@guiie/buda-mcp 1.5.3 → 1.5.4

package/.github/workflows/publish.yml

@@ -10,8 +10,8 @@ jobs:
     name: Build & test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4.4.0
         with:
           node-version: "20"
           cache: "npm"
@@ -28,8 +28,8 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4.4.0
         with:
           node-version: "20"
           registry-url: "https://registry.npmjs.org"
@@ -53,15 +53,25 @@ jobs:
     name: Publish to MCP Registry
     needs: npm
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     env:
       MCP_REGISTRY_TOKEN: ${{ secrets.MCP_REGISTRY_TOKEN }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
       - name: Install mcp-publisher
         run: |
-          curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_linux_amd64.tar.gz" \
-            | tar xz mcp-publisher
+          RELEASE_TAG=$(gh api repos/modelcontextprotocol/registry/releases/latest --jq '.tag_name')
+          VER="${RELEASE_TAG#v}"
+          curl -fsSL -o mcp-publisher.tar.gz \
+            "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_linux_amd64.tar.gz"
+          curl -fsSL -o checksums.txt \
+            "https://github.com/modelcontextprotocol/registry/releases/download/${RELEASE_TAG}/registry_${VER}_checksums.txt"
+          grep "mcp-publisher_linux_amd64.tar.gz" checksums.txt | sha256sum --check
+          tar xzf mcp-publisher.tar.gz mcp-publisher
           sudo mv mcp-publisher /usr/local/bin/
+        env:
+          GH_TOKEN: ${{ github.token }}
       - name: Authenticate and publish to MCP Registry
         run: |
           mcp-publisher login token "$MCP_REGISTRY_TOKEN"

package/CHANGELOG.md

@@ -11,6 +11,32 @@ This project uses [Semantic Versioning](https://semver.org/).
 
 ---
 
+## [1.5.4] – 2026-04-11
+
+### Security
+
+- **CI/CD supply-chain hardening** — `publish.yml` now verifies the SHA256 checksum of the `mcp-publisher` binary against the official `registry_*_checksums.txt` file before extraction. The download uses `curl -fsSL` (strict) and aborts if the checksum does not match. Previously the binary was piped directly from the network into `tar` without any integrity check.
+
+- **GitHub Actions pinned to immutable commit SHAs** — all three `actions/checkout` and `actions/setup-node` usages in `publish.yml` are now pinned to their exact commit SHA (`11bd71901...` / `49933ea5...`) with the human-readable tag in a comment. Tag-based references (`@v4`) are mutable and could be silently redirected.
+
+- **`DELETE /mcp` protected by rate limiter and auth middleware** — the endpoint was previously unprotected and returned 405 to anyone without any throttling. It now passes through the same `mcpRateLimiter` and `mcpAuthMiddleware` as the `POST`/`GET` `/mcp` handlers.
+
+- **Version removed from unauthenticated `/health` response** — the `version` field was removed from the public health endpoint to prevent fingerprinting of the exact server version. `status`, `server`, and `auth_mode` are still returned.
+
+- **`/.well-known/mcp/server-card.json` gated by auth when credentials are configured** — when `MCP_AUTH_TOKEN` is set, the server-card endpoint now requires the same Bearer token as `/mcp`, preventing unauthenticated enumeration of all tool schemas including authenticated ones.
+
+- **`validateCurrency` added to `get_arbitrage_opportunities`** — the `base_currency` input was the only tool parameter that bypassed the shared currency validator. It now runs `validateCurrency()` before any business logic. The Zod schema in `register()` was also tightened with `.min(2).max(10).regex(/^[A-Z0-9]+$/i)`.
+
+- **`network` field in `create_withdrawal` validated by regex** — the blockchain network identifier for crypto withdrawals is now validated against `/^[a-z][a-z0-9-]{1,29}$/` in the Zod schema, rejecting unexpected values before they reach the Buda API.
+
+- **Audit log for `lightning_withdrawal` now includes amount** — `args_summary` was previously empty (`{}`), making the audit trail useless for this operation. The confirmed withdrawal amount (`amount_btc`) is now included so anomaly detection and post-incident review have meaningful context. The invoice string is still never logged.
+
+- **`safeTokenEqual` now eliminates token-length timing oracle** — both strings are written into equal-length zero-padded `Buffer.alloc(maxLen)` before `timingSafeEqual`, so execution time no longer varies with the difference in string lengths. A final `aByteLen === bByteLen` guard prevents a padded match from returning `true`.
+
+- **CORS policy documented explicitly** — an inline comment clarifies that CORS is intentionally not configured because `buda-mcp` is a server-to-server MCP transport, not a browser client target. `helmet()` already sets the relevant browser security headers.
+
+---
+
 ## [1.5.3] – 2026-04-11
 
