@guiie/buda-mcp 1.5.2 → 1.5.4

package/dist/tools/place_order.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"place_order.d.ts","sourceRoot":"","sources":["../../src/tools/place_order.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAKxD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmEtB,CAAC;AAEF,KAAK,cAAc,GAAG;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,KAAK,GAAG,KAAK,CAAC;IACpB,UAAU,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAsLhF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CA4DpE"}
+{"version":3,"file":"place_order.d.ts","sourceRoot":"","sources":["../../src/tools/place_order.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAKxD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmEtB,CAAC;AAEF,KAAK,cAAc,GAAG;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,KAAK,GAAG,KAAK,CAAC;IACpB,UAAU,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAsLhF;AAED,wBAAgB,QAAQ,CACtB,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,IAAI,CA4DN"}

package/dist/tools/place_order.js

@@ -226,7 +226,7 @@ export async function handlePlaceOrder(args, client, transport = "stdio") {
         return result;
     }
 }
-export function register(server, client) {
+export function register(server, client, transport = "stdio") {
     server.tool(toolSchema.name, toolSchema.description, {
         market_id: z
             .string()
@@ -276,6 +276,6 @@ export function register(server, client) {
             .string()
             .describe("Safety confirmation. Must equal exactly 'CONFIRM' (case-sensitive) to execute the order. " +
             "Any other value will reject the request without placing an order."),
-    }, (args) => handlePlaceOrder(args, client));
+    }, (args) => handlePlaceOrder(args, client, transport));
 }
 //# sourceMappingURL=place_order.js.map

package/dist/tools/receive_addresses.d.ts

@@ -79,5 +79,5 @@ export declare function handleCreateReceiveAddress(args: {
     }>;
     isError?: boolean;
 }>;
-export declare function register(server: McpServer, client: BudaClient): void;
+export declare function register(server: McpServer, client: BudaClient, transport?: "http" | "stdio"): void;
 //# sourceMappingURL=receive_addresses.d.ts.map

package/dist/tools/receive_addresses.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"receive_addresses.d.ts","sourceRoot":"","sources":["../../src/tools/receive_addresses.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAKxD,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;CAwB1C,CAAC;AAEF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;CAiB1C,CAAC;AAEF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;CAoBvC,CAAC;AAYF,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,EAC1B,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAqChF;AAED,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,EACtC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA4BhF;AAED,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,EACtD,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA8ChF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CA+BpE"}
+{"version":3,"file":"receive_addresses.d.ts","sourceRoot":"","sources":["../../src/tools/receive_addresses.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAKxD,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;CAwB1C,CAAC;AAEF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;CAiB1C,CAAC;AAEF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;CAoBvC,CAAC;AAYF,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,EAC1B,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAqChF;AAED,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,EACtC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA4BhF;AAED,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,EACtD,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA8ChF;AAED,wBAAgB,QAAQ,CACtB,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,IAAI,CA+BN"}

package/dist/tools/receive_addresses.js

@@ -167,7 +167,7 @@ export async function handleCreateReceiveAddress(args, client, transport = "stdi
         return result;
     }
 }
-export function register(server, client) {
+export function register(server, client, transport = "stdio") {
     server.tool(listReceiveAddressesToolSchema.name, listReceiveAddressesToolSchema.description, {
         currency: z.string().min(2).max(10).describe("Currency code (e.g. 'BTC', 'ETH')."),
     }, (args) => handleListReceiveAddresses(args, client));
@@ -180,6 +180,6 @@ export function register(server, client) {
         confirmation_token: z
             .string()
             .describe("Safety confirmation. Must equal exactly 'CONFIRM' (case-sensitive) to generate a new address."),
-    }, (args) => handleCreateReceiveAddress(args, client));
+    }, (args) => handleCreateReceiveAddress(args, client, transport));
 }
 //# sourceMappingURL=receive_addresses.js.map

package/dist/tools/remittances.d.ts

@@ -116,5 +116,5 @@ export declare function handleAcceptRemittanceQuote(args: {
     }>;
     isError?: boolean;
 }>;
-export declare function register(server: McpServer, client: BudaClient): void;
+export declare function register(server: McpServer, client: BudaClient, transport?: "http" | "stdio"): void;
 //# sourceMappingURL=remittances.d.ts.map

