@humanops/mcp-server 0.3.1 → 0.3.3

package/README.md

@@ -24,7 +24,7 @@ HumanOps bridges the gap between AI capabilities and physical-world actions. Whe
 
 | Variable | Required | Description |
 |----------|----------|-------------|
-| `HUMANOPS_API_KEY` | Yes | Your HumanOps API key |
+| `HUMANOPS_API_KEY` | Yes* | Your HumanOps API key. Not required to run the unauthenticated `register_agent` tool, but required for all other tools. |
 | `HUMANOPS_API_URL` | No | API base URL (default: `https://api.humanops.io`) |
 | `HUMANOPS_DEV_ALLOW_LOCALHOST` | No | Set to `true` to allow `HUMANOPS_API_URL` to be `http://localhost:8787` for local development |
 | `HUMANOPS_ALLOW_ANY_API_HOST` | No | Set to `true` to allow non-`*.humanops.io` API hosts (still blocks private/internal hosts) |
@@ -32,7 +32,15 @@ HumanOps bridges the gap between AI capabilities and physical-world actions. Whe
 
 ## Prerequisites
 
-Before using the MCP server, register your agent via the REST API:
+Register your agent (get an API key) using one of the following:
+
+### Option A: Register via MCP (Recommended)
+
+Call the `register_agent` tool first (no `HUMANOPS_API_KEY` required). It returns an `api_key`.
+
+Then set `HUMANOPS_API_KEY` to that key (restart the MCP server) to use authenticated tools.
+
+### Option B: Register via REST API
 
 ```bash
 curl -X POST https://api.humanops.io/api/v1/agents/register \

package/dist/index.js

@@ -395,23 +395,30 @@ function getApiUrl() {
     }
     return normalized;
 }
-function getApiKey() {
+function getApiKeyOptional() {
     const apiKey = process.env.HUMANOPS_API_KEY?.trim();
-    if (!apiKey) {
-        throw new Error("HUMANOPS_API_KEY environment variable is required.");
-    }
+    if (!apiKey)
+        return null;
     if (!/^ho_(live|test)_[a-zA-Z0-9]{32,}$/.test(apiKey)) {
         console.error("Warning: HUMANOPS_API_KEY does not match expected format (ho_live_... or ho_test_...)");
     }
     return apiKey;
 }
+function getApiKeyRequired() {
+    const apiKey = getApiKeyOptional();
+    if (!apiKey) {
+        throw new Error("HUMANOPS_API_KEY environment variable is required for this tool.");
+    }
+    return apiKey;
+}
 const MCP_REQUEST_TIMEOUT = 30_000;
-async function apiRequest(path, init = {}) {
+async function apiRequest(path, init = {}, opts) {
     const baseUrl = getApiUrl();
-    const apiKey = getApiKey();
     const url = `${baseUrl}${path}`;
     const headers = new Headers(init.headers);
-    headers.set("X-API-Key", apiKey);
+    if (opts?.auth !== false) {
+        headers.set("X-API-Key", getApiKeyRequired());
+    }
     if (!headers.has("Content-Type") && init.body && typeof init.body === "string") {
         headers.set("Content-Type", "application/json");
     }
@@ -515,7 +522,10 @@ const PostTaskInputSchema = z.object({
         lng: z.number(),
         address: z.string().min(1),
     }),
-    reward_usd: z.number().min(MIN_TASK_VALUE_USD).max(MAX_TASK_VALUE_USD),
+    urgency: z.enum(["standard", "priority", "urgent"]).optional(),
+    reward_usd: z.number().min(MIN_TASK_VALUE_USD).max(MAX_TASK_VALUE_USD).optional(),
+    max_budget_usd: z.number().min(MIN_TASK_VALUE_USD).max(MAX_TASK_VALUE_USD).optional(),
+    proposal_deadline_minutes: z.number().int().min(15).max(10080).optional(),
     deadline: z.string().datetime(),
     proof_requirements: z.array(z.string().min(1).max(500)).min(1).max(10),
     task_type: TaskTypeEnum,
@@ -528,10 +538,37 @@ const PostTaskInputSchema = z.object({
         .optional(),
     callback_secret: z.string().min(16).max(128).optional(),
     idempotency_key: z.string().min(1).max(200).optional(),
+}).refine((d) => (d.reward_usd !== undefined || d.max_budget_usd !== undefined) &&
+    !(d.reward_usd !== undefined && d.max_budget_usd !== undefined), {
+    message: "Provide either reward_usd (fixed price) or max_budget_usd (proposal mode), not both",
+    path: ["reward_usd"],
 });
 const GetTaskResultInputSchema = z.object({
     task_id: z.string().min(1),
 });
+const SubmitReviewInputSchema = z.object({
+    task_id: z.string().min(1),
+    rating: z.number().int().min(1).max(10),
+    comment: z.string().min(1).max(1000).optional(),
+});
+const GetOperatorReviewsInputSchema = z.object({
+    operator_id: z.string().min(1),
+});
+const ListProposalsInputSchema = z.object({
+    task_id: z.string().min(1),
+});
+const AwardProposalToolInputSchema = z.object({
+    task_id: z.string().min(1),
+    proposal_id: z.string().min(1),
+});
+const RejectProposalToolInputSchema = z.object({
+    task_id: z.string().min(1),
+    proposal_id: z.string().min(1),
+    reason: z.string().max(200).optional(),
+});
+const CancelProposalWindowInputSchema = z.object({
+    task_id: z.string().min(1),
+});
 const FundAccountInputSchema = z.object({
     amount_usd: z.number().min(MIN_DEPOSIT_USD).max(MAX_DEPOSIT_USD),
     payment_method: z.enum(["usdc", "card", "bank_transfer"]).default("usdc"),
@@ -545,6 +582,20 @@ const FundAccountInputSchema = z.object({
     })
         .optional(),
 });
+const GetWalletChallengeInputSchema = z.object({
+    chain: z.enum(["base"]).optional(),
+});
+const BindWalletInputSchema = z.object({
