@oobe-protocol-labs/sap-mcp-server 0.9.21 → 0.9.35

package/.env.example

@@ -100,6 +100,16 @@ SAP_MCP_REMOTE_KEEP_ALIVE_TIMEOUT_MS=75000
 # 0 means unlimited requests per socket.
 SAP_MCP_REMOTE_MAX_REQUESTS_PER_SOCKET=0
 
+# =============================================================================
+# Hosted Provider Keys (server-side only)
+# =============================================================================
+# Used only by the hosted SAP MCP gateway when serving protocol tools to users.
+# Never put provider keys in agent runtime configs, public metadata, or MCP snippets.
+SAP_MCP_JUPITER_API_BASE_URL=https://api.jup.ag
+# SAP_MCP_JUPITER_TOKENS_API_BASE_URL=https://api.jup.ag
+# SAP_MCP_JUPITER_API_KEY=your-jupiter-api-key
+SAP_MCP_JUPITER_TIMEOUT_MS=30000
+
 # =============================================================================
 # Remote MCP Access Control
 # =============================================================================
@@ -187,7 +197,7 @@ SAP_MCP_FACILITATOR_NETWORKS=devnet
 SAP_MCP_PRICE_READ_PREMIUM_USD=0.001
 SAP_MCP_PRICE_BUILDER_USD=0.008
 SAP_MCP_PRICE_VALUE_FIXED_USD=0.09
-SAP_MCP_PRICE_HEAVY_VALUE_USD=0.15
+SAP_MCP_PRICE_HEAVY_VALUE_USD=0.05
 SAP_MCP_PRICE_VALUE_BPS=0
 SAP_MCP_PRICE_MIN_USD=0.001
 SAP_MCP_PRICE_MAX_USD=100

package/CHANGELOG.md

@@ -2,6 +2,236 @@
 
 All notable changes to this project are documented in this file.
 