package/dist/tools/remittances.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remittances.d.ts","sourceRoot":"","sources":["../../src/tools/remittances.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAMxD,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;CAoBrC,CAAC;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;CAiCrC,CAAC;AAEF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;CAuB3C,CAAC;AAEF,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;CAiBnC,CAAC;AAgBF,wBAAsB,qBAAqB,CACzC,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EACrC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAoChF;AAED,wBAAsB,mBAAmB,CACvC,IAAI,EAAE;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EACpB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAgBhF;AAED,wBAAsB,qBAAqB,CACzC,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,EAC5F,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAiDhF;AAED,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,EAChD,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAoChF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CA2CpE"}
+{"version":3,"file":"remittances.d.ts","sourceRoot":"","sources":["../../src/tools/remittances.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAMxD,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;CAoBrC,CAAC;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;CAiCrC,CAAC;AAEF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;CAuB3C,CAAC;AAEF,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;CAiBnC,CAAC;AAgBF,wBAAsB,qBAAqB,CACzC,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EACrC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAoChF;AAED,wBAAsB,mBAAmB,CACvC,IAAI,EAAE;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EACpB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAgBhF;AAED,wBAAsB,qBAAqB,CACzC,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,EAC5F,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAiDhF;AAED,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,EAChD,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAoChF;AAED,wBAAgB,QAAQ,CACtB,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,IAAI,CA2CN"}

package/dist/tools/remittances.js

@@ -236,7 +236,7 @@ export async function handleAcceptRemittanceQuote(args, client, transport = "std
         return result;
     }
 }
-export function register(server, client) {
+export function register(server, client, transport = "stdio") {
     server.tool(listRemittancesToolSchema.name, listRemittancesToolSchema.description, {
         per: z.number().int().min(1).max(300).optional().describe("Results per page (default: 20, max: 300)."),
         page: z.number().int().min(1).optional().describe("Page number (default: 1)."),
@@ -251,10 +251,10 @@ export function register(server, client) {
         confirmation_token: z
             .string()
             .describe("Safety confirmation. Must equal exactly 'CONFIRM' (case-sensitive) to create the quote."),
-    }, (args) => handleQuoteRemittance(args, client));
+    }, (args) => handleQuoteRemittance(args, client, transport));
     server.tool(acceptRemittanceQuoteToolSchema.name, acceptRemittanceQuoteToolSchema.description, {
         id: z.number().int().positive().describe("The numeric ID of the remittance quote to accept."),
         confirmation_token: z.string().describe("Must be 'CONFIRM' to proceed. Any other value aborts."),
-    }, (args) => handleAcceptRemittanceQuote(args, client));
+    }, (args) => handleAcceptRemittanceQuote(args, client, transport));
 }
 //# sourceMappingURL=remittances.js.map

package/dist/tools/withdrawals.d.ts

@@ -88,6 +88,6 @@ export declare function handleCreateWithdrawal(args: CreateWithdrawalArgs, clien
     }>;
     isError?: boolean;
 }>;
-export declare function register(server: McpServer, client: BudaClient): void;
+export declare function register(server: McpServer, client: BudaClient, transport?: "http" | "stdio"): void;
 export {};
 //# sourceMappingURL=withdrawals.d.ts.map

package/dist/tools/withdrawals.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"withdrawals.d.ts","sourceRoot":"","sources":["../../src/tools/withdrawals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAMxD,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;CA8B1C,CAAC;AAEF,KAAK,wBAAwB,GAAG;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,mBAAmB,GAAG,SAAS,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,CAAC;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAqBF,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,wBAAwB,EAC9B,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA+ChF;AAED,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuBtC,CAAC;AAEF,KAAK,oBAAoB,GAAG;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,oBAAoB,EAC1B,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAkGhF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CA+BpE"}
+{"version":3,"file":"withdrawals.d.ts","sourceRoot":"","sources":["../../src/tools/withdrawals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAMxD,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;CA8B1C,CAAC;AAEF,KAAK,wBAAwB,GAAG;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,mBAAmB,GAAG,SAAS,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,CAAC;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAqBF,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,wBAAwB,EAC9B,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA+ChF;AAED,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuBtC,CAAC;AAEF,KAAK,oBAAoB,GAAG;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,oBAAoB,EAC1B,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAkGhF;AAED,wBAAgB,QAAQ,CACtB,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,IAAI,CAmCN"}