 ### Security

package/PUBLISH_CHECKLIST.md

@@ -1,6 +1,6 @@
-# Publish Checklist — buda-mcp v1.5.3
+# Publish Checklist — buda-mcp v1.5.4
 
-Steps to publish `v1.5.3` to npm, the MCP registry, and notify community directories.
+Steps to publish `v1.5.4` to npm, the MCP registry, and notify community directories.
 
 ---
 
@@ -8,7 +8,7 @@ Steps to publish `v1.5.3` to npm, the MCP registry, and notify community directo
 
 ```bash
 # Confirm version
-node -e "console.log(require('./package.json').version)"  # should print 1.5.3
+node -e "console.log(require('./package.json').version)"  # should print 1.5.4
 
 # Build and test
 npm run build
@@ -37,9 +37,9 @@ Verify: https://www.npmjs.com/package/@guiie/buda-mcp
 
 ## 3. GitHub release
 
-Tag and release already created via `gh release create v1.5.3`. Verify at:
+Tag and release already created via `gh release create v1.5.4`. Verify at:
 
-https://github.com/gtorreal/buda-mcp/releases/tag/v1.5.3
+https://github.com/gtorreal/buda-mcp/releases/tag/v1.5.4
 
 ---
 

package/dist/http.js

@@ -197,6 +197,9 @@ function createServer() {
 }
 const app = express();
 app.use(helmet());
+// CORS: intentionally not configured. This server is designed for server-to-server MCP
+// communication only (AI agents, Claude Desktop, etc.) — not for browser clients.
+// Helmet already sets X-Content-Type-Options, X-Frame-Options, and related headers.
 // trust proxy: 1 = trust exactly one hop (Railway's reverse proxy).
 // If Cloudflare or another proxy is added in front, increment this value.
 // Affects: req.ip and express-rate-limit client IP detection.
@@ -246,18 +249,20 @@ function mcpAuthMiddleware(req, res, next) {
     }
     next();
 }
-// Health check for Railway / uptime monitors
+// Health check for Railway / uptime monitors.
+// version is intentionally omitted to avoid fingerprinting by unauthenticated callers.
 app.get("/health", staticRateLimiter, (_req, res) => {
     res.json({
         status: "ok",
         server: "buda-mcp",
-        version: VERSION,
         auth_mode: authEnabled ? "authenticated" : "public",
     });
 });
 // Smithery static server card — assembled programmatically from tool definitions.
 // Adding a new tool only requires exporting its toolSchema; this handler needs no changes.
-app.get("/.well-known/mcp/server-card.json", staticRateLimiter, (_req, res) => {
+// When auth is enabled, the server card is gated behind the same bearer token as /mcp
+// to avoid leaking the full tool schema to unauthenticated callers.
+app.get("/.well-known/mcp/server-card.json", staticRateLimiter, mcpAuthMiddleware, (_req, res) => {
     res.json({
         serverInfo: { name: "buda-mcp", version: VERSION },
         authentication: { required: authEnabled },
@@ -294,7 +299,7 @@ app.get("/mcp", mcpRateLimiter, mcpAuthMiddleware, async (req, res) => {
     await server.connect(transport);
     await transport.handleRequest(req, res);
 });
-app.delete("/mcp", async (_req, res) => {
+app.delete("/mcp", mcpRateLimiter, mcpAuthMiddleware, async (_req, res) => {
     res.status(405).json({ error: "Sessions not supported (stateless server)" });
 });
 app.listen(PORT, () => {

package/dist/tools/arbitrage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"arbitrage.d.ts","sourceRoot":"","sources":["../../src/tools/arbitrage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,WAAW,EAAa,MAAM,aAAa,CAAC;AAGrD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;CAyBtB,CAAC;AAYF,UAAU,cAAc;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wBAAsB,4BAA4B,CAChD,EAAE,aAAa,EAAE,aAAmB,EAAE,EAAE,cAAc,EACtD,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAgIhF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAmBxF"}