+## 0.9.35 - 2026-07-26
+
+### Changed — Protocol Safety And Perps Readiness
+
+- Removed the disabled perp protocol family from the public SAP MCP surface while
+  it is under active exploit review. Public docs, skills, landing-page copy,
+  logo carousels, and dynamic AgentKit registration now exclude those tools.
+- Replaced incomplete Adrena transaction builders with `sap_perp_trade_plan`,
+  a free trader-grade planning tool that returns notional sizing, liquidation
+  estimate, stop risk, reward/risk, risk flags, and the exact read tools an
+  agent should call before any external perps execution route.
+- Kept perps analytics free and fast: markets, positions, funding, OHLC,
+  long-term charts, volume profile, liquidation zones, and trade planning.
+- Moved local memory and strategy stores onto the canonical SAP MCP profile
+  directory: `~/.config/mcp-sap/`.
+- Updated release metadata, hosted server card, desktop wizard references, and
+  npm/client snippets to `0.9.35`.
+
+### Added — Local Agent Memory Subsystem (SQLite FTS5)
+
+### Added — Local Agent Memory Subsystem (SQLite FTS5)
+
+A complete serverless local-memory subsystem built on SQLite FTS5, using
+inverted full-text indexes and relevance-ranked retrieval to recover historical
+agent interactions. All data is stored locally at
+`~/.config/mcp-sap/memory/agent-memory.db` — no data leaves the user's machine.
+
+**10 module files:**
+- `src/memory/types.ts` — 11 TypeScript interfaces with strict typing
+- `src/memory/database.ts` — Singleton SQLite connection (WAL mode, FTS5, schema versioning, prepared statements, graceful degradation)
+- `src/memory/tool-call-store.ts` — Records + FTS5 search with BM25 ranking
+- `src/memory/memory-store.ts` — Agent memories with relevance decay + recall
+- `src/memory/stream-buffer-store.ts` — FIFO event buffering with dedup + replay
+- `src/memory/async-processor.ts` — Non-blocking background maintenance (decay, evict, archive, prune, WAL checkpoint)
+- `src/memory/auto-record.ts` — Automatic tool call recording hook
+- `src/memory/hermes-bridge.ts` — Cross-session Hermes Agent integration (read-only)
+- `src/memory/utils.ts` — truncate, decayRelevance, isExpired
+- `src/strategies/strategy-store.ts` — File-based JSON strategy store with versioning + path traversal protection
+
+**17 FREE MCP memory tools (tool surface now 327 total after risk-policy removals, all local, no x402):**
+
+| Category | Tool | Function |
+|---|---|---|
+| Memory | `sap_memory_record` | Record a tool call in the DB |
+| | `sap_memory_search` | FTS5 search across tool call history |
+| | `sap_memory_summarize` | Create an LLM-compressed memory (lesson/pattern/failure/success) |
+| | `sap_memory_recall` | Top N memories for a category (prompt injection) |
+| | `sap_memory_prune` | Remove expired + low-relevance memories |
+| Strategy | `sap_strategy_save` | Save/update a strategy JSON |
+| | `sap_strategy_load` | Load a strategy by category+name |
+| | `sap_strategy_list` | List strategies (filterable) |
+| | `sap_strategy_activate` | Activate/deactivate a strategy |
+| Stream | `sap_stream_buffer` | Buffer a stream event (dedup by eventId) |
+| | `sap_stream_consume` | Consume events FIFO (mark consumed) |
+| | `sap_stream_replay` | Replay all events for backtest |
+| Audit | `sap_audit_query` | Query audit trail via FTS5 |
+| | `sap_audit_record` | Record a manual audit entry |
+| | `sap_audit_stats` | Aggregate stats (counts, breakdowns, DB size) |
+| Hermes | `sap_hermes_search` | Search Hermes session history |
+| | `sap_hermes_recent` | Recent Hermes sessions for context injection |
+
+**Key engineering features:**
+- SQLite FTS5 with BM25 relevance ranking
+- WAL mode for concurrent read access (crash-safe)
+- Thread-safe singleton with cached prepared statements
+- Graceful degradation (if DB can't open, tools return empty results)
+- Async processor: decay (1h), evict (5m), archive (1h), prune (6h), WAL checkpoint (10m)
+- Relevance decay: 1%/day, auto-prune below 0.05
+- Stream dedup: (streamType, eventId) unique index
+- Strategy versioning: auto-increment on update
+- Path traversal protection: sanitized path segments (alphanumeric + dash/underscore/dot only)
+- Hermes bridge: auto-detected, read-only, FTS5 with LIKE fallback
+- Server lifecycle: init+start on boot, stop+close on shutdown
+
+### Added — Quick Context Auto-Update
+
+`sap_quick_context` now accepts `agentKnownVersion`:
+- When omitted (first bootstrap): `skillsUpdateRequired=true`, `skillsContents` populated with full SKILL.md inline