package/dist/tools/withdrawals.js

@@ -201,7 +201,7 @@ export async function handleCreateWithdrawal(args, client, transport = "stdio")
         return result;
     }
 }
-export function register(server, client) {
+export function register(server, client, transport = "stdio") {
     server.tool(getWithdrawalHistoryToolSchema.name, getWithdrawalHistoryToolSchema.description, {
         currency: z.string().min(2).max(10).describe("Currency code (e.g. 'BTC', 'CLP')."),
         state: z
@@ -215,11 +215,15 @@ export function register(server, client) {
         currency: z.string().min(2).max(10).describe("Currency code (e.g. 'BTC', 'CLP')."),
         amount: z.number().positive().describe("Withdrawal amount."),
         address: z.string().optional().describe("Destination crypto address. Mutually exclusive with bank_account_id."),
-        network: z.string().optional().describe("Blockchain network for crypto withdrawals (e.g. 'bitcoin', 'ethereum')."),
+        network: z
+            .string()
+            .regex(/^[a-z][a-z0-9-]{1,29}$/, "Must be a lowercase alphanumeric network identifier (e.g. 'bitcoin', 'ethereum').")
+            .optional()
+            .describe("Blockchain network for crypto withdrawals (e.g. 'bitcoin', 'ethereum')."),
         bank_account_id: z.number().int().positive().optional().describe("Fiat bank account ID. Mutually exclusive with address."),
         confirmation_token: z
             .string()
             .describe("Safety confirmation. Must equal exactly 'CONFIRM' (case-sensitive) to execute."),
-    }, (args) => handleCreateWithdrawal(args, client));
+    }, (args) => handleCreateWithdrawal(args, client, transport));
 }
 //# sourceMappingURL=withdrawals.js.map

package/dist/utils.d.ts

@@ -1,6 +1,8 @@
 import type { Amount, OhlcvCandle } from "./types.js";
 /**
  * Constant-time string comparison to prevent timing attacks on bearer tokens.
+ * Both strings are written into equal-length buffers before comparing so that
+ * neither token length nor content can be inferred from execution time.
  */
 export declare function safeTokenEqual(a: string, b: string): boolean;
 /**

package/dist/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtD;;GAEG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAK5D;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GACX,MAAM,CASR;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAIjF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAI/E;AAWD;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAC3C,MAAM,EAAE,MAAM,GACb,WAAW,EAAE,CAoCf"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAS5D;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GACX,MAAM,CASR;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAIjF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAI/E;AAWD;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAC3C,MAAM,EAAE,MAAM,GACb,WAAW,EAAE,CAoCf"}

package/dist/utils.js

@@ -1,13 +1,18 @@
 import { timingSafeEqual } from "crypto";
 /**
  * Constant-time string comparison to prevent timing attacks on bearer tokens.
+ * Both strings are written into equal-length buffers before comparing so that
+ * neither token length nor content can be inferred from execution time.
  */
 export function safeTokenEqual(a, b) {
-    const aBuf = Buffer.from(a);
-    const bBuf = Buffer.from(b);
-    if (aBuf.length !== bBuf.length)
-        return false;
-    return timingSafeEqual(aBuf, bBuf);
+    const aByteLen = Buffer.byteLength(a);
+    const bByteLen = Buffer.byteLength(b);
+    const maxLen = Math.max(aByteLen, bByteLen);
+    const aBuf = Buffer.alloc(maxLen);
+    const bBuf = Buffer.alloc(maxLen);
+    aBuf.write(a);
+    bBuf.write(b);
+    return timingSafeEqual(aBuf, bBuf) && aByteLen === bByteLen;
 }
 /**
  * Parses a raw string (from an environment variable) as an integer within [min, max].