+{"version":3,"file":"arbitrage.d.ts","sourceRoot":"","sources":["../../src/tools/arbitrage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,WAAW,EAAa,MAAM,aAAa,CAAC;AAIrD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;CAyBtB,CAAC;AAYF,UAAU,cAAc;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wBAAsB,4BAA4B,CAChD,EAAE,aAAa,EAAE,aAAmB,EAAE,EAAE,cAAc,EACtD,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAwIhF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAsBxF"}

package/dist/tools/arbitrage.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { BudaApiError } from "../client.js";
 import { CACHE_TTL } from "../cache.js";
+import { validateCurrency } from "../validation.js";
 export const toolSchema = {
     name: "get_arbitrage_opportunities",
     description: "Detects cross-country price discrepancies for a given asset across Buda's CLP, COP, and PEN markets, " +
@@ -26,6 +27,13 @@ export const toolSchema = {
     },
 };
 export async function handleArbitrageOpportunities({ base_currency, threshold_pct = 0.5 }, client, cache) {
+    const currencyError = validateCurrency(base_currency);
+    if (currencyError) {
+        return {
+            content: [{ type: "text", text: JSON.stringify({ error: currencyError, code: "INVALID_CURRENCY" }) }],
+            isError: true,
+        };
+    }
     try {
         const base = base_currency.toUpperCase();
         const data = await cache.getOrFetch("tickers:all", CACHE_TTL.TICKER, () => client.get("/tickers"));
@@ -130,6 +138,9 @@ export function register(server, client, cache) {
     server.tool(toolSchema.name, toolSchema.description, {
         base_currency: z
             .string()
+            .min(2)
+            .max(10)
+            .regex(/^[A-Z0-9]+$/i, "Must be 2–10 alphanumeric characters (e.g. 'BTC', 'ETH').")
             .describe("Base asset to scan (e.g. 'BTC', 'ETH', 'XRP')."),
         threshold_pct: z
             .number()

package/dist/tools/lightning.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lightning.d.ts","sourceRoot":"","sources":["../../src/tools/lightning.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAKxD,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;CAuBzC,CAAC;AAEF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;CAwB5C,CAAC;AAEF,KAAK,uBAAuB,GAAG;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,KAAK,0BAA0B,GAAG;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,uBAAuB,EAC7B,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAgFhF;AAED,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,0BAA0B,EAChC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA8ChF;AAED,wBAAgB,QAAQ,CACtB,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,IAAI,CA2CN"}
+{"version":3,"file":"lightning.d.ts","sourceRoot":"","sources":["../../src/tools/lightning.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAKxD,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;CAuBzC,CAAC;AAEF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;CAwB5C,CAAC;AAEF,KAAK,uBAAuB,GAAG;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,KAAK,0BAA0B,GAAG;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,uBAAuB,EAC7B,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAsFhF;AAED,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,0BAA0B,EAChC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA8ChF;AAED,wBAAgB,QAAQ,CACtB,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,IAAI,CA2CN"}

package/dist/tools/lightning.js

@@ -103,7 +103,13 @@ export async function handleLightningWithdrawal(args, client, transport = "stdio
                 },
             ],
         };
-        logAudit({ ts: new Date().toISOString(), tool: "lightning_withdrawal", transport, args_summary: {}, success: true });
+        logAudit({
+            ts: new Date().toISOString(),
+            tool: "lightning_withdrawal",
+            transport,
+            args_summary: { amount_btc: amount.value },
+            success: true,
+        });
         return result;
     }
     catch (err) {