+- When ≠ server version: `skillsUpdateRequired=true`, skills contents included
+- When == server version: `skillsUpdateRequired=false` (token savings)
+
+Also returns `serverCommit` (git short hash), `environment` (network, mode, authType, rateLimitPerMinute), and `recommendedFlow` (mode-specific workflow guidance).
+
+### Added — Wizard Directory Creation
+
+`ensureConfigDirectories()` now creates `~/.config/mcp-sap/memory/` and `~/.config/mcp-sap/strategies/` with private permissions (mode 0o700) alongside the existing config, keypair, data, log, and cache directories.
+
+### Security
+
+- Path traversal protection on all strategy store operations (`sanitizePathSegment`)
+- All SQL queries use parameterized prepared statements (no string interpolation)
+- Hermes bridge opens read-only connections only
+- Memory database is local-only — no network access
+- No secrets, private keys, or keypair bytes stored in the memory DB
+- 0 dependency vulnerabilities (`pnpm audit`)
+- `createRequire` used instead of `require()` to satisfy ESLint
+
+## 0.9.22 - 2026-07-25
+
+### Added
+
+- **`signerProfile` per-call parameter** on `sap_payments_finalize_transaction`.
+  Agents can now sign with a specific profile without switching `.active-profile`
+  manually. Multiple profiles coexist in the same session. Eliminates the #1
+  source of agent friction: profile-switch juggling + stale signer cache.
+- **`sap_build_sol_transfer`** — Hosted unsigned builder for native SOL transfers
+  using `SystemProgram.transfer`. Fills the gap left by `spl-token_transferSol`
+  (local-signer-only). Returns base64 unsigned transaction for local signing.
+- **`sap_build_spl_transfer`** — Hosted unsigned builder for SPL token transfers
+  with idempotent ATA creation. Uses raw `@solana/web3.js` `TransactionInstruction`
+  (no `@solana/spl-token` dependency). Returns base64 unsigned transaction.
+- **x402 idempotency cache** in `McpMonetizationGate` — prevents double-charge on
+  retry. Successful settlements are cached by `requestHash` for 5 minutes
+  (max 10,000 entries, LRU eviction, opportunistic pruning). If the same
+  request is retried after a network failure, the cached settlement is returned
+  without re-charging the payer's USDC.
+- **x402 nonce + TTL strict validation** — `validatePaymentRequirementsForDecision`
+  now enforces `maxTimeoutSeconds ≤ 120` and rejects invalid/missing TTL values.
+  Prevents stale challenge replay attacks.
+- **Challenge-signature parameter** on `sap_profile_switch` — optional Ed25519
+  signature proving ownership of the target profile keypair. Prevents
+  impersonation via manual `.active-profile` file edits.
+- **`preloadPremiumProviders`** at server startup — providers are eagerly loaded
+  and connected when the server boots, not lazily on first request. The
+  `providerHealth` response now reflects real provider status immediately.
+- **3 new free meme-radar providers** (DexScreener + Solana RPC, no API keys):
+  - `meme.newlisting.alert` — detects newly listed tokens via DexScreener
+    `pairCreatedAt` with honeypot/dev-wallet risk flags.
+  - `meme.rugpull.detector` — on-chain mint/freeze authority checks via Solana
+  RPC + DexScreener liquidity drain detection. Risk score 0-1 with
+    exit/monitor/caution actions.
+  - `meme.social.sentiment` — bull/bear scores from DexScreener price momentum
+  (1h/6h/24h weighted) with volume acceleration confidence.
+- **Multi-feed Pyth** — `pyth.price.tick` and `pyth.volatility.watch` now poll
+  5 feeds by default (SOL/USD, WBTC/USD, WETH/USD, JUP/USD, USDC/USD) instead
+  of 1. All Pyth providers converted from WebSocket to HTTP polling
+  (`hermes.pyth.network/v2/updates/price/latest`).
+- **`signalConfidence` field** on Pyth price tick events — normalized 0-1
+  confidence score derived from `1 - (confidenceInterval / price)`, separate
+  from the raw Pyth `confidenceIntervalUsd`.
+- **ATR-based SL/TP** for volatility breakout signals — `stopLoss = entry ∓
+  2×ATR`, `takeProfit = entry ± 3×ATR`, with `minSpreadPct` filter (0.1%)
+  to discard signals too tight for on-chain execution. `action` changed from
+  `sell` to `swap` for spot-only agents.
+- **Applied filters in webhook relay response** — `sap_premium_webhook_relay`
+  now returns `subscribedEvents` and `appliedFilters` in the subscription
+  response for agent verification.
+- **`sap-mcp-optimization` skill** (devops category) — documents pre-estimate,
+  profile routing, build→sign→submit, x402 payment rules, readiness checks,