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guiie/buda-mcp",
-  "version": "1.5.2",
+  "version": "1.5.4",
   "mcpName": "io.github.gtorreal/buda-mcp",
   "description": "MCP server for Buda.com's public cryptocurrency exchange API (Chile, Colombia, Peru)",
   "type": "module",
@@ -50,6 +50,7 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "express": "^5.2.1",
     "express-rate-limit": "^8.3.2",
+    "helmet": "^8.1.0",
     "zod": "^4.3.6"
   },
   "devDependencies": {

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/gtorreal/buda-mcp",
     "source": "github"
   },
-  "version": "1.5.2",
+  "version": "1.5.4",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@guiie/buda-mcp",
-      "version": "1.5.2",
+      "version": "1.5.4",
       "transport": {
         "type": "stdio"
       }

package/src/client.ts

@@ -113,7 +113,15 @@ export class BudaClient {
       } catch {
         // ignore parse error, use statusText
       }
-      throw new BudaApiError(response.status, path, `Buda API ${response.status}: ${detail}`);
+      // Log full upstream detail server-side only — never forward to MCP caller
+      process.stderr.write(
+        JSON.stringify({ buda_api_error: true, status: response.status, path, detail }) + "\n",
+      );
+      const clientMsg =
+        response.status === 429
+          ? `Rate limit exceeded on ${path}. Retry later.`
+          : `Buda API error ${response.status} on ${path}.`;
+      throw new BudaApiError(response.status, path, clientMsg);
     }
     return response.json() as Promise<T>;
   }

package/src/http.ts

@@ -1,4 +1,5 @@
 import express from "express";
+import helmet from "helmet";
 import rateLimit from "express-rate-limit";
 import { McpServer, ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
@@ -140,22 +141,22 @@ function createServer(): McpServer {
   if (authEnabled) {
     balances.register(server, client);
     orders.register(server, client);
-    placeOrder.register(server, client);
-    cancelOrder.register(server, client);
+    placeOrder.register(server, client, "http");
+    cancelOrder.register(server, client, "http");
     deadMansSwitch.register(server, client, "http");
     account.register(server, client);
     balance.register(server, client);
     orderLookup.register(server, client);
     networkFees.register(server, client);
     deposits.register(server, client);
-    withdrawals.register(server, client);
-    receiveAddresses.register(server, client);
-    remittances.register(server, client);
+    withdrawals.register(server, client, "http");
+    receiveAddresses.register(server, client, "http");
+    remittances.register(server, client, "http");
     remittanceRecipients.register(server, client);
-    cancelAllOrders.register(server, client);
-    cancelOrderByClientId.register(server, client);
-    batchOrders.register(server, client);
-    lightning.register(server, client);
+    cancelAllOrders.register(server, client, "http");
+    cancelOrderByClientId.register(server, client, "http");
+    batchOrders.register(server, client, "http");
+    lightning.register(server, client, "http");
   }
 
   // MCP Resources
@@ -231,10 +232,15 @@ function createServer(): McpServer {
 }
 
 const app = express();
-// Required for correct client IP detection behind Railway's reverse proxy.
-// Without this, express-rate-limit sees the proxy IP instead of the real client.
+app.use(helmet());
+// CORS: intentionally not configured. This server is designed for server-to-server MCP
+// communication only (AI agents, Claude Desktop, etc.) — not for browser clients.
+// Helmet already sets X-Content-Type-Options, X-Frame-Options, and related headers.
+// trust proxy: 1 = trust exactly one hop (Railway's reverse proxy).
+// If Cloudflare or another proxy is added in front, increment this value.
+// Affects: req.ip and express-rate-limit client IP detection.
 app.set("trust proxy", 1);
-app.use(express.json());
+app.use(express.json({ limit: "10kb" }));
 
 const MCP_AUTH_TOKEN = process.env.MCP_AUTH_TOKEN;
 
@@ -269,6 +275,14 @@ const mcpRateLimiter = rateLimit({
   message: { error: "Too many requests. Retry after 60 seconds.", code: "RATE_LIMITED" },
 });
 