+    wallet_address: z.string().regex(/^0x[a-fA-F0-9]{40}$/, "Invalid wallet_address (must be a 0x-prefixed address)"),
+    nonce: z.string().min(1).max(200),
+    signature: z.string().min(10).max(5000),
+    chain: z.enum(["base"]).optional(),
+});
+const RegisterAgentInputSchema = z.object({
+    name: z.string().min(1).max(200),
+    email: z.string().email(),
+    company: z.string().min(1).max(200).optional(),
+});
 const RequestPayoutInputSchema = z.object({
     amount_usd: z.number().min(MIN_PAYOUT_USD),
 });
@@ -591,7 +642,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
         },
         {
             name: "post_task",
-            description: "Create a new task for a human operator. Supports physical tasks (VERIFICATION, PHOTO, DELIVERY, INSPECTION), digital tasks (CAPTCHA_SOLVING, FORM_FILLING, etc.), and credential tasks (ACCOUNT_CREATION, API_KEY_PROCUREMENT, etc.). For digital tasks prefer dispatch_digital_task; for credential tasks prefer dispatch_credential_task. Funds will be escrowed from your account (reward + platform fee).",
+            description: "Create a new task for a human operator. Supports physical tasks (VERIFICATION, PHOTO, DELIVERY, INSPECTION), digital tasks (CAPTCHA_SOLVING, FORM_FILLING, etc.), and credential tasks (ACCOUNT_CREATION, API_KEY_PROCUREMENT, etc.). For digital tasks prefer dispatch_digital_task; for credential tasks prefer dispatch_credential_task. Provide either reward_usd (fixed price; escrowed at creation) OR max_budget_usd (proposal mode; escrow created when you award a proposal).",
             inputSchema: {
                 type: "object",
                 properties: {
@@ -602,7 +653,14 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
                         properties: { lat: { type: "number" }, lng: { type: "number" }, address: { type: "string" } },
                         required: ["lat", "lng", "address"],
                     },
-                    reward_usd: { type: "number" },
+                    urgency: {
+                        type: "string",
+                        enum: ["standard", "priority", "urgent"],
+                        description: "Urgency level (standard=24h pickup, priority=4h pickup, urgent=1h pickup + 4h completion SLA).",
+                    },
+                    reward_usd: { type: "number", description: "Fixed-price mode: reward in USD" },
+                    max_budget_usd: { type: "number", description: "Proposal mode: maximum budget in USD (alternative to reward_usd)" },
+                    proposal_deadline_minutes: { type: "number", description: "Proposal window length in minutes (default: 120)" },
                     deadline: { type: "string", description: "ISO 8601 deadline for task completion" },
                     proof_requirements: { type: "array", items: { type: "string" } },
                     task_type: {
@@ -613,7 +671,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
                     callback_secret: { type: "string", description: "Optional secret to sign webhook callbacks" },
                     idempotency_key: { type: "string", description: "Optional key to make task creation safe to retry" },
                 },
-                required: ["title", "description", "location", "reward_usd", "deadline", "proof_requirements", "task_type"],
+                required: ["title", "description", "location", "deadline", "proof_requirements", "task_type"],
             },
         },
         {
@@ -717,6 +775,52 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
                 required: ["task_id"],
             },
         },
+        {
+            name: "submit_review",
+            description: "Submit a 1-10 rating (and optional comment) for the operator on a COMPLETED task. One review per task. Comments are screened for safety.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    task_id: { type: "string", description: "The completed task ID" },
+                    rating: { type: "number", description: "Integer rating 1-10" },
+                    comment: { type: "string", description: "Optional comment (max 1000 chars)" },
+                },
+                required: ["task_id", "rating"],
+            },
+        },
+        {
+            name: "get_operator_reviews",
+            description: "Get an operator's approved reviews and aggregate rating (agent-facing). Useful for building trust signals and choosing operators.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    operator_id: { type: "string", description: "Operator ID" },
+                },
+                required: ["operator_id"],
+            },
+        },
+        {
+            name: "register_agent",
+            description: "Register a new HumanOps agent account. Returns an API key for authentication. You start in SANDBOX tier (tasks auto-complete with simulated operators). Verify your email to upgrade to VERIFIED tier.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    name: { type: "string", description: "Agent name" },
+                    email: { type: "string", description: "Agent email (must be unique)" },
+                    company: { type: "string", description: "Optional company name" },
+                },
+                required: ["name", "email"],