+  budget management, and premium stream consumption patterns.
+- Tool count: 317 → 319. Test count: 603 (unchanged, all updated).
+
+### Changed
+
+- **Premium capability prices halved** — all 13 premium capabilities now cost
+  50% less per unit/event:
+  - `jupiter.quote.delta`: $0.02 → $0.01/min
+  - `pyth.price.tick`: $0.015 → $0.0075/min
+  - `price.threshold.crossed`: $0.001 → $0.0005/event
+  - `jupiter.arbitrage.scan`: $0.05 → $0.025/min
+  - `pyth.volatility.watch`: $0.03 → $0.015/min
+  - `jupiter.route.optimized`: $0.025 → $0.0125/min
+  - `meme.newlisting.alert`: $0.003 → $0.0015/event
+  - `meme.social.sentiment`: $0.02 → $0.01/min
+  - `meme.rugpull.detector`: $0.04 → $0.02/min
+  - `meme.volume.spike`: $0.025 → $0.0125/min
+  - `tech.github.activity`: $0.002 → $0.001/event
+  - `tech.tvl.change`: $0.02 → $0.01/min
+  - `tech.tokenomics.analysis`: $0.004 → $0.002/event
+- **Heavy value-action price**: $0.15 → $0.05 (max accepted x402 for
+  value-action tier tools).
+- **Auto-pay threshold**: $0.02 → $0.05 (`SAP_MCP_X402_AUTO_PAY_MAX_USD`).
+  Read-premium ($0.001) and builder ($0.008) calls now auto-pay without
+  confirmation.
+- **Premium poll/flush/metrics FREE** — `sap_premium_stream_poll`,
+  `sap_premium_stream_flush`, `sap_premium_webhook_relay_status`,
+  `sap_premium_metrics`, `sap_premium_session_status`, `sap_premium_close_session`
+  moved to FREE_TOOLS + STRICT_FREE_TOOLS. No x402 charge for consumption
+  or diagnostics.
+- **Birdeye dependency removed** — all meme-radar capabilities now use
+  DexScreener + Solana RPC (both free, no API key). `SAP_MCP_PREMIUM_BIRDEYE_API_URL`
+  removed from all capability definitions and test fixtures.
+- **Builder tool descriptions** now mention `sap_payments_finalize_transaction`
+  as the 1-call alternative to the 3-step preview→sign→submit flow.
+- **`sap_estimate_tool_cost`** description now explicitly says "dry-run — no
+  charge, no x402 challenge" and includes `maxPriceUsd = estimate × 1.25`
+  guidance.
+- **`sap_quick_context` nextAction** now includes explicit routing guidance:
+  accountless hosted → use `sap_payments_profile_current`, `signerProfile`
+  per-call, `sap_build_sol_transfer`/`sap_build_spl_transfer`, no signing scripts.
+
+### Fixed
+
+- **Bridge cache coherence** — `sap_payments_profile_current` now re-reads
+  `.active-profile` and re-resolves the signer on every call. No more stale
+  signer after manual profile switch.
+- **`sap_profile_switch` guidance** — when the hosted server is accountless,
+  the response now provides 3 concrete options (local bridge, manual edit,
+  CLI command) instead of a bare "Profile does not exist" error. Includes
+  stale cache warning.
+- **Provider preload at startup** — providers are loaded and connected when
+  the server boots, not on first request. `providerHealth` is populated
+  immediately, not empty `{}`.
+- **Provider delivery loop logging** — all `catch` blocks in provider-bridge,
+  webhook-engine, premium-tools, and premium-routes now log errors to stderr
+  instead of swallowing silently.
+- **Meme volume spike provider** — replaced nonexistent DexScreener
+  `/v1/solana/volume` endpoint with real API (`/latest/dex/tokens/{mint}` and
+  `/latest/dex/search`). Added `activeMints` tracking, EMA baseline spike
+  detection, `MAX_MINTS_PER_POLL` limit.
+- **Pyth providers** — converted from WebSocket (`wss://hermes.pyth.network/v2/ws`,
+  rejects bare connections) to HTTP polling (`/v2/updates/price/latest`).
+- **All 12 provider import paths** — fixed `../../types.js` → `../types.js`.
+- **`onchain.solana.ts`** — imported `ConfirmedSignatureInfo` from
+  `@solana/web3.js` to fix `blockTime: number | null | undefined` type mismatch.
+- **Stale config references** — cleaned up all `0.02` auto-pay and `0.15`
+  heavy value refs in `.env.example`, `config.example.json`,
+  `config.secure-example.json`, `schema.json`, `mcp-client-injection.ts`, and
+  `explain-x402-settlement.prompt.ts`.
+
+### Security
+
+- x402 idempotency cache prevents double-charge on retry (point 2c).
+- x402 nonce + TTL strict validation caps challenge lifetime at 120s (point 5b).
+- Challenge-signature parameter on profile switch prevents impersonation (point 5a).
+- `secretMaterial: keypair-bytes-never-returned` guarantee maintained across
+  all signing tools.
+- No secrets, private keys, or keypair bytes in source code (security audit clean).
+- 0 dependency vulnerabilities (`pnpm audit`).
+
 ## 0.9.21 - 2026-07-25
 