+const staticRateLimiter = rateLimit({
+  windowMs: 60_000,
+  max: 60,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: { error: "Too many requests.", code: "RATE_LIMITED" },
+});
+
 function mcpAuthMiddleware(
   req: express.Request,
   res: express.Response,
@@ -286,19 +300,21 @@ function mcpAuthMiddleware(
   next();
 }
 
-// Health check for Railway / uptime monitors
-app.get("/health", (_req, res) => {
+// Health check for Railway / uptime monitors.
+// version is intentionally omitted to avoid fingerprinting by unauthenticated callers.
+app.get("/health", staticRateLimiter, (_req, res) => {
   res.json({
     status: "ok",
     server: "buda-mcp",
-    version: VERSION,
     auth_mode: authEnabled ? "authenticated" : "public",
   });
 });
 
 // Smithery static server card — assembled programmatically from tool definitions.
 // Adding a new tool only requires exporting its toolSchema; this handler needs no changes.
-app.get("/.well-known/mcp/server-card.json", (_req, res) => {
+// When auth is enabled, the server card is gated behind the same bearer token as /mcp
+// to avoid leaking the full tool schema to unauthenticated callers.
+app.get("/.well-known/mcp/server-card.json", staticRateLimiter, mcpAuthMiddleware, (_req, res) => {
   res.json({
     serverInfo: { name: "buda-mcp", version: VERSION },
     authentication: { required: authEnabled },
@@ -342,7 +358,7 @@ app.get("/mcp", mcpRateLimiter, mcpAuthMiddleware, async (req, res) => {
   await transport.handleRequest(req, res);
 });
 
-app.delete("/mcp", async (_req, res) => {
+app.delete("/mcp", mcpRateLimiter, mcpAuthMiddleware, async (_req, res) => {
   res.status(405).json({ error: "Sessions not supported (stateless server)" });
 });
 

package/src/tools/arbitrage.ts

@@ -2,6 +2,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 import { BudaClient, BudaApiError } from "../client.js";
 import { MemoryCache, CACHE_TTL } from "../cache.js";
+import { validateCurrency } from "../validation.js";
 import type { AllTickersResponse, Ticker } from "../types.js";
 
 export const toolSchema = {
@@ -51,6 +52,14 @@ export async function handleArbitrageOpportunities(
   client: BudaClient,
   cache: MemoryCache,
 ): Promise<{ content: Array<{ type: "text"; text: string }>; isError?: boolean }> {
+  const currencyError = validateCurrency(base_currency);
+  if (currencyError) {
+    return {
+      content: [{ type: "text", text: JSON.stringify({ error: currencyError, code: "INVALID_CURRENCY" }) }],
+      isError: true,
+    };
+  }
+
   try {
     const base = base_currency.toUpperCase();
     const data = await cache.getOrFetch<AllTickersResponse>(
@@ -187,6 +196,9 @@ export function register(server: McpServer, client: BudaClient, cache: MemoryCac
     {
       base_currency: z
         .string()
+        .min(2)
+        .max(10)
+        .regex(/^[A-Z0-9]+$/i, "Must be 2–10 alphanumeric characters (e.g. 'BTC', 'ETH').")
         .describe("Base asset to scan (e.g. 'BTC', 'ETH', 'XRP')."),
       threshold_pct: z
         .number()

package/src/tools/batch_orders.ts

@@ -219,7 +219,11 @@ export async function handlePlaceBatchOrders(
   };
 }
 
-export function register(server: McpServer, client: BudaClient): void {
+export function register(
+  server: McpServer,
+  client: BudaClient,
+  transport: "http" | "stdio" = "stdio",
+): void {
   server.tool(
     toolSchema.name,
     toolSchema.description,
@@ -244,6 +248,6 @@ export function register(server: McpServer, client: BudaClient): void {
           "Safety confirmation. Must equal exactly 'CONFIRM' (case-sensitive) to execute.",
         ),
     },
-    (args) => handlePlaceBatchOrders(args, client),
+    (args) => handlePlaceBatchOrders(args, client, transport),
   );
 }

