;CAiCrC,CAAC;AAEF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;CAuB3C,CAAC;AAEF,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;CAiBnC,CAAC;AAgBF,wBAAsB,qBAAqB,CACzC,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EACrC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAoChF;AAED,wBAAsB,mBAAmB,CACvC,IAAI,EAAE;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EACpB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAgBhF;AAED,wBAAsB,qBAAqB,CACzC,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,EAC5F,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAiDhF;AAED,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,EAChD,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAoChF;AAED,wBAAgB,QAAQ,CACtB,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,IAAI,CA2CN"}

package/dist/tools/remittances.js

@@ -236,7 +236,7 @@ export async function handleAcceptRemittanceQuote(args, client, transport = "std
         return result;
     }
 }
-export function register(server, client) {
+export function register(server, client, transport = "stdio") {
     server.tool(listRemittancesToolSchema.name, listRemittancesToolSchema.description, {
         per: z.number().int().min(1).max(300).optional().describe("Results per page (default: 20, max: 300)."),
         page: z.number().int().min(1).optional().describe("Page number (default: 1)."),
@@ -251,10 +251,10 @@ export function register(server, client) {
         confirmation_token: z
             .string()
             .describe("Safety confirmation. Must equal exactly 'CONFIRM' (case-sensitive) to create the quote."),
-    }, (args) => handleQuoteRemittance(args, client));
+    }, (args) => handleQuoteRemittance(args, client, transport));
     server.tool(acceptRemittanceQuoteToolSchema.name, acceptRemittanceQuoteToolSchema.description, {
         id: z.number().int().positive().describe("The numeric ID of the remittance quote to accept."),
         confirmation_token: z.string().describe("Must be 'CONFIRM' to proceed. Any other value aborts."),
-    }, (args) => handleAcceptRemittanceQuote(args, client));
+    }, (args) => handleAcceptRemittanceQuote(args, client, transport));
 }
 //# sourceMappingURL=remittances.js.map

package/dist/tools/withdrawals.d.ts

@@ -88,6 +88,6 @@ export declare function handleCreateWithdrawal(args: CreateWithdrawalArgs, clien
     }>;
     isError?: boolean;
 }>;
-export declare function register(server: McpServer, client: BudaClient): void;
+export declare function register(server: McpServer, client: BudaClient, transport?: "http" | "stdio"): void;
 export {};
 //# sourceMappingURL=withdrawals.d.ts.map

package/dist/tools/withdrawals.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"withdrawals.d.ts","sourceRoot":"","sources":["../../src/tools/withdrawals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAMxD,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;CA8B1C,CAAC;AAEF,KAAK,wBAAwB,GAAG;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,mBAAmB,GAAG,SAAS,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,CAAC;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAqBF,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,wBAAwB,EAC9B,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA+ChF;AAED,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuBtC,CAAC;AAEF,KAAK,oBAAoB,GAAG;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,oBAAoB,EAC1B,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAkGhF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CA+BpE"}
+{"version":3,"file":"withdrawals.d.ts","sourceRoot":"","sources":["../../src/tools/withdrawals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAMxD,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;CA8B1C,CAAC;AAEF,KAAK,wBAAwB,GAAG;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,mBAAmB,GAAG,SAAS,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,CAAC;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAqBF,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,wBAAwB,EAC9B,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA+ChF;AAED,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuBtC,CAAC;AAEF,KAAK,oBAAoB,GAAG;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,oBAAoB,EAC1B,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAkGhF;AAED,wBAAgB,QAAQ,CACtB,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,IAAI,CA+BN"}

