@jaw.id/cli 0.1.15 → 0.1.17

package/dist/mcp/handlers/resources.js

@@ -2,8 +2,9 @@ import { ResourceTemplate } from '@modelcontextprotocol/sdk/server/mcp.js';
 
 // src/mcp/handlers/resources.ts
 var DOCS_BASE = "https://docs.jaw.id/api-reference";
+var FETCH_TIMEOUT_MS = 15e3;
 async function fetchDocs(url) {
-  const res = await fetch(url);
+  const res = await fetch(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
   if (!res.ok) {
     throw new Error(`Failed to fetch docs: ${res.status} ${res.statusText}`);
   }
@@ -11,7 +12,7 @@ async function fetchDocs(url) {
   return html.replace(/<script[^>]*>[\s\S]*?<\/script>/gi, "").replace(/<style[^>]*>[\s\S]*?<\/style>/gi, "").replace(/<[^>]+>/g, " ").replace(/&nbsp;/g, " ").replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/\s{2,}/g, " ").trim();
 }
 function registerResources(server) {
-  server.resource(
+  server.registerResource(
     "api-reference",
     "jaw://api-reference",
     {
@@ -28,7 +29,7 @@ function registerResources(server) {
       ]
     })
   );
-  server.resource(
+  server.registerResource(
     "api-reference-method",
     new ResourceTemplate("jaw://api-reference/{method}", { list: void 0 }),
     {

package/dist/mcp/handlers/resources.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/mcp/handlers/resources.ts"],"names":[],"mappings":";;;AAEA,IAAM,SAAA,GAAY,mCAAA;AAElB,eAAe,UAAU,GAAA,EAA8B;AACrD,EAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAG,CAAA;AAC3B,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,MAAM,CAAA,sBAAA,EAAyB,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EACzE;AACA,EAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAG5B,EAAA,OAAO,KACJ,OAAA,CAAQ,mCAAA,EAAqC,EAAE,CAAA,CAC/C,OAAA,CAAQ,mCAAmC,EAAE,CAAA,CAC7C,OAAA,CAAQ,UAAA,EAAY,GAAG,CAAA,CACvB,OAAA,CAAQ,WAAW,GAAG,CAAA,CACtB,QAAQ,QAAA,EAAU,GAAG,CAAA,CACrB,OAAA,CAAQ,SAAS,GAAG,CAAA,CACpB,QAAQ,OAAA,EAAS,GAAG,EACpB,OAAA,CAAQ,SAAA,EAAW,GAAG,CAAA,CACtB,OAAA,CAAQ,UAAU,GAAG,CAAA,CACrB,QAAQ,SAAA,EAAW,GAAG,EACtB,IAAA,EAAK;AACV;AAEO,SAAS,kBAAkB,MAAA,EAAyB;AAEzD,EAAA,MAAA,CAAO,QAAA;AAAA,IACL,eAAA;AAAA,IACA,qBAAA;AAAA,IACA;AAAA,MACE,WAAA,EACE,yJAAA;AAAA,MAEF,QAAA,EAAU;AAAA,KACZ;AAAA,IACA,aAAa;AAAA,MACX,QAAA,EAAU;AAAA,QACR;AAAA,UACE,GAAA,EAAK,qBAAA;AAAA,UACL,QAAA,EAAU,YAAA;AAAA,UACV,IAAA,EAAM,MAAM,SAAA,CAAU,SAAS;AAAA;AACjC;AACF,KACF;AAAA,GACF;AAGA,EAAA,MAAA,CAAO,QAAA;AAAA,IACL,sBAAA;AAAA,IACA,IAAI,gBAAA,CAAiB,8BAAA,EAAgC,EAAE,IAAA,EAAM,QAAW,CAAA;AAAA,IACxE;AAAA,MACE,WAAA,EACE,2MAAA;AAAA,MAGF,QAAA,EAAU;AAAA,KACZ;AAAA,IACA,OAAO,KAAK,SAAA,KAAc;AACxB,MAAA,MAAM,MAAA,GAAS,MAAA,CAAO,SAAA,CAAU,MAAM,CAAA;AAGtC,MAAA,IAAI,CAAC,UAAA,CAAW,IAAA,CAAK,MAAM,CAAA,EAAG;AAC5B,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,MAAM,CAAA,gDAAA,CAAkD,CAAA;AAAA,MACnG;AAEA,MAAA,OAAO;AAAA,QACL,QAAA,EAAU;AAAA,UACR;AAAA,YACE,KAAK,GAAA,CAAI,IAAA;AAAA,YACT,QAAA,EAAU,YAAA;AAAA,YACV,MAAM,MAAM,SAAA,CAAU,GAAG,SAAS,CAAA,CAAA,EAAI,MAAM,CAAA,CAAE;AAAA;AAChD;AACF,OACF;AAAA,IACF;AAAA,GACF;AACF","file":"resources.js","sourcesContent":["import { type McpServer, ResourceTemplate } from '@modelcontextprotocol/sdk/server/mcp.js';\n\nconst DOCS_BASE = 'https://docs.jaw.id/api-reference';\n\nasync function fetchDocs(url: string): Promise<string> {\n  const res = await fetch(url);\n  if (!res.ok) {\n    throw new Error(`Failed to fetch docs: ${res.status} ${res.statusText}`);\n  }\n  const html = await res.text();\n  // Strip HTML tags for a readable text representation.