+            },
+        },
+        {
+            name: "get_agent_status",
+            description: "Check your current agent status including tier, email verification, wallet binding, and balances. Also returns clear upgrade steps.",
+            inputSchema: {
+                type: "object",
+                properties: {},
+                required: [],
+            },
+        },
         {
             name: "get_deposit_address",
             description: "Get your USDC deposit address. Send USDC on Base L2 to fund your HumanOps account. This is the recommended way to add funds.",
@@ -726,6 +830,31 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
                 required: [],
             },
         },
+        {
+            name: "get_wallet_challenge",
+            description: "Get a challenge message to sign with your EVM wallet. Sign this message to prove wallet ownership before depositing USDC. In production, wallet binding is required before deposits can be confirmed.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    chain: { type: "string", enum: ["base"], description: "Blockchain network (default: base)" },
+                },
+                required: [],
+            },
+        },
+        {
+            name: "bind_wallet",
+            description: "Bind your EVM wallet after signing the challenge message. This verifies wallet ownership. Required once before confirming USDC deposits in production.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    wallet_address: { type: "string", description: "0x-prefixed EVM address (sender wallet)" },
+                    nonce: { type: "string", description: "Nonce from get_wallet_challenge" },
+                    signature: { type: "string", description: "Signature over the challenge message (personal_sign)" },
+                    chain: { type: "string", enum: ["base"], description: "Blockchain network (default: base)" },
+                },
+                required: ["wallet_address", "nonce", "signature"],
+            },
+        },
         {
             name: "fund_account",
             description: "Add funds to your HumanOps account. **Recommended: use USDC deposits** (default). Send USDC on Base L2 to your deposit address (get it via get_deposit_address), then call this with the tx_hash to verify. Fiat methods (card, bank_transfer) are coming soon.",
@@ -752,7 +881,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
         },
         {
             name: "request_payout",
-            description: "Request a payout of available earnings. Operators can withdraw via USDC on Base L2 through the operator portal or API.",
+            description: "Operator-only: agents cannot request payouts. Use this tool to understand payout options (withdrawals happen in the operator portal / operator API).",
             inputSchema: {
                 type: "object",
                 properties: { amount_usd: { type: "number", description: "Amount to withdraw in USD (min: $10)" } },
@@ -777,6 +906,49 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
                 required: ["task_id"],
             },
         },
+        {
+            name: "list_proposals",
+            description: "List proposals for a proposal-mode task. Use this after creating a task with max_budget_usd.",
+            inputSchema: {
+                type: "object",
+                properties: { task_id: { type: "string", description: "The task ID" } },
+                required: ["task_id"],
+            },
+        },
+        {
+            name: "award_proposal",
+            description: "Award a proposal for a proposal-mode task. This creates escrow at award time and assigns the operator.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    task_id: { type: "string", description: "The task ID" },
+                    proposal_id: { type: "string", description: "The proposal ID to award" },
+                },
+                required: ["task_id", "proposal_id"],
+            },
+        },
+        {
+            name: "reject_proposal",
+            description: "Reject a proposal for a proposal-mode task (optional reason).",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    task_id: { type: "string", description: "The task ID" },
+                    proposal_id: { type: "string", description: "The proposal ID to reject" },
+                    reason: { type: "string", description: "Optional rejection reason" },
+                },
+                required: ["task_id", "proposal_id"],
+            },
+        },
+        {
+            name: "cancel_proposal_window",
+            description: "Close the proposal window by cancelling the task. This is useful when you no longer want proposals for a task in proposal mode.",
+            inputSchema: {
+                type: "object",
+                properties: { task_id: { type: "string", description: "The task ID to cancel" } },
+                required: ["task_id"],
+            },
+        },
         {
             name: "approve_estimate",
             description: "Approve an operator's time estimate for a task. The operator will be notified and can start working. Only works when task status is ESTIMATE_PENDING.",