package/dist/tools/withdrawals.js

@@ -201,7 +201,7 @@ export async function handleCreateWithdrawal(args, client, transport = "stdio")
         return result;
     }
 }
-export function register(server, client) {
+export function register(server, client, transport = "stdio") {
     server.tool(getWithdrawalHistoryToolSchema.name, getWithdrawalHistoryToolSchema.description, {
         currency: z.string().min(2).max(10).describe("Currency code (e.g. 'BTC', 'CLP')."),
         state: z
@@ -220,6 +220,6 @@ export function register(server, client) {
         confirmation_token: z
             .string()
             .describe("Safety confirmation. Must equal exactly 'CONFIRM' (case-sensitive) to execute."),
-    }, (args) => handleCreateWithdrawal(args, client));
+    }, (args) => handleCreateWithdrawal(args, client, transport));
 }
 //# sourceMappingURL=withdrawals.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guiie/buda-mcp",
-  "version": "1.5.2",
+  "version": "1.5.3",
   "mcpName": "io.github.gtorreal/buda-mcp",
   "description": "MCP server for Buda.com's public cryptocurrency exchange API (Chile, Colombia, Peru)",
   "type": "module",
@@ -50,6 +50,7 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "express": "^5.2.1",
     "express-rate-limit": "^8.3.2",
+    "helmet": "^8.1.0",
     "zod": "^4.3.6"
   },
   "devDependencies": {

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/gtorreal/buda-mcp",
     "source": "github"
   },
-  "version": "1.5.2",
+  "version": "1.5.3",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@guiie/buda-mcp",
-      "version": "1.5.2",
+      "version": "1.5.3",
       "transport": {
         "type": "stdio"
       }

package/src/client.ts

@@ -113,7 +113,15 @@ export class BudaClient {
       } catch {
         // ignore parse error, use statusText
       }
-      throw new BudaApiError(response.status, path, `Buda API ${response.status}: ${detail}`);
+      // Log full upstream detail server-side only — never forward to MCP caller
+      process.stderr.write(
+        JSON.stringify({ buda_api_error: true, status: response.status, path, detail }) + "\n",
+      );
+      const clientMsg =
+        response.status === 429
+          ? `Rate limit exceeded on ${path}. Retry later.`
+          : `Buda API error ${response.status} on ${path}.`;
+      throw new BudaApiError(response.status, path, clientMsg);
     }
     return response.json() as Promise<T>;
   }

package/src/http.ts

@@ -1,4 +1,5 @@
 import express from "express";
+import helmet from "helmet";
 import rateLimit from "express-rate-limit";
 import { McpServer, ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
@@ -140,22 +141,22 @@ function createServer(): McpServer {
   if (authEnabled) {
     balances.register(server, client);
     orders.register(server, client);
-    placeOrder.register(server, client);
-    cancelOrder.register(server, client);
+    placeOrder.register(server, client, "http");
+    cancelOrder.register(server, client, "http");
     deadMansSwitch.register(server, client, "http");
     account.register(server, client);
     balance.register(server, client);
     orderLookup.register(server, client);
     networkFees.register(server, client);
     deposits.register(server, client);
-    withdrawals.register(server, client);
-    receiveAddresses.register(server, client);
-    remittances.register(server, client);
+    withdrawals.register(server, client, "http");
+    receiveAddresses.register(server, client, "http");
+    remittances.register(server, client, "http");
     remittanceRecipients.register(server, client);
-    cancelAllOrders.register(server, client);
-    cancelOrderByClientId.register(server, client);
-    batchOrders.register(server, client);
-    lightning.register(server, client);
+    cancelAllOrders.register(server, client, "http");
+    cancelOrderByClientId.register(server, client, "http");
+    batchOrders.register(server, client, "http");
+    lightning.register(server, client, "http");
   }
 
   // MCP Resources
@@ -231,10 +232,12 @@ function createServer(): McpServer {
 }
 
 const app = express();
-// Required for correct client IP detection behind Railway's reverse proxy.
-// Without this, express-rate-limit sees the proxy IP instead of the real client.
+app.use(helmet());
+// trust proxy: 1 = trust exactly one hop (Railway's reverse proxy).
+// If Cloudflare or another proxy is added in front, increment this value.
+// Affects: req.ip and express-rate-limit client IP detection.
 app.set("trust proxy", 1);
-app.use(express.json());
+app.use(express.json({ limit: "10kb" }));
 
 const MCP_AUTH_TOKEN = process.env.MCP_AUTH_TOKEN;
 
@@ -269,6 +272,14 @@ const mcpRateLimiter = rateLimit({
   message: { error: "Too many requests. Retry after 60 seconds.", code: "RATE_LIMITED" },
 });
 