\n  // MCP resources are consumed by LLMs, so plain text is ideal.\n  return html\n    .replace(/<script[^>]*>[\\s\\S]*?<\\/script>/gi, '')\n    .replace(/<style[^>]*>[\\s\\S]*?<\\/style>/gi, '')\n    .replace(/<[^>]+>/g, ' ')\n    .replace(/&nbsp;/g, ' ')\n    .replace(/&amp;/g, '&')\n    .replace(/&lt;/g, '<')\n    .replace(/&gt;/g, '>')\n    .replace(/&quot;/g, '\"')\n    .replace(/&#39;/g, \"'\")\n    .replace(/\\s{2,}/g, ' ')\n    .trim();\n}\n\nexport function registerResources(server: McpServer): void {\n  // Overview of all RPC methods\n  server.resource(\n    'api-reference',\n    'jaw://api-reference',\n    {\n      description:\n        'JAW.id API reference — lists all supported RPC methods with descriptions. ' +\n        'Read this before using the jaw_rpc tool to understand available methods.',\n      mimeType: 'text/plain',\n    },\n    async () => ({\n      contents: [\n        {\n          uri: 'jaw://api-reference',\n          mimeType: 'text/plain',\n          text: await fetchDocs(DOCS_BASE),\n        },\n      ],\n    })\n  );\n\n  // Per-method documentation with parameter details\n  server.resource(\n    'api-reference-method',\n    new ResourceTemplate('jaw://api-reference/{method}', { list: undefined }),\n    {\n      description:\n        'Detailed documentation for a specific RPC method including parameters, ' +\n        'request/response format, and examples. Use the method name from the ' +\n        'api-reference overview (e.g. wallet_sendCalls, personal_sign).',\n      mimeType: 'text/plain',\n    },\n    async (uri, variables) => {\n      const method = String(variables.method);\n\n      // Validate method name to prevent path traversal (e.g. ../../admin)\n      if (!/^[\\w_]+$/.test(method)) {\n        throw new Error(`Invalid method name: \"${method}\". Expected an RPC method like wallet_sendCalls.`);\n      }\n\n      return {\n        contents: [\n          {\n            uri: uri.href,\n            mimeType: 'text/plain',\n            text: await fetchDocs(`${DOCS_BASE}/${method}`),\n          },\n        ],\n      };\n    }\n  );\n}\n"]}
+{"version":3,"sources":["../../../src/mcp/handlers/resources.ts"],"names":[],"mappings":";;;AAEA,IAAM,SAAA,GAAY,mCAAA;AAElB,IAAM,gBAAA,GAAmB,IAAA;AAEzB,eAAe,UAAU,GAAA,EAA8B;AACrD,EAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,QAAQ,WAAA,CAAY,OAAA,CAAQ,gBAAgB,CAAA,EAAG,CAAA;AAC9E,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,MAAM,CAAA,sBAAA,EAAyB,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EACzE;AACA,EAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAG5B,EAAA,OAAO,KACJ,OAAA,CAAQ,mCAAA,EAAqC,EAAE,CAAA,CAC/C,OAAA,CAAQ,mCAAmC,EAAE,CAAA,CAC7C,OAAA,CAAQ,UAAA,EAAY,GAAG,CAAA,CACvB,OAAA,CAAQ,WAAW,GAAG,CAAA,CACtB,QAAQ,QAAA,EAAU,GAAG,CAAA,CACrB,OAAA,CAAQ,SAAS,GAAG,CAAA,CACpB,QAAQ,OAAA,EAAS,GAAG,EACpB,OAAA,CAAQ,SAAA,EAAW,GAAG,CAAA,CACtB,OAAA,CAAQ,UAAU,GAAG,CAAA,CACrB,QAAQ,SAAA,EAAW,GAAG,EACtB,IAAA,EAAK;AACV;AAEO,SAAS,kBAAkB,MAAA,EAAyB;AAEzD,EAAA,MAAA,CAAO,gBAAA;AAAA,IACL,eAAA;AAAA,IACA,qBAAA;AAAA,IACA;AAAA,MACE,WAAA,EACE,yJAAA;AAAA,MAEF,QAAA,EAAU;AAAA,KACZ;AAAA,IACA,aAAa;AAAA,MACX,QAAA,EAAU;AAAA,QACR;AAAA,UACE,GAAA,EAAK,qBAAA;AAAA,UACL,QAAA,EAAU,YAAA;AAAA,UACV,IAAA,EAAM,MAAM,SAAA,CAAU,SAAS;AAAA;AACjC;AACF,KACF;AAAA,GACF;AAGA,EAAA,MAAA,CAAO,gBAAA;AAAA,IACL,sBAAA;AAAA,IACA,IAAI,gBAAA,CAAiB,8BAAA,EAAgC,EAAE,IAAA,EAAM,QAAW,CAAA;AAAA,IACxE;AAAA,MACE,WAAA,EACE,2MAAA;AAAA,MAGF,QAAA,EAAU;AAAA,KACZ;AAAA,IACA,OAAO,KAAK,SAAA,KAAc;AACxB,MAAA,MAAM,MAAA,GAAS,MAAA,CAAO,SAAA,CAAU,MAAM,CAAA;AAGtC,MAAA,IAAI,CAAC,UAAA,CAAW,IAAA,CAAK,MAAM,CAAA,EAAG;AAC5B,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,MAAM,CAAA,gDAAA,CAAkD,CAAA;AAAA,MACnG;AAEA,MAAA,OAAO;AAAA,QACL,QAAA,EAAU;AAAA,UACR;AAAA,YACE,KAAK,GAAA,CAAI,IAAA;AAAA,YACT,QAAA,EAAU,YAAA;AAAA,YACV,MAAM,MAAM,SAAA,CAAU,GAAG,SAAS,CAAA,CAAA,EAAI,MAAM,CAAA,CAAE;AAAA;AAChD;AACF,OACF;AAAA,IACF;AAAA,GACF;AACF","file":"resources.js","sourcesContent":["import { type McpServer, ResourceTemplate } from '@modelcontextprotocol/sdk/server/mcp.js';\n\nconst DOCS_BASE = 'https://docs.jaw.id/api-reference';\n\nconst FETCH_TIMEOUT_MS = 15_000;\n\nasync function fetchDocs(url: string): Promise<string> {\n  const res = await fetch(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });\n  if (!res.ok) {\n    throw new Error(`Failed to fetch docs: ${res.status} ${res.statusText}`);\n  }\n  const html = await res.text();\n  // Strip HTML tags for a readable text representation.\n  // MCP resources are consumed by LLMs, so plain text is ideal.\n  return html\n    .replace(/<script[^>]*>[\\s\\S]*?<\\/script>/gi, '')\n    .replace(/<style[^>]*>[\\s\\S]*?<\\/style>/gi, '')\n    .replace(/<[^>]+>/g, ' ')\n    .replace(/&nbsp;/g, ' ')\n    .replace(/&amp;/g, '&')\n    .replace(/&lt;/g, '<')\n    .replace(/&gt;/g, '>')\n    .replace(/&quot;/g, '\"')\n    .replace(/&#39;/g, \"'\")\n    .replace(/\\s{2,}/g, ' ')\n    .trim();\n}\n\nexport function registerResources(server: McpServer): void {\n  // Overview of all RPC methods\n  server.registerResource(\n    'api-reference',\n    'jaw://api-reference',\n    {\n      description:\n        'JAW.id API reference — lists all supported RPC methods with descriptions. ' +\n        'Read this before using the jaw_rpc tool to understand available methods.',\n      mimeType: 'text/plain',\n    },\n    async () => ({\n      contents: [\n        {\n          uri: 'jaw://api-reference',\n          mimeType: 'text/plain',\n          text: await fetchDocs(DOCS_BASE),\n        },\n      ],\n    })\n  );\n\n  // Per-method documentation with parameter details\n  server.registerResource(\n    'api-reference-method',\n    new ResourceTemplate('jaw://api-reference/{method}', { list: undefined }),\n    {\n      description:\n        'Detailed documentation for a specific RPC method including parameters, ' +\n        'request/response format, and examples. Use the method name from the ' +\n        'api-reference overview (e.g. wallet_sendCalls, personal_sign).',\n      mimeType: 'text/plain',\n    },\n    async (uri, variables) => {\n      const method = String(variables.method);\n\n      // Validate method name to prevent path traversal (e.g. ../../admin)\n      if (!/^[\\w_]+$/.test(method)) {\n        throw new Error(`Invalid method name: \"${method}\". Expected an RPC method like wallet_sendCalls.`);\n      }\n\n      return {\n        contents: [\n          {\n            uri: uri.href,\n            mimeType: 'text/plain',\n            text: await fetchDocs(`${DOCS_BASE}/${method}`),\n          },\n        ],\n      };\n    }\n  );\n}\n"]}

package/dist/mcp/handlers/rpc.js

@@ -13,10 +13,13 @@ var rpcMethodSchema = {
   params: z.any().optional().describe(
     "Method parameters \u2014 structure varies by method. Read the jaw://api-reference/{method} resource for the expected format."
   ),
