@helm-protocol/ttt-mcp 0.1.8 → 0.2.1

package/LICENSE

@@ -1,21 +1,22 @@
-MIT License
+Business Source License 1.1
 
-Copyright (c) 2026 Helm Protocol Foundation
+Parameters
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
+Licensor: Heime-Jorgen (Peter Jang)
+Licensed Work: @helm-protocol/ttt-mcp
+Change Date: 2029-05-28
+Change License: Apache License, Version 2.0
 
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
+Additional Use Grant:
+The following uses are permitted without a commercial license:
+- Non-commercial use (research, education, personal projects)
+- Commercial use generating less than $10,000 USD/year in revenue
+- Individual MEV bots or arbitrage bots operated for personal account
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+For all other commercial use, a license is required. See:
+https://kenosian.com/pricing
+
+---
+
+Business Source License 1.1 terms apply. The full text is available at:
+https://mariadb.com/bsl11/

package/README.md

@@ -144,6 +144,47 @@ Config file locations:
 - Node.js >= 18
 - Network access for time synthesis (HTTPS to time.nist.gov, time.google.com, time.cloudflare.com)
 
+## TypeScript: MEV Bot Integration
+
+```typescript
+import { McpClient } from "@modelcontextprotocol/sdk/client/mcp.js";
+
+// Generate a Proof of Time for a transaction
+const result = await client.callTool({
+  name: "pot_generate",
+  arguments: {
+    txHash: "0xabc123...",
+    chainId: 8453,
+    poolAddress: "0xdef456..."
+  }
+});
+// Returns: { potHash, timestamp, stratum, grg_shards }
+```
+
+## Python: Hedge Fund Audit
+
+```python
+import subprocess, json
+
+result = subprocess.run(
+    ["npx", "-y", "@helm-protocol/ttt-mcp"],
+    input=json.dumps({
+        "tool": "pot_verify",
+        "potHash": "0x...",
+        "expectedChainId": 8453
+    }),
+    capture_output=True, text=True
+)
+```
+
+## Rate Limits & Pricing
+
+```
+Free Tier:   100 calls/day per IP — no API key needed
+Paid Tier:   Set TTT_API_KEY env var — unlimited
+Commercial:  peter@kenosian.com (hedge funds, DEX protocols, OTC desks)
+```
+
 ## Learn More
 
 - [OpenTTT SDK](https://www.npmjs.com/package/openttt) — The underlying SDK
@@ -152,4 +193,4 @@ Config file locations:
 