package/src/tools/cancel_all_orders.ts

@@ -94,7 +94,11 @@ export async function handleCancelAllOrders(
   }
 }
 
-export function register(server: McpServer, client: BudaClient): void {
+export function register(
+  server: McpServer,
+  client: BudaClient,
+  transport: "http" | "stdio" = "stdio",
+): void {
   server.tool(
     toolSchema.name,
     toolSchema.description,
@@ -110,6 +114,6 @@ export function register(server: McpServer, client: BudaClient): void {
             "Any other value will reject the request without canceling.",
         ),
     },
-    (args) => handleCancelAllOrders(args, client),
+    (args) => handleCancelAllOrders(args, client, transport),
   );
 }

package/src/tools/cancel_order.ts

@@ -78,7 +78,11 @@ export async function handleCancelOrder(
   }
 }
 
-export function register(server: McpServer, client: BudaClient): void {
+export function register(
+  server: McpServer,
+  client: BudaClient,
+  transport: "http" | "stdio" = "stdio",
+): void {
   server.tool(
     toolSchema.name,
     toolSchema.description,
@@ -95,6 +99,6 @@ export function register(server: McpServer, client: BudaClient): void {
             "Any other value will reject the request without canceling.",
         ),
     },
-    (args) => handleCancelOrder(args, client),
+    (args) => handleCancelOrder(args, client, transport),
   );
 }

package/src/tools/cancel_order_by_client_id.ts

@@ -112,7 +112,11 @@ export async function handleCancelOrderByClientId(
   }
 }
 
-export function register(server: McpServer, client: BudaClient): void {
+export function register(
+  server: McpServer,
+  client: BudaClient,
+  transport: "http" | "stdio" = "stdio",
+): void {
   server.tool(
     toolSchema.name,
     toolSchema.description,
@@ -128,6 +132,6 @@ export function register(server: McpServer, client: BudaClient): void {
             "Any other value will reject the request without canceling.",
         ),
     },
-    (args) => handleCancelOrderByClientId(args, client),
+    (args) => handleCancelOrderByClientId(args, client, transport),
   );
 }

package/src/tools/lightning.ts

@@ -140,7 +140,13 @@ export async function handleLightningWithdrawal(
         },
       ],
     };
-    logAudit({ ts: new Date().toISOString(), tool: "lightning_withdrawal", transport, args_summary: {}, success: true });
+    logAudit({
+      ts: new Date().toISOString(),
+      tool: "lightning_withdrawal",
+      transport,
+      args_summary: { amount_btc: amount.value },
+      success: true,
+    });
     return result;
   } catch (err) {
     const msg =
@@ -148,7 +154,7 @@ export async function handleLightningWithdrawal(
         ? { error: err.message, code: err.status }
         : { error: String(err), code: "UNKNOWN" };
     const result = { content: [{ type: "text" as const, text: JSON.stringify(msg) }], isError: true as const };
-    logAudit({ ts: new Date().toISOString(), tool: "lightning_withdrawal", transport, args_summary: {}, success: false, error_code: msg.code });
+    logAudit({ ts: new Date().toISOString(), tool: "lightning_withdrawal", transport, args_summary: {}, success: false, error_code: msg.code as string | number });
     return result;
   }
 }
@@ -204,7 +210,11 @@ export async function handleCreateLightningInvoice(
   }
 }
 
-export function register(server: McpServer, client: BudaClient): void {
+export function register(
+  server: McpServer,
+  client: BudaClient,
+  transport: "http" | "stdio" = "stdio",
+): void {
   server.tool(
     lightningWithdrawalToolSchema.name,
     lightningWithdrawalToolSchema.description,
@@ -220,7 +230,7 @@ export function register(server: McpServer, client: BudaClient): void {
             "Any other value will reject the request without paying.",
         ),
     },
-    (args) => handleLightningWithdrawal(args, client),
+    (args) => handleLightningWithdrawal(args, client, transport),
   );
 
   server.tool(

package/src/tools/place_order.ts

@@ -277,7 +277,11 @@ export async function handlePlaceOrder(
   }
 }
 
-export function register(server: McpServer, client: BudaClient): void {
+export function register(
+  server: McpServer,
+  client: BudaClient,
+  transport: "http" | "stdio" = "stdio",
+): void {
   server.tool(
     toolSchema.name,
     toolSchema.description,
@@ -335,6 +339,6 @@ export function register(server: McpServer, client: BudaClient): void {
             "Any other value will reject the request without placing an order.",
         ),
     },
-    (args) => handlePlaceOrder(args, client),
+    (args) => handlePlaceOrder(args, client, transport),
   );
 }