@@ -895,6 +1067,60 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                 }
                 return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
             }
+            case "register_agent": {
+                const parsed = RegisterAgentInputSchema.safeParse(args);
+                if (!parsed.success) {
+                    return {
+                        content: [{ type: "text", text: `Error: invalid input: ${parsed.error.message}` }],
+                        isError: true,
+                    };
+                }
+                try {
+                    const result = await apiRequest("/api/v1/agents/register", {
+                        method: "POST",
+                        body: JSON.stringify({
+                            name: parsed.data.name,
+                            email: parsed.data.email,
+                            ...(parsed.data.company ? { company: parsed.data.company } : {}),
+                        }),
+                    }, { auth: false });
+                    const apiKey = result && typeof result.api_key === "string" ? result.api_key : null;
+                    const banner = apiKey
+                        ? `CRITICAL — SAVE THIS API KEY:\nHUMANOPS_API_KEY=${apiKey}\n\nRestart your MCP server with this environment variable to use authenticated tools.`
+                        : "Registration succeeded.";
+                    return {
+                        content: [{ type: "text", text: `${banner}\n\n${JSON.stringify(result, null, 2)}` }],
+                    };
+                }
+                catch (err) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: `Error: ${err instanceof Error ? err.message : String(err)}\n\nTip: If you already registered with this email, use a different email address.`,
+                            },
+                        ],
+                        isError: true,
+                    };
+                }
+            }
+            case "get_agent_status": {
+                try {
+                    const result = await apiRequest("/api/v1/agents/status", { method: "GET" });
+                    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+                }
+                catch (err) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: `Error: ${err instanceof Error ? err.message : String(err)}\n\nIf you haven't registered yet, call register_agent first. Otherwise, set HUMANOPS_API_KEY and restart the MCP server.`,
+                            },
+                        ],
+                        isError: true,
+                    };
+                }
+            }
             case "check_verification_status": {
                 const parsed = GetTaskResultInputSchema.safeParse(args);
                 if (!parsed.success) {
@@ -916,17 +1142,112 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                 };
                 return { content: [{ type: "text", text: JSON.stringify(focused, null, 2) }] };
             }
+            case "submit_review": {
+                const parsed = SubmitReviewInputSchema.safeParse(args);
+                if (!parsed.success) {
+                    return {
+                        content: [{ type: "text", text: `Error: invalid input: ${parsed.error.message}` }],
+                        isError: true,
+                    };
+                }
+                const { task_id, rating, comment } = parsed.data;
+                const result = await apiRequest(`/api/v1/tasks/${encodeURIComponent(task_id)}/review`, {
+                    method: "POST",
+                    body: JSON.stringify({ rating, ...(comment ? { comment } : {}) }),
+                });
+                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+            }
+            case "get_operator_reviews": {
+                const parsed = GetOperatorReviewsInputSchema.safeParse(args);
+                if (!parsed.success) {
+                    return {
+                        content: [{ type: "text", text: `Error: invalid input: ${parsed.error.message}` }],
+                        isError: true,
+                    };
+                }
+                const result = await apiRequest(`/api/v1/operators/${encodeURIComponent(parsed.data.operator_id)}/reviews`, {
+                    method: "GET",
+                });
+                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+            }
             case "get_deposit_address": {
                 const result = await apiRequest("/api/v1/agents/deposit-address", {
                     method: "GET",
                 });
+                const obj = result;
+                const walletVerified = Boolean(obj.wallet_verified);
+                const walletAddress = typeof obj.wallet_address === "string" ? obj.wallet_address : null;
+                const walletBound = walletVerified || Boolean(walletAddress);
+                const walletBindingRequired = Boolean(obj.wallet_verification?.required);
+                const instructions = walletBindingRequired
+                    ? (walletBound
+                        ? "Send USDC to this address, then call fund_account with payment_method='usdc', tx_hash, and chain to confirm the deposit."