 ### Added
@@ -45,7 +275,7 @@ All notable changes to this project are documented in this file.
 
 ### Added
 
-- Added 10 new MCP tools for perpetual futures trading and chart analysis:
+- Added MCP tools for perpetual futures market analytics and chart analysis:
   - `sap_perp_markets` — List Adrena perp markets with mark price, funding, OI.
   - `sap_perp_position_info` — Read on-chain Adrena perp positions for a wallet.
   - `sap_perp_funding_history` — Historical funding rates from Adrena API.
@@ -53,11 +283,8 @@ All notable changes to this project are documented in this file.
   - `sap_chart_long_term` — Long-term price history + protocol TVL (DexScreener + DeFiLlama).
   - `sap_chart_volume_profile` — Volume profile analysis with POC, VAH, VAL.
   - `sap_perp_liquidation_zones` — Compute liquidation zones for open positions.
-  - `sap_perp_build_open` — Build unsigned tx to open leveraged perp position (Adrena).
-  - `sap_perp_build_close` — Build unsigned tx to close a perp position.
-  - `sap_perp_build_modify` — Build unsigned tx to add/remove collateral.
-- All 10 tools use only free APIs (DexScreener, DeFiLlama, Adrena REST, Solana RPC).
-- Inscribed tools (`sap_perp_build_*`) return unsigned transactions for local agent signing.
+- Execution builders were later removed from the public surface until IDL-backed, locally finalizable
+  perps transactions can meet the SAP MCP signing and safety bar.
 
 ### Removed
 

package/README.md

@@ -15,7 +15,7 @@ User-facing setup docs live in [`USER_DOCS/`](USER_DOCS/00_START_HERE.md). Opera
 
 | Area | Current behavior |
 | --- | --- |
-| Package version | `0.9.21` |
+| Package version | `0.9.35` |
 | MCP transport | stdio locally, Streamable HTTP remotely |
 | Remote access | Bearerless public mode for hosted agents; API key or JWT for private modes |
 | Config directory | `~/.config/mcp-sap` only |
@@ -134,7 +134,7 @@ For paid/write hosted tools, add the local non-custodial payment bridge as well:
 ```toml
 [mcp_servers.sap_payments]
 command = "npx"
-args = ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server@0.9.21", "sap-mcp-server"]
+args = ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server@0.9.35", "sap-mcp-server"]
 startup_timeout_sec = 300
 tool_timeout_sec = 300
 
@@ -152,7 +152,7 @@ Codex supports Streamable HTTP MCP servers with URL-based entries in `config.tom
 ```toml
 [mcp_servers.sap]
 command = "npx"
-args = ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server@0.9.21", "sap-mcp-server"]
+args = ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server@0.9.35", "sap-mcp-server"]
 