+const staticRateLimiter = rateLimit({
+  windowMs: 60_000,
+  max: 60,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: { error: "Too many requests.", code: "RATE_LIMITED" },
+});
+
 function mcpAuthMiddleware(
   req: express.Request,
   res: express.Response,
@@ -287,7 +298,7 @@ function mcpAuthMiddleware(
 }
 
 // Health check for Railway / uptime monitors
-app.get("/health", (_req, res) => {
+app.get("/health", staticRateLimiter, (_req, res) => {
   res.json({
     status: "ok",
     server: "buda-mcp",
@@ -298,7 +309,7 @@ app.get("/health", (_req, res) => {
 
 // Smithery static server card — assembled programmatically from tool definitions.
 // Adding a new tool only requires exporting its toolSchema; this handler needs no changes.
-app.get("/.well-known/mcp/server-card.json", (_req, res) => {
+app.get("/.well-known/mcp/server-card.json", staticRateLimiter, (_req, res) => {
   res.json({
     serverInfo: { name: "buda-mcp", version: VERSION },
     authentication: { required: authEnabled },

package/src/tools/batch_orders.ts

@@ -219,7 +219,11 @@ export async function handlePlaceBatchOrders(
   };
 }
 
-export function register(server: McpServer, client: BudaClient): void {
+export function register(
+  server: McpServer,
+  client: BudaClient,
+  transport: "http" | "stdio" = "stdio",
+): void {
   server.tool(
     toolSchema.name,
     toolSchema.description,
@@ -244,6 +248,6 @@ export function register(server: McpServer, client: BudaClient): void {
           "Safety confirmation. Must equal exactly 'CONFIRM' (case-sensitive) to execute.",
         ),
     },
-    (args) => handlePlaceBatchOrders(args, client),
+    (args) => handlePlaceBatchOrders(args, client, transport),
   );
 }

package/src/tools/cancel_all_orders.ts

@@ -94,7 +94,11 @@ export async function handleCancelAllOrders(
   }
 }
 
-export function register(server: McpServer, client: BudaClient): void {
+export function register(
+  server: McpServer,
+  client: BudaClient,
+  transport: "http" | "stdio" = "stdio",
+): void {
   server.tool(
     toolSchema.name,
     toolSchema.description,
@@ -110,6 +114,6 @@ export function register(server: McpServer, client: BudaClient): void {
             "Any other value will reject the request without canceling.",
         ),
     },
-    (args) => handleCancelAllOrders(args, client),
+    (args) => handleCancelAllOrders(args, client, transport),
   );
 }

package/src/tools/cancel_order.ts

@@ -78,7 +78,11 @@ export async function handleCancelOrder(
   }
 }
 
-export function register(server: McpServer, client: BudaClient): void {
+export function register(
+  server: McpServer,
+  client: BudaClient,
+  transport: "http" | "stdio" = "stdio",
+): void {
   server.tool(
     toolSchema.name,
     toolSchema.description,
@@ -95,6 +99,6 @@ export function register(server: McpServer, client: BudaClient): void {
             "Any other value will reject the request without canceling.",
         ),
     },
-    (args) => handleCancelOrder(args, client),
+    (args) => handleCancelOrder(args, client, transport),
   );
 }

package/src/tools/cancel_order_by_client_id.ts

@@ -112,7 +112,11 @@ export async function handleCancelOrderByClientId(
   }
 }
 
-export function register(server: McpServer, client: BudaClient): void {
+export function register(
+  server: McpServer,
+  client: BudaClient,
+  transport: "http" | "stdio" = "stdio",
+): void {
   server.tool(
     toolSchema.name,
     toolSchema.description,
@@ -128,6 +132,6 @@ export function register(server: McpServer, client: BudaClient): void {
             "Any other value will reject the request without canceling.",
         ),
     },
-    (args) => handleCancelOrderByClientId(args, client),
+    (args) => handleCancelOrderByClientId(args, client, transport),
   );
 }