package/src/tools/receive_addresses.ts

@@ -209,7 +209,11 @@ export async function handleCreateReceiveAddress(
   }
 }
 
-export function register(server: McpServer, client: BudaClient): void {
+export function register(
+  server: McpServer,
+  client: BudaClient,
+  transport: "http" | "stdio" = "stdio",
+): void {
   server.tool(
     listReceiveAddressesToolSchema.name,
     listReceiveAddressesToolSchema.description,
@@ -238,6 +242,6 @@ export function register(server: McpServer, client: BudaClient): void {
         .string()
         .describe("Safety confirmation. Must equal exactly 'CONFIRM' (case-sensitive) to generate a new address."),
     },
-    (args) => handleCreateReceiveAddress(args, client),
+    (args) => handleCreateReceiveAddress(args, client, transport),
   );
 }

package/src/tools/remittances.ts

@@ -280,7 +280,11 @@ export async function handleAcceptRemittanceQuote(
   }
 }
 
-export function register(server: McpServer, client: BudaClient): void {
+export function register(
+  server: McpServer,
+  client: BudaClient,
+  transport: "http" | "stdio" = "stdio",
+): void {
   server.tool(
     listRemittancesToolSchema.name,
     listRemittancesToolSchema.description,
@@ -311,7 +315,7 @@ export function register(server: McpServer, client: BudaClient): void {
         .string()
         .describe("Safety confirmation. Must equal exactly 'CONFIRM' (case-sensitive) to create the quote."),
     },
-    (args) => handleQuoteRemittance(args, client),
+    (args) => handleQuoteRemittance(args, client, transport),
   );
 
   server.tool(
@@ -321,6 +325,6 @@ export function register(server: McpServer, client: BudaClient): void {
       id: z.number().int().positive().describe("The numeric ID of the remittance quote to accept."),
       confirmation_token: z.string().describe("Must be 'CONFIRM' to proceed. Any other value aborts."),
     },
-    (args) => handleAcceptRemittanceQuote(args, client),
+    (args) => handleAcceptRemittanceQuote(args, client, transport),
   );
 }

package/src/tools/withdrawals.ts

@@ -254,7 +254,11 @@ export async function handleCreateWithdrawal(
   }
 }
 
-export function register(server: McpServer, client: BudaClient): void {
+export function register(
+  server: McpServer,
+  client: BudaClient,
+  transport: "http" | "stdio" = "stdio",
+): void {
   server.tool(
     getWithdrawalHistoryToolSchema.name,
     getWithdrawalHistoryToolSchema.description,
@@ -277,12 +281,16 @@ export function register(server: McpServer, client: BudaClient): void {
       currency: z.string().min(2).max(10).describe("Currency code (e.g. 'BTC', 'CLP')."),
       amount: z.number().positive().describe("Withdrawal amount."),
       address: z.string().optional().describe("Destination crypto address. Mutually exclusive with bank_account_id."),
-      network: z.string().optional().describe("Blockchain network for crypto withdrawals (e.g. 'bitcoin', 'ethereum')."),
+      network: z
+        .string()
+        .regex(/^[a-z][a-z0-9-]{1,29}$/, "Must be a lowercase alphanumeric network identifier (e.g. 'bitcoin', 'ethereum').")
+        .optional()
+        .describe("Blockchain network for crypto withdrawals (e.g. 'bitcoin', 'ethereum')."),
       bank_account_id: z.number().int().positive().optional().describe("Fiat bank account ID. Mutually exclusive with address."),
       confirmation_token: z
         .string()
         .describe("Safety confirmation. Must equal exactly 'CONFIRM' (case-sensitive) to execute."),
     },
-    (args) => handleCreateWithdrawal(args, client),
+    (args) => handleCreateWithdrawal(args, client, transport),
   );
 }