-  chainId: z.number().optional().describe("Target chain ID (overrides default). E.g., 1 for Ethereum, 8453 for Base, 84532 for Base Sepolia")
+  chainId: z.number().optional().describe("Target chain ID (overrides default). E.g., 1 for Ethereum, 8453 for Base, 84532 for Base Sepolia"),
+  session: z.boolean().optional().describe(
+    "Sign with the local session key instead of opening the browser (requires `jaw session setup`; check jaw_session_status first). Supported methods only: eth_requestAccounts, eth_accounts, wallet_sendCalls, wallet_getCallsStatus, personal_sign, eth_signTypedData_v4. Defaults to the JAW_SESSION env var."
+  )
 };
 ({
-  key: z.enum(["apiKey", "defaultChain", "keysUrl", "ens", "relayUrl"]).describe("Config key"),
+  key: z.enum(["apiKey", "defaultChain", "keysUrl", "ens", "relayUrl", "sessionExpiry"]).describe("Config key"),
   value: z.string().describe("Config value")
 });
 
@@ -485,10 +488,6 @@ function safeParse(data) {
     return null;
   }
 }
-
-// src/lib/bridge-singleton.ts
-var DEFAULT_KEYS_URL = "https://keys.jaw.id";
-var DEFAULT_RELAY_URL = "wss://relay.jaw.id";
 function loadRelaySession() {
   try {
     if (!fs.existsSync(PATHS.relay)) return null;
@@ -515,6 +514,10 @@ function deleteRelaySession() {
   } catch {
   }
 }
+
+// src/lib/bridge-singleton.ts
+var DEFAULT_KEYS_URL = "https://keys.jaw.id";
+var DEFAULT_RELAY_URL = "wss://relay.jaw.id";
 async function getBridge(options) {
   const config = loadConfig();
   const keysUrl = options.keysUrl ?? config.keysUrl ?? DEFAULT_KEYS_URL;
@@ -592,39 +595,205 @@ function buildBridgeUrl(keysUrl, session, relayUrl, cliPublicKeyHex) {
   url.hash = `pk=${cliPublicKeyHex}`;
   return url.toString();
 }
+function loadSessionKey() {
+  if (!fs.existsSync(PATHS.keystore)) {
+    throw new Error("No session configured. Run `jaw session setup` first.");
+  }
+  const contents = fs.readFileSync(PATHS.keystore, "utf-8");
+  let parsed;
+  try {
+    parsed = JSON.parse(contents);
+  } catch {
+    throw new Error(`Keystore at ${PATHS.keystore} is corrupted. Run \`jaw session setup\` to recreate it.`);
+  }
+  return parsed.privateKey;
+}
+function loadSessionConfig() {
+  if (!fs.existsSync(PATHS.sessionConfig)) {
+    throw new Error("No session configured. Run `jaw session setup` first.");
+  }
+  const raw = fs.readFileSync(PATHS.sessionConfig, "utf-8");
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw new Error(`Session config at ${PATHS.sessionConfig} is corrupted. Run \`jaw session setup\` to recreate it.`);
+  }
+}
+
+// src/lib/session-bridge.ts
+var SessionBridge = class {
+  options;
+  session = null;
+  constructor(options) {
+    this.options = { ...options };
+    if (!this.options.paymasterUrl) {
+      const config = loadConfig();
+      const pm = config.paymasters?.[this.options.chainId];
+      if (pm) {
+        this.options.paymasterUrl = pm.url;
+        this.options.paymasterContext = pm.context;
+      }
+    }
+  }
+  async getSession() {
+    if (this.session) {
+      this.checkExpiry(this.session.config);
+      return this.session;
+    }
+    const config = loadSessionConfig();
+    this.checkExpiry(config);
+    if (config.chainId !== this.options.chainId) {
+      throw new Error(
+        `Session was created for chain ${config.chainId}, but --chain ${this.options.chainId} was requested. Run \`jaw session setup --chain ${this.options.chainId}\` to create a session for that chain.`
+      );
+    }