 ## License
 
-MIT
+BSL-1.1

package/dist/auth.js

@@ -1,9 +1,7 @@
 "use strict";
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -17,241 +15,52 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var auth_exports = {};
 __export(auth_exports, {
-  AUTH_ERROR_MESSAGE: () => AUTH_ERROR_MESSAGE,
-  verifyHelmApiKey: () => verifyHelmApiKey
+  checkRateLimit: () => checkRateLimit,
+  resolveApiKey: () => resolveApiKey
 });
 module.exports = __toCommonJS(auth_exports);
-var import_crypto = require("crypto");
-var https = __toESM(require("https"));
-var import_crypto2 = require("crypto");
-const HELM_PUBLIC_KEY_B64 = process.env.HELM_PUBLIC_KEY ?? "PLACEHOLDER_REPLACE_BEFORE_DEPLOY";
-const HELM_AUTH_SERVER_URL = process.env.HELM_AUTH_SERVER_URL;
-if (HELM_AUTH_SERVER_URL !== void 0) {
-  if (!HELM_AUTH_SERVER_URL.startsWith("https://")) {
-    throw new Error(
-      "[ttt-mcp] HELM_AUTH_SERVER_URL must use HTTPS (got: " + HELM_AUTH_SERVER_URL + "). Refusing to start to protect API keys in transit."
-    );
-  }
-}
-const CLIENT_VERSION = "0.2.0";
-const authCache = /* @__PURE__ */ new Map();
-function getCached(apiKey, toolName) {
-  const key = `${apiKey}:${toolName}`;
-  const entry = authCache.get(key);
-  if (!entry) return null;
-  if (Date.now() > entry.expiresAt) {
-    authCache.delete(key);
-    return null;
-  }
-  return entry;
-}
-function setCached(apiKey, toolName, allowed, planTier, cacheTtlMs) {
-  const key = `${apiKey}:${toolName}`;
-  authCache.set(key, {
-    allowed,
-    planTier,
-    expiresAt: Date.now() + cacheTtlMs
-  });
-}
-const CIRCUIT_FAILURE_THRESHOLD = 3;
-const CIRCUIT_OPEN_DURATION_MS = 5 * 60 * 1e3;
-const circuit = {
-  state: "CLOSED",
-  consecutiveFailures: 0,
-  openedAt: 0
-};
-function circuitRecordSuccess() {
-  circuit.consecutiveFailures = 0;
-  circuit.state = "CLOSED";
-}
-function circuitRecordFailure() {
-  circuit.consecutiveFailures += 1;
-  if (circuit.consecutiveFailures >= CIRCUIT_FAILURE_THRESHOLD) {
-    circuit.state = "OPEN";
-    circuit.openedAt = Date.now();
-  }
-}
-function circuitCanAttempt() {
-  if (circuit.state === "CLOSED") return true;
-  if (circuit.state === "OPEN") {
-    if (Date.now() - circuit.openedAt >= CIRCUIT_OPEN_DURATION_MS) {
-      circuit.state = "HALF_OPEN";
-      return true;
-    }
-    return false;
-  }
-  return true;
+const FREE_TIER_LIMIT = parseInt(process.env.FREE_TIER_LIMIT ?? "100", 10);
+const buckets = /* @__PURE__ */ new Map();
+function nextMidnightUtc() {
+  const now = /* @__PURE__ */ new Date();
+  const midnight = new Date(
+    Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate() + 1)
+  );
+  return midnight.getTime();
 }
-function callAuthServer(serverUrl, apiKey, toolName) {
-  return new Promise((resolve, reject) => {
-    const requestId = (0, import_crypto2.randomUUID)();
-    const body = JSON.stringify({
-      api_key: apiKey,
-      tool_name: toolName,
-      request_id: requestId,
-      timestamp_ms: Date.now(),
-      client_version: CLIENT_VERSION
-    });
-    const url = new URL("/v1/auth/verify", serverUrl);
-    const options = {
-      hostname: url.hostname,
-      port: url.port || 443,
-      path: url.pathname,
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        "Content-Length": Buffer.byteLength(body),
-        "X-Request-ID": requestId
-      }
-    };
-    const req = https.request(options, (res) => {
-      let data = "";
-      res.on("data", (chunk) => {
-        data += chunk.toString();
-      });
-      res.on("end", () => {
-        try {
-          const parsed = JSON.parse(data);
-          resolve(parsed);
-        } catch {
-          reject(new Error("Auth server returned non-JSON response"));
-        }
-      });
-    });
-    req.setTimeout(3e3, () => {
-      req.destroy(new Error("Auth server request timed out (3000ms)"));
-    });
-    req.on("error", (err) => {
-      reject(err);
-    });
-    req.write(body);
-    req.end();
-  });
-}
-async function serverSideGate(apiKey, toolName) {
-  if (!HELM_AUTH_SERVER_URL) {
-    return null;
-  }
-  const cached = getCached(apiKey, toolName);
-  if (cached !== null) {
-    if (!cached.allowed) {
-      return `Access denied by Helm Auth Server (plan: ${cached.planTier}, cached)`;
-    }
-    return null;
-  }
-  if (!circuitCanAttempt()) {
-    return "Helm Auth Server is temporarily unreachable. Access denied (fail-closed). Please retry in a few minutes.";