package/src/tools/lightning.ts

@@ -204,7 +204,11 @@ export async function handleCreateLightningInvoice(
   }
 }
 
-export function register(server: McpServer, client: BudaClient): void {
+export function register(
+  server: McpServer,
+  client: BudaClient,
+  transport: "http" | "stdio" = "stdio",
+): void {
   server.tool(
     lightningWithdrawalToolSchema.name,
     lightningWithdrawalToolSchema.description,
@@ -220,7 +224,7 @@ export function register(server: McpServer, client: BudaClient): void {
             "Any other value will reject the request without paying.",
         ),
     },
-    (args) => handleLightningWithdrawal(args, client),
+    (args) => handleLightningWithdrawal(args, client, transport),
   );
 
   server.tool(

package/src/tools/place_order.ts

@@ -277,7 +277,11 @@ export async function handlePlaceOrder(
   }
 }
 
-export function register(server: McpServer, client: BudaClient): void {
+export function register(
+  server: McpServer,
+  client: BudaClient,
+  transport: "http" | "stdio" = "stdio",
+): void {
   server.tool(
     toolSchema.name,
     toolSchema.description,
@@ -335,6 +339,6 @@ export function register(server: McpServer, client: BudaClient): void {
             "Any other value will reject the request without placing an order.",
         ),
     },
-    (args) => handlePlaceOrder(args, client),
+    (args) => handlePlaceOrder(args, client, transport),
   );
 }

package/src/tools/receive_addresses.ts

@@ -209,7 +209,11 @@ export async function handleCreateReceiveAddress(
   }
 }
 
-export function register(server: McpServer, client: BudaClient): void {
+export function register(
+  server: McpServer,
+  client: BudaClient,
+  transport: "http" | "stdio" = "stdio",
+): void {
   server.tool(
     listReceiveAddressesToolSchema.name,
     listReceiveAddressesToolSchema.description,
@@ -238,6 +242,6 @@ export function register(server: McpServer, client: BudaClient): void {
         .string()
         .describe("Safety confirmation. Must equal exactly 'CONFIRM' (case-sensitive) to generate a new address."),
     },
-    (args) => handleCreateReceiveAddress(args, client),
+    (args) => handleCreateReceiveAddress(args, client, transport),
   );
 }

package/src/tools/remittances.ts

@@ -280,7 +280,11 @@ export async function handleAcceptRemittanceQuote(
   }
 }
 
-export function register(server: McpServer, client: BudaClient): void {
+export function register(
+  server: McpServer,
+  client: BudaClient,
+  transport: "http" | "stdio" = "stdio",
+): void {
   server.tool(
     listRemittancesToolSchema.name,
     listRemittancesToolSchema.description,
@@ -311,7 +315,7 @@ export function register(server: McpServer, client: BudaClient): void {
         .string()
         .describe("Safety confirmation. Must equal exactly 'CONFIRM' (case-sensitive) to create the quote."),
     },
-    (args) => handleQuoteRemittance(args, client),
+    (args) => handleQuoteRemittance(args, client, transport),
   );
 
   server.tool(
@@ -321,6 +325,6 @@ export function register(server: McpServer, client: BudaClient): void {
       id: z.number().int().positive().describe("The numeric ID of the remittance quote to accept."),
       confirmation_token: z.string().describe("Must be 'CONFIRM' to proceed. Any other value aborts."),
     },
-    (args) => handleAcceptRemittanceQuote(args, client),
+    (args) => handleAcceptRemittanceQuote(args, client, transport),
   );
 }

package/src/tools/withdrawals.ts

@@ -254,7 +254,11 @@ export async function handleCreateWithdrawal(
   }
 }
 
-export function register(server: McpServer, client: BudaClient): void {
+export function register(
+  server: McpServer,
+  client: BudaClient,
+  transport: "http" | "stdio" = "stdio",
+): void {
   server.tool(
     getWithdrawalHistoryToolSchema.name,
     getWithdrawalHistoryToolSchema.description,
@@ -283,6 +287,6 @@ export function register(server: McpServer, client: BudaClient): void {
         .string()
         .describe("Safety confirmation. Must equal exactly 'CONFIRM' (case-sensitive) to execute."),
     },
-    (args) => handleCreateWithdrawal(args, client),
+    (args) => handleCreateWithdrawal(args, client, transport),
   );
 }