+                        : "STEP 1: Call get_wallet_challenge to get a signing message. STEP 2: Sign the message with your wallet (personal_sign). STEP 3: Call bind_wallet with wallet_address + nonce + signature. STEP 4: Send USDC. STEP 5: Call fund_account with tx_hash + chain.")
+                    : (walletBound
+                        ? "Send USDC to this address, then call fund_account with tx_hash + chain to confirm the deposit."
+                        : "Wallet binding is optional in dev/test. For production parity, bind your wallet first: get_wallet_challenge → bind_wallet. Then send USDC and confirm via fund_account with tx_hash + chain.");
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify({
+                                ...obj,
+                                wallet_bound: walletBound,
+                                wallet_binding_required: walletBindingRequired,
+                                _instructions: instructions,
+                            }, null, 2),
+                        },
+                    ],
+                };
+            }
+            case "get_wallet_challenge": {
+                const parsed = GetWalletChallengeInputSchema.safeParse(args ?? {});
+                if (!parsed.success) {
+                    return {
+                        content: [{ type: "text", text: `Error: invalid input: ${parsed.error.message}` }],
+                        isError: true,
+                    };
+                }
+                const result = await apiRequest("/api/v1/agents/wallet/challenge", {
+                    method: "POST",
+                    body: JSON.stringify({ chain: parsed.data.chain ?? "base" }),
+                });
                 return {
                     content: [
                         {
                             type: "text",
                             text: JSON.stringify({
                                 ...result,
-                                _instructions: "Send USDC to this address on the specified chain. Production safety: you may need to bind the wallet you deposit from (POST /api/v1/agents/wallet/challenge + PUT /api/v1/agents/wallet) before verifying deposits. After sending, use fund_account with tx_hash + chain to verify.",
+                                _instructions: "Sign the returned message with your wallet using personal_sign. Then call bind_wallet with wallet_address + nonce + signature (and chain if needed).",
+                            }, null, 2),
+                        },
+                    ],
+                };
+            }
+            case "bind_wallet": {
+                const parsed = BindWalletInputSchema.safeParse(args);
+                if (!parsed.success) {
+                    return {
+                        content: [{ type: "text", text: `Error: invalid input: ${parsed.error.message}` }],
+                        isError: true,
+                    };
+                }
+                const result = await apiRequest("/api/v1/agents/wallet", {
+                    method: "PUT",
+                    body: JSON.stringify({
+                        wallet_address: parsed.data.wallet_address,
+                        nonce: parsed.data.nonce,
+                        signature: parsed.data.signature,
+                        chain: parsed.data.chain ?? "base",
+                    }),
+                });
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify({
+                                ...result,
+                                _instructions: "Wallet bound. You can now deposit USDC: call get_deposit_address, send USDC, then call fund_account with tx_hash + chain.",
                             }, null, 2),
                         },
                     ],
@@ -955,6 +1276,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                                 }, null, 2),
                             },
                         ],
+                        isError: true,
                     };
                 }
                 // USDC deposit verification
@@ -970,7 +1292,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                                 text: JSON.stringify({
                                     status: "awaiting_deposit",
                                     ...addressResult,
-                                    message: "No tx_hash provided. Send USDC to the address above. If the API says your deposit wallet is not verified, bind it first via POST /api/v1/agents/wallet/challenge + PUT /api/v1/agents/wallet. Then call fund_account again with tx_hash + chain to verify your deposit.",
+                                    message: "No tx_hash provided. Send USDC to the address above. If the deposit response indicates wallet binding is required, bind your wallet first (get_wallet_challenge → bind_wallet). Then call fund_account again with tx_hash + chain to verify your deposit.",
                                 }, null, 2),
                             },
                         ],
@@ -1005,6 +1327,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                             }, null, 2),
                         },
                     ],
+                    isError: true,
                 };
             }
             case "get_balance": {
@@ -1037,6 +1360,61 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                 });