package/dist/tools/withdrawals.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"withdrawals.d.ts","sourceRoot":"","sources":["../../src/tools/withdrawals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAMxD,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;CA8B1C,CAAC;AAEF,KAAK,wBAAwB,GAAG;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,mBAAmB,GAAG,SAAS,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,CAAC;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAqBF,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,wBAAwB,EAC9B,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA+ChF;AAED,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuBtC,CAAC;AAEF,KAAK,oBAAoB,GAAG;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,oBAAoB,EAC1B,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAkGhF;AAED,wBAAgB,QAAQ,CACtB,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,IAAI,CA+BN"}
+{"version":3,"file":"withdrawals.d.ts","sourceRoot":"","sources":["../../src/tools/withdrawals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAC;AAMxD,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;CA8B1C,CAAC;AAEF,KAAK,wBAAwB,GAAG;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,mBAAmB,GAAG,SAAS,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,CAAC;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAqBF,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,wBAAwB,EAC9B,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA+ChF;AAED,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuBtC,CAAC;AAEF,KAAK,oBAAoB,GAAG;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,oBAAoB,EAC1B,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAkGhF;AAED,wBAAgB,QAAQ,CACtB,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,UAAU,EAClB,SAAS,GAAE,MAAM,GAAG,OAAiB,GACpC,IAAI,CAmCN"}

package/dist/tools/withdrawals.js

@@ -215,7 +215,11 @@ export function register(server, client, transport = "stdio") {
         currency: z.string().min(2).max(10).describe("Currency code (e.g. 'BTC', 'CLP')."),
         amount: z.number().positive().describe("Withdrawal amount."),
         address: z.string().optional().describe("Destination crypto address. Mutually exclusive with bank_account_id."),
-        network: z.string().optional().describe("Blockchain network for crypto withdrawals (e.g. 'bitcoin', 'ethereum')."),
+        network: z
+            .string()
+            .regex(/^[a-z][a-z0-9-]{1,29}$/, "Must be a lowercase alphanumeric network identifier (e.g. 'bitcoin', 'ethereum').")
+            .optional()
+            .describe("Blockchain network for crypto withdrawals (e.g. 'bitcoin', 'ethereum')."),
         bank_account_id: z.number().int().positive().optional().describe("Fiat bank account ID. Mutually exclusive with address."),
         confirmation_token: z
             .string()

package/dist/utils.d.ts

@@ -1,6 +1,8 @@
 import type { Amount, OhlcvCandle } from "./types.js";
 /**
  * Constant-time string comparison to prevent timing attacks on bearer tokens.
+ * Both strings are written into equal-length buffers before comparing so that
+ * neither token length nor content can be inferred from execution time.
  */
 export declare function safeTokenEqual(a: string, b: string): boolean;
 /**

package/dist/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtD;;GAEG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAK5D;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GACX,MAAM,CASR;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAIjF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAI/E;AAWD;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAC3C,MAAM,EAAE,MAAM,GACb,WAAW,EAAE,CAoCf"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAS5D;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GACX,MAAM,CASR;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAIjF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAI/E;AAWD;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAC3C,MAAM,EAAE,MAAM,GACb,WAAW,EAAE,CAoCf"}