 [mcp_servers.sap.env]
 SAP_MCP_ALLOW_ENV_CONFIG_OVERRIDE = "false"

package/USER_DOCS/00_START_HERE.md

@@ -71,7 +71,14 @@ npm exec --yes --package @oobe-protocol-labs/sap-mcp-server -- sap-mcp-config re
 9. For registrations, check `success`, `agentRegistered`, `agentPda`, `protocolFee`, and `protocolComplete`. Local registration does not pay a hosted x402 fee. `success: true` means the agent account exists and the source-level protocol fee invariant was verified. If `success: false` with `agentRegistered: true`, the account may exist but SAP registration is not protocol-complete.
 10. Use `sap_payments_finalize_transaction` when a paid hosted builder returns an unsigned transaction to preview, sign locally, and optionally submit already-signed bytes through the hosted OOBE relay.
 11. Use `sap_agent_runtime_status` when asking an agent whether SAP MCP is connected or ready for paid/write work. It returns the hosted/local bridge routing truth without reading local files.
-12. Use `sap_pricing_catalog` or `https://mcp.sap.oobeprotocol.ai/pricing.json` to inspect generated hosted pricing tiers. The x402 challenge returned by a paid tool remains the final payment source of truth.
+12. Use `sap_prepare_action` before swaps, registry writes, identity updates, Escrow V2, external x402 calls, premium streams, or transaction finalization. It returns fresh-data requirements, the correct hosted/local route, confirmation policy, retry rules, and proof-tape fields without charging x402.
+13. Use `sap_pricing_catalog` or `https://mcp.sap.oobeprotocol.ai/pricing.json` to inspect generated hosted pricing tiers. The x402 challenge returned by a paid tool remains the final payment source of truth.
+
+Session memory is for operational context and audit: active profile name after
+readiness, public wallet keys, runtime namespace availability, x402 receipts,
+submitted signatures, final statuses, and error classifications. Do not use
+memory as cached truth for balances, token prices, Jupiter quotes/orders,
+blockhashes, simulations, liquidity/routes, SNS ownership, or SAP account state.
 
 Agent identity, profile images, Metaplex bridging, SNS linking, capabilities,
 pricing, and update fields are documented in:
@@ -87,6 +94,7 @@ server exposes these free maintenance tools:
 | --- | --- |
 | `sap_agent_start` | Load the canonical startup playbook. |
 | `sap_agent_runtime_status` | Free runtime truth table for hosted connection, local `sap_payments` readiness expectations, write routing, forbidden actions, and next tool calls. |
+| `sap_prepare_action` | Free intent-level planner for paid calls, writes, swaps, escrow, external x402, premium streams, confirmation policy, retry rules, and proof-tape shape. |
 | `sap_pricing_catalog` | Free machine-readable pricing catalog generated from the hosted pricing registry. Also available at `/pricing.json`. |
 | `sap_protocol_invariants` | Return the canonical SAP program id, protocol treasury, registration fee, hosted/local routing rules, and forbidden actions. |
 | `sap_agent_identity_plan` | Free planner for SAP registration, image/profile updates, Metaplex identity, SNS linking, and verification. |

package/USER_DOCS/01_HOSTED_REMOTE_MCP.md

@@ -29,7 +29,7 @@ Public `server.json` shape:
   "name": "sap-mcp-server",
   "title": "SAP MCP Server | OOBE Protocol",
   "description": "Hosted Solana-native MCP gateway for Synapse Agent Protocol tools, x402/pay.sh monetization, SNS identity, and agent operations.",
-  "version": "0.9.21",
+  "version": "0.9.35",
   "status": "online",
   "protocol": {
     "primary": "mcp",

package/USER_DOCS/04_CLIENT_CONFIGS.md

@@ -45,7 +45,7 @@ url = "https://mcp.sap.oobeprotocol.ai/mcp"
 
 [mcp_servers.sap_payments]
 command = "npx.cmd"
-args = ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server@0.9.21", "sap-mcp-server"]
+args = ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server@0.9.35", "sap-mcp-server"]
 startup_timeout_sec = 300
 tool_timeout_sec = 300
 
@@ -65,7 +65,7 @@ the complete local stdio SAP MCP process instead of using the hosted endpoint, u
 ```toml
 [mcp_servers.sap]
 command = "npx.cmd"
-args = ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server@0.9.21", "sap-mcp-server"]
+args = ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server@0.9.35", "sap-mcp-server"]
 
 [mcp_servers.sap.env]
 SAP_MCP_ALLOW_ENV_CONFIG_OVERRIDE = "false"
@@ -201,7 +201,7 @@ For Claude Code, use the official MCP CLI pattern:
 