                 return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
             }
+            case "list_proposals": {
+                const parsed = ListProposalsInputSchema.safeParse(args);
+                if (!parsed.success) {
+                    return {
+                        content: [{ type: "text", text: `Error: invalid input: ${parsed.error.message}` }],
+                        isError: true,
+                    };
+                }
+                const data = await apiRequest(`/api/v1/tasks/${encodeURIComponent(parsed.data.task_id)}/proposals`, {
+                    method: "GET",
+                });
+                return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
+            }
+            case "award_proposal": {
+                const parsed = AwardProposalToolInputSchema.safeParse(args);
+                if (!parsed.success) {
+                    return {
+                        content: [{ type: "text", text: `Error: invalid input: ${parsed.error.message}` }],
+                        isError: true,
+                    };
+                }
+                const result = await apiRequest(`/api/v1/tasks/${encodeURIComponent(parsed.data.task_id)}/award-proposal`, {
+                    method: "POST",
+                    body: JSON.stringify({ proposal_id: parsed.data.proposal_id }),
+                });
+                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+            }
+            case "reject_proposal": {
+                const parsed = RejectProposalToolInputSchema.safeParse(args);
+                if (!parsed.success) {
+                    return {
+                        content: [{ type: "text", text: `Error: invalid input: ${parsed.error.message}` }],
+                        isError: true,
+                    };
+                }
+                const body = parsed.data.reason ? { reason: parsed.data.reason } : {};
+                const result = await apiRequest(`/api/v1/tasks/${encodeURIComponent(parsed.data.task_id)}/proposals/${encodeURIComponent(parsed.data.proposal_id)}/reject`, {
+                    method: "POST",
+                    body: JSON.stringify(body),
+                });
+                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+            }
+            case "cancel_proposal_window": {
+                const parsed = CancelProposalWindowInputSchema.safeParse(args);
+                if (!parsed.success) {
+                    return {
+                        content: [{ type: "text", text: `Error: invalid input: ${parsed.error.message}` }],
+                        isError: true,
+                    };
+                }
+                const result = await apiRequest(`/api/v1/tasks/${encodeURIComponent(parsed.data.task_id)}/cancel`, {
+                    method: "POST",
+                });
+                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+            }
             case "approve_estimate": {
                 const parsed = GetTaskResultInputSchema.safeParse(args);
                 if (!parsed.success) {
@@ -1186,17 +1564,22 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                 const response = {
                     ...result,
                     private_key: keyPair.privateKey,
-                    _notice: "IMPORTANT: Save the private_key securely. You need it to decrypt the credential using retrieve_credential.",
+                    _notice: "Save the private_key securely. It is required to decrypt the credential using retrieve_credential. If lost, the credential is unrecoverable (single-read).",
                 };
+                const warningText = `CRITICAL — SAVE THIS PRIVATE KEY:\n` +
+                    `private_key: ${keyPair.privateKey}\n\n` +
+                    `You MUST store this key securely. It is required to decrypt the credential\n` +
+                    `via retrieve_credential. If lost, the credential is unrecoverable (single-read).\n\n` +
+                    `${JSON.stringify(response, null, 2)}`;
                 const credResultObj = result;
                 if (credResultObj.sandbox) {
                     return {
                         content: [
-                            { type: "text", text: `SANDBOX MODE: ${credResultObj.sandbox_notice ?? "This credential task will auto-complete with simulated data. No real credentials will be delivered."}\n\n${JSON.stringify(response, null, 2)}` },
+                            { type: "text", text: `SANDBOX MODE: ${credResultObj.sandbox_notice ?? "This credential task will auto-complete with simulated data. No real credentials will be delivered."}\n\n${warningText}` },
                         ],
                     };
                 }
-                return { content: [{ type: "text", text: JSON.stringify(response, null, 2) }] };
+                return { content: [{ type: "text", text: warningText }] };
             }
             case "retrieve_credential": {
                 const parsed = RetrieveCredentialInputSchema.safeParse(args);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@humanops/mcp-server",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "mcpName": "io.github.thepianistdirector/humanops",
   "description": "MCP server for AI agents to dispatch real-world tasks to verified human operators via HumanOps",
   "type": "module",