-  }
-  try {
-    const resp = await callAuthServer(HELM_AUTH_SERVER_URL, apiKey, toolName);
-    const ttl = typeof resp.cache_ttl_ms === "number" && resp.cache_ttl_ms > 0 ? resp.cache_ttl_ms : 3e5;
-    setCached(apiKey, toolName, resp.allowed, resp.plan_tier ?? "unknown", ttl);
-    circuitRecordSuccess();
-    if (!resp.allowed) {
-      const reason = resp.reason ? ` Reason: ${resp.reason}` : "";
-      return `Access denied by Helm Auth Server (plan: ${resp.plan_tier}).${reason}`;
-    }
-    return null;
-  } catch {
-    circuitRecordFailure();
-    return "Helm Auth Server is unreachable. Access denied (fail-closed). Please retry later.";
+function checkRateLimit(apiKey, clientIp) {
+  if (apiKey && apiKey.trim().length > 0) {
+    return { allowed: true, remaining: -1, tier: "paid" };
   }
-}
-async function verifyHelmApiKey(apiKey, opts) {
-  if (!apiKey) {
-    return { valid: false, error: "No API key provided" };
-  }
-  if (!apiKey.startsWith("hk-")) {
-    return { valid: false, error: "Invalid key format" };
-  }
-  if (HELM_PUBLIC_KEY_B64 === "PLACEHOLDER_REPLACE_BEFORE_DEPLOY") {
-    if (process.env.HELM_DEV_MODE === "true") {
-      return { valid: true, tier: 0, orgId: "dev-mode" };
-    }
-    return { valid: false, error: "Server misconfiguration: HELM_PUBLIC_KEY not set" };
+  const bucketKey = `ip:${clientIp}`;
+  const now = Date.now();
+  let entry = buckets.get(bucketKey);
+  if (!entry || now >= entry.resetAt) {
+    entry = { count: 0, resetAt: nextMidnightUtc() };
+    buckets.set(bucketKey, entry);
   }
-  const jwt = apiKey.slice(3);
-  const parts = jwt.split(".");
-  if (parts.length !== 3) {
-    return { valid: false, error: "Malformed JWT" };
-  }
-  try {
-    const payload = JSON.parse(
-      Buffer.from(parts[1], "base64url").toString("utf8")
-    );
-    if (typeof payload.exp !== "number" || payload.exp < Math.floor(Date.now() / 1e3)) {
-      return { valid: false, error: "Key expired" };
-    }
-    if (payload.iss !== "helm-protocol") {
-      return { valid: false, error: "Invalid issuer" };
-    }
-    const publicKey = (0, import_crypto.createPublicKey)({
-      key: Buffer.from(HELM_PUBLIC_KEY_B64, "base64"),
-      format: "der",
-      type: "spki"
-    });
-    const sigInput = Buffer.from(`${parts[0]}.${parts[1]}`);
-    const sig = Buffer.from(parts[2], "base64url");
-    const isValid = (0, import_crypto.verify)(null, sigInput, publicKey, sig);
-    if (!isValid) {
-      return { valid: false, error: "Invalid signature" };
-    }
-    if (opts?.redisClient && payload.type === "short" && payload.jti) {
-      const redisKey = `helm:jti:${payload.jti}`;
-      const ttl = Math.max(
-        1,
-        payload.exp - Math.floor(Date.now() / 1e3)
-      );
-      const isNew = await opts.redisClient.set(redisKey, "1", {
-        NX: true,
-        EX: ttl
-      });
-      if (isNew === null) {
-        opts.onReplayDetected?.(payload.jti);
-        return { valid: false, error: "Replay detected" };
-      }
-    }
-    if (opts?.toolName) {
-      const gateError = await serverSideGate(apiKey, opts.toolName);
-      if (gateError !== null) {
-        return { valid: false, error: gateError };
-      }
-    }
+  if (entry.count >= FREE_TIER_LIMIT) {
     return {
-      valid: true,
-      tier: typeof payload.tier === "number" ? payload.tier : 0,
-      orgId: payload.sub
+      allowed: false,
+      remaining: 0,
+      tier: "free"
     };
-  } catch {
-    return { valid: false, error: "Verification error" };
   }
+  entry.count += 1;
+  return {
+    allowed: true,
+    remaining: FREE_TIER_LIMIT - entry.count,
+    tier: "free"
+  };
+}
+function resolveApiKey(headerValue) {
+  return headerValue?.trim() || process.env.TTT_API_KEY?.trim() || void 0;
 }
-const AUTH_ERROR_MESSAGE = `This tool requires a Helm Protocol API key.
-
-To get access:
-  1. Contact enterprise@helmprotocol.io
-  2. Add the key to your MCP config:
-     { "env": { "HELM_API_KEY": "hk-..." } }
-
-Optional server-side validation:
-  Set HELM_AUTH_SERVER_URL=https://auth.helm-protocol.com for additional
-  server-side gate (quota enforcement, revocation, plan tier checks).
-  HTTPS is required \u2014 HTTP URLs are rejected at startup.
-
-Free tools available without a key: pot_health, pot_stats`;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  AUTH_ERROR_MESSAGE,
-  verifyHelmApiKey
+  checkRateLimit,
+  resolveApiKey
 });