 ```bash
 claude mcp add --transport http sap https://mcp.sap.oobeprotocol.ai/mcp
-claude mcp add --transport stdio sap_payments -- npx --yes --package @oobe-protocol-labs/sap-mcp-server@0.9.21 sap-mcp-server
+claude mcp add --transport stdio sap_payments -- npx --yes --package @oobe-protocol-labs/sap-mcp-server@0.9.35 sap-mcp-server
 ```
 
 Set `SAP_MCP_PAYMENTS_BRIDGE_ONLY=true` and `SAP_ALLOWED_TOOLS=all` in the

package/USER_DOCS/06_DESKTOP_GUI_WIZARD.md

@@ -106,7 +106,7 @@ url = "https://mcp.sap.oobeprotocol.ai/mcp"
 
 [mcp_servers.sap_payments]
 command = "npx"
-args = ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server@0.9.21", "sap-mcp-server"]
+args = ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server@0.9.35", "sap-mcp-server"]
 startup_timeout_sec = 300
 tool_timeout_sec = 300
 
@@ -138,7 +138,7 @@ Claude Desktop uses a root `mcpServers` JSON object:
     },
     "sap_payments": {
       "command": "npx",
-      "args": ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server@0.9.21", "sap-mcp-server"],
+      "args": ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server@0.9.35", "sap-mcp-server"],
       "env": {
         "SAP_MCP_ALLOW_ENV_CONFIG_OVERRIDE": "false",
         "SAP_MCP_PAYMENTS_BRIDGE_ONLY": "true",
@@ -170,7 +170,7 @@ Hermes global `mcp.json` uses flat server entries:
   },
   "sap_payments": {
     "command": "npx",
-    "args": ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server@0.9.21", "sap-mcp-server"],
+    "args": ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server@0.9.35", "sap-mcp-server"],
     "env": {
       "SAP_MCP_ALLOW_ENV_CONFIG_OVERRIDE": "false",
       "SAP_MCP_PAYMENTS_BRIDGE_ONLY": "true",
@@ -193,7 +193,7 @@ mcp_servers:
     args:
       - "--yes"
       - "--package"
-      - "@oobe-protocol-labs/sap-mcp-server@0.9.21"
+      - "@oobe-protocol-labs/sap-mcp-server@0.9.35"
       - "sap-mcp-server"
     env:
       SAP_MCP_ALLOW_ENV_CONFIG_OVERRIDE: "false"
@@ -215,7 +215,7 @@ OpenClaw MCP JSON uses the same root `mcpServers` structure as generic MCP clien
     },
     "sap_payments": {
       "command": "npx",
-      "args": ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server@0.9.21", "sap-mcp-server"],
+      "args": ["--yes", "--package", "@oobe-protocol-labs/sap-mcp-server@0.9.35", "sap-mcp-server"],
       "env": {
         "SAP_MCP_ALLOW_ENV_CONFIG_OVERRIDE": "false",
         "SAP_MCP_PAYMENTS_BRIDGE_ONLY": "true",

package/config.example.json

@@ -56,7 +56,7 @@
       "readPremiumUsd": 0.001,
       "builderUsd": 0.008,
       "valueFixedUsd": 0.09,
-      "heavyValueUsd": 0.15,
+      "heavyValueUsd": 0.05,
       "valueBps": 0,
       "minUsd": 0.001,
       "maxUsd": 100

package/config.secure-example.json

@@ -59,7 +59,7 @@
       "readPremiumUsd": 0.001,
       "builderUsd": 0.008,
       "valueFixedUsd": 0.09,
-      "heavyValueUsd": 0.15,
+      "heavyValueUsd": 0.05,
       "valueBps": 0,
       "minUsd": 0.001,
       "maxUsd": 100

package/dist/config/env.d.ts

@@ -47,6 +47,10 @@ export declare const envSchema: z.ZodObject<{
     SAP_CACHE_TTL_SECONDS: z.ZodDefault<z.ZodNumber>;
     SAP_ENABLE_RATE_LIMIT: z.ZodDefault<z.ZodEffects<z.ZodBoolean, boolean, unknown>>;
     SAP_RATE_LIMIT_PER_MINUTE: z.ZodDefault<z.ZodNumber>;
+    SAP_MCP_JUPITER_API_BASE_URL: z.ZodDefault<z.ZodString>;
+    SAP_MCP_JUPITER_TOKENS_API_BASE_URL: z.ZodOptional<z.ZodString>;
+    SAP_MCP_JUPITER_API_KEY: z.ZodOptional<z.ZodString>;
+    SAP_MCP_JUPITER_TIMEOUT_MS: z.ZodDefault<z.ZodNumber>;
     SAP_MCP_MONETIZATION_ENABLED: z.ZodDefault<z.ZodEffects<z.ZodBoolean, boolean, unknown>>;
     SAP_MCP_MONETIZATION_PROVIDER: z.ZodDefault<z.ZodEnum<["x402", "pay-sh"]>>;
     SAP_MCP_MONETIZATION_PAY_TO: z.ZodOptional<z.ZodString>;
@@ -87,6 +91,8 @@ export declare const envSchema: z.ZodObject<{
     SAP_CACHE_TTL_SECONDS: number;
     SAP_ENABLE_RATE_LIMIT: boolean;
     SAP_RATE_LIMIT_PER_MINUTE: number;
+    SAP_MCP_JUPITER_API_BASE_URL: string;
+    SAP_MCP_JUPITER_TIMEOUT_MS: number;
     SAP_MCP_MONETIZATION_ENABLED: boolean;
     SAP_MCP_MONETIZATION_PROVIDER: "x402" | "pay-sh";
     SAP_MCP_X402_MAX_TIMEOUT_SECONDS: number;
@@ -109,6 +115,8 @@ export declare const envSchema: z.ZodObject<{
     SAP_HTTP_CORS_ORIGINS?: string | undefined;
     SAP_ALLOWED_TOOLS?: string | undefined;
     SAP_LOG_FILE?: string | undefined;
+    SAP_MCP_JUPITER_TOKENS_API_BASE_URL?: string | undefined;
+    SAP_MCP_JUPITER_API_KEY?: string | undefined;
     SAP_MCP_MONETIZATION_PAY_TO?: string | undefined;
     SAP_MCP_MONETIZATION_NETWORK?: string | undefined;
     SAP_MCP_X402_FACILITATOR_URL?: string | undefined;
@@ -149,6 +157,10 @@ export declare const envSchema: z.ZodObject<{
     SAP_CACHE_TTL_SECONDS?: number | undefined;
     SAP_ENABLE_RATE_LIMIT?: unknown;
     SAP_RATE_LIMIT_PER_MINUTE?: number | undefined;
+    SAP_MCP_JUPITER_API_BASE_URL?: string | undefined;
+    SAP_MCP_JUPITER_TOKENS_API_BASE_URL?: string | undefined;
+    SAP_MCP_JUPITER_API_KEY?: string | undefined;
+    SAP_MCP_JUPITER_TIMEOUT_MS?: number | undefined;
     SAP_MCP_MONETIZATION_ENABLED?: unknown;
     SAP_MCP_MONETIZATION_PROVIDER?: "x402" | "pay-sh" | undefined;
     SAP_MCP_MONETIZATION_PAY_TO?: string | undefined;
@@ -205,6 +217,12 @@ export interface SapMcpConfig {
     cacheTtlSeconds: number;
     enableRateLimit: boolean;
     rateLimitPerMinute: number;
+    jupiter: {
+        apiBaseUrl: string;
+        tokensApiBaseUrl?: string;
+        apiKeyConfigured: boolean;
+        timeoutMs: number;
+    };
     bento?: {
         enabled: boolean;
         apiKey?: string;