+    let privateKeyHex = loadSessionKey();
+    const { privateKeyToAccount } = await import('viem/accounts');
+    const localAccount = privateKeyToAccount(privateKeyHex);
+    privateKeyHex = null;
+    const { Account } = await import('@jaw.id/core');
+    const account = await Account.fromLocalAccount(
+      {
+        chainId: this.options.chainId,
+        apiKey: this.options.apiKey,
+        paymasterUrl: this.options.paymasterUrl,
+        paymasterContext: this.options.paymasterContext
+      },
+      localAccount
+    );
+    this.session = { account, config };
+    return this.session;
+  }
+  checkExpiry(config) {
+    if (config.expiry <= Date.now() / 1e3) {
+      const expiryDate = new Date(config.expiry * 1e3).toISOString();
+      throw new Error(`Session expired on ${expiryDate}. Run \`jaw session setup\` to create a new session.`);
+    }
+  }
+  async request(method, params) {
+    const { account, config } = await this.getSession();
+    switch (method) {
+      case "eth_requestAccounts":
+      case "eth_accounts":
+        return [config.sessionAddress];
+      case "wallet_sendCalls": {
+        const payload = Array.isArray(params) ? params[0] : params;
+        const { calls } = payload;
+        return account.sendCalls(calls, {
+          permissionId: config.permissionId
+        });
+      }
+      case "wallet_getCallsStatus": {
+        const batchId = Array.isArray(params) ? params[0] : params;
+        return account.getCallStatus(batchId);
+      }
+      case "personal_sign": {
+        const message = Array.isArray(params) ? params[0] : params;
+        return account.signMessage(message);
+      }
+      case "eth_signTypedData_v4": {
+        const asArray = Array.isArray(params) ? params : [params];
+        const raw = asArray.length > 1 ? asArray[1] : asArray[0];
+        const typedData = typeof raw === "string" ? JSON.parse(raw) : raw;
+        return account.signTypedData(typedData);
+      }
+      case "wallet_grantPermissions":
+        throw new Error("Requires browser \u2014 run `jaw session setup`.");
+      case "wallet_revokePermissions":
+        throw new Error("Requires browser \u2014 run `jaw session revoke`.");
+      default:
+        throw new Error(`Method ${method} is not supported in auto mode.`);
+    }
+  }
+  close() {
+  }
+};
+
+// src/lib/rpc-classifier.ts
+var SESSION_SUPPORTED_METHODS = /* @__PURE__ */ new Set([
+  "eth_requestAccounts",
+  "eth_accounts",
+  "wallet_sendCalls",
+  "wallet_getCallsStatus",
+  "personal_sign",
+  "eth_signTypedData_v4"
+]);
+function supportsSessionMode(method) {
+  return SESSION_SUPPORTED_METHODS.has(method);
+}
 
 // src/mcp/handlers/rpc.ts
-function resolveApiKey() {
-  const apiKey = process.env["JAW_API_KEY"] ?? loadConfig().apiKey;
+function resolveApiKey(config) {
+  const apiKey = process.env["JAW_API_KEY"] ?? config.apiKey;
   if (!apiKey) {
     throw new Error("API key required. Set JAW_API_KEY env var or run: jaw config set apiKey <key>");
   }
   return apiKey;
 }
+function resolveChainId(paramChainId, config) {
+  if (paramChainId) return paramChainId;
+  const envChainId = parseInt(process.env["JAW_CHAIN_ID"] ?? "", 10);
+  if (Number.isInteger(envChainId) && envChainId > 0) return envChainId;
+  return config.defaultChain ?? 1;
+}
+function envSessionEnabled() {
+  const value = process.env["JAW_SESSION"]?.toLowerCase();
+  return value === "1" || value === "true";
+}