package/dist/utils.js

@@ -1,13 +1,18 @@
 import { timingSafeEqual } from "crypto";
 /**
  * Constant-time string comparison to prevent timing attacks on bearer tokens.
+ * Both strings are written into equal-length buffers before comparing so that
+ * neither token length nor content can be inferred from execution time.
  */
 export function safeTokenEqual(a, b) {
-    const aBuf = Buffer.from(a);
-    const bBuf = Buffer.from(b);
-    if (aBuf.length !== bBuf.length)
-        return false;
-    return timingSafeEqual(aBuf, bBuf);
+    const aByteLen = Buffer.byteLength(a);
+    const bByteLen = Buffer.byteLength(b);
+    const maxLen = Math.max(aByteLen, bByteLen);
+    const aBuf = Buffer.alloc(maxLen);
+    const bBuf = Buffer.alloc(maxLen);
+    aBuf.write(a);
+    bBuf.write(b);
+    return timingSafeEqual(aBuf, bBuf) && aByteLen === bByteLen;
 }
 /**
  * Parses a raw string (from an environment variable) as an integer within [min, max].

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guiie/buda-mcp",
-  "version": "1.5.3",
+  "version": "1.5.4",
   "mcpName": "io.github.gtorreal/buda-mcp",
   "description": "MCP server for Buda.com's public cryptocurrency exchange API (Chile, Colombia, Peru)",
   "type": "module",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/gtorreal/buda-mcp",
     "source": "github"
   },
-  "version": "1.5.3",
+  "version": "1.5.4",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@guiie/buda-mcp",
-      "version": "1.5.3",
+      "version": "1.5.4",
       "transport": {
         "type": "stdio"
       }

package/src/http.ts

@@ -233,6 +233,9 @@ function createServer(): McpServer {
 
 const app = express();
 app.use(helmet());
+// CORS: intentionally not configured. This server is designed for server-to-server MCP
+// communication only (AI agents, Claude Desktop, etc.) — not for browser clients.
+// Helmet already sets X-Content-Type-Options, X-Frame-Options, and related headers.
 // trust proxy: 1 = trust exactly one hop (Railway's reverse proxy).
 // If Cloudflare or another proxy is added in front, increment this value.
 // Affects: req.ip and express-rate-limit client IP detection.
@@ -297,19 +300,21 @@ function mcpAuthMiddleware(
   next();
 }
 
-// Health check for Railway / uptime monitors
+// Health check for Railway / uptime monitors.
+// version is intentionally omitted to avoid fingerprinting by unauthenticated callers.
 app.get("/health", staticRateLimiter, (_req, res) => {
   res.json({
     status: "ok",
     server: "buda-mcp",
-    version: VERSION,
     auth_mode: authEnabled ? "authenticated" : "public",
   });
 });
 
 // Smithery static server card — assembled programmatically from tool definitions.
 // Adding a new tool only requires exporting its toolSchema; this handler needs no changes.
-app.get("/.well-known/mcp/server-card.json", staticRateLimiter, (_req, res) => {
+// When auth is enabled, the server card is gated behind the same bearer token as /mcp
+// to avoid leaking the full tool schema to unauthenticated callers.
+app.get("/.well-known/mcp/server-card.json", staticRateLimiter, mcpAuthMiddleware, (_req, res) => {
   res.json({
     serverInfo: { name: "buda-mcp", version: VERSION },
     authentication: { required: authEnabled },
@@ -353,7 +358,7 @@ app.get("/mcp", mcpRateLimiter, mcpAuthMiddleware, async (req, res) => {
   await transport.handleRequest(req, res);
 });
 
-app.delete("/mcp", async (_req, res) => {
+app.delete("/mcp", mcpRateLimiter, mcpAuthMiddleware, async (_req, res) => {
   res.status(405).json({ error: "Sessions not supported (stateless server)" });
 });
 

package/src/tools/arbitrage.ts

@@ -2,6 +2,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 import { BudaClient, BudaApiError } from "../client.js";
 import { MemoryCache, CACHE_TTL } from "../cache.js";
+import { validateCurrency } from "../validation.js";
 import type { AllTickersResponse, Ticker } from "../types.js";
 