package/dist/config/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/config/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAyDxB;;GAEG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0EpB,CAAC;AAEH;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAMrD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,WAAW,GAAG,WAAW,GAAG,WAAW,CAAC;IACpD,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,OAAO,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,uBAAuB,EAAE,MAAM,CAAC;IAChC,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,uBAAuB,EAAE,MAAM,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAC/B,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAC9C,SAAS,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,KAAK,CAAC,EAAE;QACN,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,MAAM,CAAC,EAAE;QACP,IAAI,EAAE,YAAY,GAAG,YAAY,GAAG,QAAQ,CAAC;QAC7C,QAAQ,EAAE,OAAO,CAAC;QAClB,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,YAAY,EAAE,wBAAwB,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,MAAM,UAAU,GAClB,UAAU,GACV,mBAAmB,GACnB,iBAAiB,GACjB,mBAAmB,GACnB,YAAY,CAAC;AAEjB;;;GAGG;AACH,MAAM,MAAM,0BAA0B,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE3D;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,0BAA0B,CAAC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,OAAO,CAAC;IACrB,MAAM,EAAE;QACN,cAAc,EAAE,MAAM,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,MAAM,CAAC;QACtB,aAAa,EAAE,MAAM,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAmCD;;;;;;GAMG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAED;;GAEG;AACH,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAMD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,YAAY,CAqC5D;AA6WD;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,IAAI,CAQ9D;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,YAAY,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CA+BhG"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/config/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAyDxB;;GAEG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiFpB,CAAC;AAEH;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAMrD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,WAAW,GAAG,WAAW,GAAG,WAAW,CAAC;IACpD,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,OAAO,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,uBAAuB,EAAE,MAAM,CAAC;IAChC,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,uBAAuB,EAAE,MAAM,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAC/B,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAC9C,SAAS,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE;QACP,UAAU,EAAE,MAAM,CAAC;QACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,gBAAgB,EAAE,OAAO,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,KAAK,CAAC,EAAE;QACN,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,MAAM,CAAC,EAAE;QACP,IAAI,EAAE,YAAY,GAAG,YAAY,GAAG,QAAQ,CAAC;QAC7C,QAAQ,EAAE,OAAO,CAAC;QAClB,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,YAAY,EAAE,wBAAwB,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,MAAM,UAAU,GAClB,UAAU,GACV,mBAAmB,GACnB,iBAAiB,GACjB,mBAAmB,GACnB,YAAY,CAAC;AAEjB;;;GAGG;AACH,MAAM,MAAM,0BAA0B,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE3D;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,0BAA0B,CAAC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,OAAO,CAAC;IACrB,MAAM,EAAE;QACN,cAAc,EAAE,MAAM,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,MAAM,CAAC;QACtB,aAAa,EAAE,MAAM,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAmCD;;;;;;GAMG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAED;;GAEG;AACH,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAMD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,YAAY,CAqC5D;AAmXD;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,IAAI,CAQ9D;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,YAAY,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CA+BhG"}

package/dist/config/env.js

@@ -102,6 +102,12 @@ export const envSchema = z.object({
     SAP_CACHE_TTL_SECONDS: z.coerce.number().positive().default(300),
     SAP_ENABLE_RATE_LIMIT: booleanEnvSchema.default(true),
     SAP_RATE_LIMIT_PER_MINUTE: z.coerce.number().positive().default(60),
+    // Hosted gateway provider keys. These are server-side only and must never be
+    // written into client MCP configs, public metadata, or tool responses.
+    SAP_MCP_JUPITER_API_BASE_URL: z.string().url().default('https://api.jup.ag'),
+    SAP_MCP_JUPITER_TOKENS_API_BASE_URL: z.string().url().optional(),
+    SAP_MCP_JUPITER_API_KEY: z.string().optional(),
+    SAP_MCP_JUPITER_TIMEOUT_MS: z.coerce.number().positive().default(30000),
     // Remote MCP monetization. Applies only when explicitly enabled by hosted HTTP deployments.
     SAP_MCP_MONETIZATION_ENABLED: booleanEnvSchema.default(false),
     SAP_MCP_MONETIZATION_PROVIDER: monetizationProviderSchema.default('x402'),
@@ -115,7 +121,7 @@ export const envSchema = z.object({
     SAP_MCP_PRICE_READ_PREMIUM_USD: z.coerce.number().positive().default(0.001),
     SAP_MCP_PRICE_BUILDER_USD: z.coerce.number().positive().default(0.008),
     SAP_MCP_PRICE_VALUE_FIXED_USD: z.coerce.number().nonnegative().default(0.09),
-    SAP_MCP_PRICE_HEAVY_VALUE_USD: z.coerce.number().nonnegative().default(0.15),
+    SAP_MCP_PRICE_HEAVY_VALUE_USD: z.coerce.number().nonnegative().default(0.05),
     SAP_MCP_PRICE_VALUE_BPS: z.coerce.number().nonnegative().default(0),
     SAP_MCP_PRICE_MIN_USD: z.coerce.number().nonnegative().default(0.001),
     SAP_MCP_PRICE_MAX_USD: z.coerce.number().positive().default(100),
@@ -442,7 +448,7 @@ function getDefaultEnvConfig() {
         SAP_MCP_PRICE_READ_PREMIUM_USD: 0.001,
         SAP_MCP_PRICE_BUILDER_USD: 0.008,
         SAP_MCP_PRICE_VALUE_FIXED_USD: 0.09,
-        SAP_MCP_PRICE_HEAVY_VALUE_USD: 0.15,
+        SAP_MCP_PRICE_HEAVY_VALUE_USD: 0.05,
         SAP_MCP_PRICE_VALUE_BPS: 0,
         SAP_MCP_PRICE_MIN_USD: 0.001,
         SAP_MCP_PRICE_MAX_USD: 100,
@@ -499,6 +505,12 @@ function transformToRuntimeConfig(env, fileConfig = {}) {
         cacheTtlSeconds: env.SAP_CACHE_TTL_SECONDS,
         enableRateLimit: env.SAP_ENABLE_RATE_LIMIT,
         rateLimitPerMinute: env.SAP_RATE_LIMIT_PER_MINUTE,
+        jupiter: {
+            apiBaseUrl: env.SAP_MCP_JUPITER_API_BASE_URL,
+            tokensApiBaseUrl: env.SAP_MCP_JUPITER_TOKENS_API_BASE_URL,
+            apiKeyConfigured: Boolean(env.SAP_MCP_JUPITER_API_KEY?.trim()),
+            timeoutMs: env.SAP_MCP_JUPITER_TIMEOUT_MS,
+        },
         bento: {
             enabled: effectiveBentoEnabled,
             apiKey: process.env.SAP_MCP_BENTO_API_KEY || asOptionalString(bentoConfig.apiKey),