+var SIGN_RATE_WINDOW_MS = 6e4;
+var MAX_SIGNS_PER_WINDOW = 5;
+var SESSION_SIGNING_METHODS = ["wallet_sendCalls", "personal_sign", "eth_signTypedData_v4"];
 function registerRpcTool(server) {
-  server.tool(
+  const recentSigns = [];
+  function assertUnderSignLimit() {
+    const now = Date.now();
+    while (recentSigns.length && now - recentSigns[0] > SIGN_RATE_WINDOW_MS) recentSigns.shift();
+    if (recentSigns.length >= MAX_SIGNS_PER_WINDOW) {
+      throw new Error("Autonomous signing rate limit reached, retry shortly or call again with session: false.");
+    }
+    recentSigns.push(now);
+  }
+  server.registerTool(
     "jaw_rpc",
-    "Execute any JAW.id wallet RPC method via the browser bridge. Supports transactions, signing, permissions, and queries. Methods that require signing will open the browser for passkey authentication. IMPORTANT: Read the jaw://api-reference resource for the full list of methods, and jaw://api-reference/{method} for detailed parameter formats and examples.",
-    rpcMethodSchema,
+    {
+      description: "Execute any JAW.id wallet RPC method. Supports transactions, signing, permissions, and queries. By default, methods that require signing open the browser for passkey authentication. Pass session: true to sign autonomously with the local session key instead (requires a session created via `jaw session setup` \u2014 check jaw_session_status). IMPORTANT: Read the jaw://api-reference resource for the full list of methods, and jaw://api-reference/{method} for detailed parameter formats and examples.",
+      inputSchema: rpcMethodSchema
+    },
+    // @ts-expect-error — MCP SDK deep type inference with z.any() in schema
     async (params) => {
-      const config = loadConfig();
-      const apiKey = resolveApiKey();
-      const chainId = params.chainId ?? config.defaultChain ?? 1;
-      const pm = config.paymasters?.[chainId];
-      const bridge = await getBridge({
-        keysUrl: config.keysUrl,
-        apiKey,
-        chainId,
-        ens: config.ens,
-        paymasterUrl: pm?.url
-      });
       try {
-        const result = await bridge.request(params.method, params.params);
-        return mcpResult(result);
+        const config = loadConfig();
+        const apiKey = resolveApiKey(config);
+        const chainId = resolveChainId(params.chainId, config);
+        const useSession = params.session ?? envSessionEnabled();
+        let bridge;
+        if (useSession) {
+          if (!supportsSessionMode(params.method)) {
+            throw new Error(
+              `Method ${params.method} is not supported in session mode. Call again with session: false to route through the browser bridge.`
+            );
+          }
+          if (SESSION_SIGNING_METHODS.includes(params.method)) {
+            assertUnderSignLimit();
+          }
+          bridge = new SessionBridge({ apiKey, chainId });
+        } else {
+          bridge = await getBridge({
+            keysUrl: config.keysUrl,
+            apiKey,
+            chainId,
+            ens: config.ens,
+            paymasterUrl: config.paymasters?.[chainId]?.url
+          });
+        }
+        try {
+          const result = await bridge.request(params.method, params.params);
+          return mcpResult(result);
+        } finally {
+          bridge.close();
+        }
       } catch (err) {
         return mcpError(err);
-      } finally {
-        bridge.close();
       }
     }
   );