 export const toolSchema = {
@@ -51,6 +52,14 @@ export async function handleArbitrageOpportunities(
   client: BudaClient,
   cache: MemoryCache,
 ): Promise<{ content: Array<{ type: "text"; text: string }>; isError?: boolean }> {
+  const currencyError = validateCurrency(base_currency);
+  if (currencyError) {
+    return {
+      content: [{ type: "text", text: JSON.stringify({ error: currencyError, code: "INVALID_CURRENCY" }) }],
+      isError: true,
+    };
+  }
+
   try {
     const base = base_currency.toUpperCase();
     const data = await cache.getOrFetch<AllTickersResponse>(
@@ -187,6 +196,9 @@ export function register(server: McpServer, client: BudaClient, cache: MemoryCac
     {
       base_currency: z
         .string()
+        .min(2)
+        .max(10)
+        .regex(/^[A-Z0-9]+$/i, "Must be 2–10 alphanumeric characters (e.g. 'BTC', 'ETH').")
         .describe("Base asset to scan (e.g. 'BTC', 'ETH', 'XRP')."),
       threshold_pct: z
         .number()

package/src/tools/lightning.ts

@@ -140,7 +140,13 @@ export async function handleLightningWithdrawal(
         },
       ],
     };
-    logAudit({ ts: new Date().toISOString(), tool: "lightning_withdrawal", transport, args_summary: {}, success: true });
+    logAudit({
+      ts: new Date().toISOString(),
+      tool: "lightning_withdrawal",
+      transport,
+      args_summary: { amount_btc: amount.value },
+      success: true,
+    });
     return result;
   } catch (err) {
     const msg =
@@ -148,7 +154,7 @@ export async function handleLightningWithdrawal(
         ? { error: err.message, code: err.status }
         : { error: String(err), code: "UNKNOWN" };
     const result = { content: [{ type: "text" as const, text: JSON.stringify(msg) }], isError: true as const };
-    logAudit({ ts: new Date().toISOString(), tool: "lightning_withdrawal", transport, args_summary: {}, success: false, error_code: msg.code });
+    logAudit({ ts: new Date().toISOString(), tool: "lightning_withdrawal", transport, args_summary: {}, success: false, error_code: msg.code as string | number });
     return result;
   }
 }

package/src/tools/withdrawals.ts

@@ -281,7 +281,11 @@ export function register(
       currency: z.string().min(2).max(10).describe("Currency code (e.g. 'BTC', 'CLP')."),
       amount: z.number().positive().describe("Withdrawal amount."),
       address: z.string().optional().describe("Destination crypto address. Mutually exclusive with bank_account_id."),
-      network: z.string().optional().describe("Blockchain network for crypto withdrawals (e.g. 'bitcoin', 'ethereum')."),
+      network: z
+        .string()
+        .regex(/^[a-z][a-z0-9-]{1,29}$/, "Must be a lowercase alphanumeric network identifier (e.g. 'bitcoin', 'ethereum').")
+        .optional()
+        .describe("Blockchain network for crypto withdrawals (e.g. 'bitcoin', 'ethereum')."),
       bank_account_id: z.number().int().positive().optional().describe("Fiat bank account ID. Mutually exclusive with address."),
       confirmation_token: z
         .string()

package/src/utils.ts

@@ -3,12 +3,18 @@ import type { Amount, OhlcvCandle } from "./types.js";
 
 /**
  * Constant-time string comparison to prevent timing attacks on bearer tokens.
+ * Both strings are written into equal-length buffers before comparing so that
+ * neither token length nor content can be inferred from execution time.
  */
 export function safeTokenEqual(a: string, b: string): boolean {
-  const aBuf = Buffer.from(a);
-  const bBuf = Buffer.from(b);
-  if (aBuf.length !== bBuf.length) return false;
-  return timingSafeEqual(aBuf, bBuf);
+  const aByteLen = Buffer.byteLength(a);
+  const bByteLen = Buffer.byteLength(b);
+  const maxLen = Math.max(aByteLen, bByteLen);
+  const aBuf = Buffer.alloc(maxLen);
+  const bBuf = Buffer.alloc(maxLen);
+  aBuf.write(a);
+  bBuf.write(b);
+  return timingSafeEqual(aBuf, bBuf) && aByteLen === bByteLen;
 }
 
 /**