@openclawcash/mcp-server 0.1.20 → 0.1.23

package/README.md

@@ -13,6 +13,8 @@ Wallet and profile tools:
 - `skill_latest` (public install metadata; no API key required)
 - `wallets_list`
 - `wallet_get`
+- `policies_list`
+- `policy_get`
 - `transactions_list`
 - `balances_get`
 - `supported_tokens_list`

package/openclawcash-mcp.mjs

@@ -7,7 +7,7 @@ import { fileURLToPath } from "node:url";
 import { z } from "zod";
 
 const SERVER_NAME = "openclawcash";
-const SERVER_VERSION = "0.1.20";
+const SERVER_VERSION = "0.1.23";
 const PROTOCOL_VERSION = "2024-11-05";
 const DEFAULT_BASE_URL = "https://openclawcash.com";
 
@@ -102,6 +102,7 @@ const walletSelectorSchema = walletSelectorBaseSchema.refine(
 const walletsListArgsSchema = z.object({
   includeBalances: z.boolean().optional(),
 });
+const policiesListArgsSchema = z.object({}).strict();
 const skillLatestArgsSchema = z.object({}).strict();
 
 const tokenlistArgsSchema = z.object({
@@ -248,8 +249,8 @@ const userTagSetArgsSchema = z.object({
     .trim()
     .toLowerCase()
     .min(3)
-    .max(64)
-    .regex(/^[a-z0-9][a-z0-9._-]{2,63}$/),
+    .max(8)
+    .regex(/^[a-z0-9][a-z0-9._-]{2,7}$/),
 });
 
 const polymarketLimitArgsSchema = z
@@ -347,6 +348,43 @@ const polymarketMarketSearchArgsSchema = z.object({
   limit: z.number().int().positive().max(50).optional(),
 });
 
+const yieldwolfCasinoLinkArgsSchema = z
+  .object({
+    walletId: z.union([z.number().int().positive(), z.string().min(1)]).optional(),
+    walletAddress: z.string().min(1).optional(),
+    agentName: z.string().min(1).max(64).optional(),
+    lane: z.enum(["real", "test"]).optional(),
+  })
+  .strict()
+  .refine((data) => [data.walletId, data.walletAddress].filter((v) => v !== undefined).length === 1, {
+    message: "Provide exactly one of walletId or walletAddress.",
+  });
+
+const yieldwolfCasinoUnlinkArgsSchema = z
+  .object({
+    walletId: z.union([z.number().int().positive(), z.string().min(1)]).optional(),
+    walletAddress: z.string().min(1).optional(),
+  })
+  .strict()
+  .refine((data) => [data.walletId, data.walletAddress].filter((v) => v !== undefined).length === 1, {
+    message: "Provide exactly one of walletId or walletAddress.",
+  });
+
+const yieldwolfCasinoCallArgsSchema = z
+  .object({
+    walletId: z.union([z.number().int().positive(), z.string().min(1)]).optional(),
+    walletAddress: z.string().min(1).optional(),
+    method: z.enum(["GET", "POST"]).optional(),
+    path: z.string().min(1),
+    body: z.unknown().optional(),
+    query: z.record(z.string()).optional(),
+    idempotencyKey: z.string().min(1).optional(),
+  })
+  .strict()
+  .refine((data) => [data.walletId, data.walletAddress].filter((v) => v !== undefined).length === 1, {
+    message: "Provide exactly one of walletId or walletAddress.",
+  });
+
 const checkoutEscrowIdArgsSchema = z.object({
   id: z.string().min(1),
 });
@@ -473,7 +511,7 @@ function requireAgentKey() {
   return agentKey;
 }
 
-async function callAgentApi({ method, pathName, query, body, requireAuth = true }) {
+async function callAgentApi({ method, pathName, query, body, requireAuth = true, extraHeaders }) {
   const headers = {
     Accept: "application/json",
   };
@@ -488,6 +526,11 @@ async function callAgentApi({ method, pathName, query, body, requireAuth = true
   if (["POST", "PATCH", "DELETE"].includes(String(method || "").toUpperCase())) {
     headers["Idempotency-Key"] = `mcp-${Date.now()}-${Math.random().toString(16).slice(2)}`;
   }
+  if (extraHeaders && typeof extraHeaders === "object") {
+    for (const [k, v] of Object.entries(extraHeaders)) {
+      if (typeof v === "string" && v.length > 0) headers[k] = v;
+    }
+  }
 
   const url = `${getBaseUrl()}${pathName}${queryString(query || {})}`;
   const response = await fetch(url, {
@@ -607,6 +650,44 @@ const tools = [
         query: args,
       }),
   },
+  {
+    name: "policies_list",
+    description:
+      "List active governance policies (spending limits, allowlists, testnet-only, etc.) for every managed wallet accessible to this agent key. Call this before suggesting or executing transfers/swaps so requests stay inside configured limits.",
+    inputSchema: {
+      type: "object",
+      properties: {},
+      additionalProperties: false,
+    },
+    parse: (args) => policiesListArgsSchema.parse(args ?? {}),
+    execute: async () =>
+      callAgentApi({
+        method: "GET",
+        pathName: "/api/agent/policies",
+      }),
+  },
+  {
+    name: "policy_get",
+    description:
+      "Get active governance policies for one managed wallet (whitelist, spending_limit, daily/weekly/monthly_spending_limit, disallow_live_transactions, wallet_purpose, checkout_access, venue_access, max_open_escrows, trusted_counterparty_tags). Call this before suggesting or executing a transfer/swap on the wallet so the request stays inside configured limits.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        walletId: { oneOf: [{ type: "integer" }, { type: "string" }], description: selectorDescription() },
+        walletLabel: { type: "string", description: selectorDescription() },
+        walletAddress: { type: "string", description: selectorDescription() },
+        chain: { type: "string", enum: ["evm", "solana"] },
+      },
+      additionalProperties: false,
+    },
+    parse: (args) => walletSelectorSchema.parse(args ?? {}),
+    execute: async (args) =>
+      callAgentApi({
+        method: "GET",
+        pathName: "/api/agent/policy",
+        query: args,
+      }),
+  },
   {
     name: "transactions_list",
     description: "List merged transaction history for one managed wallet. EVM wallets accept optional `network` to scope to a single EVM chain (e.g. \"base-mainnet\") or `\"all\"` to merge activity across every supported EVM chain into one history. Solana wallets stay scoped to their cluster.",
@@ -962,11 +1043,11 @@ const tools = [
   },
   {
     name: "user_tag_set",
-    description: withWriteSafety("Set global checkout user tag once (immutable after set)."),
+    description: withWriteSafety("Set global checkout user tag once (immutable after set). 3-8 lowercase characters: a-z, 0-9, '.', '_', '-'."),
     inputSchema: {
       type: "object",
       properties: {
-        userTag: { type: "string" },
+        userTag: { type: "string", minLength: 3, maxLength: 8, pattern: "^[a-z0-9][a-z0-9._-]{2,7}$" },
       },
       required: ["userTag"],
       additionalProperties: false,
@@ -1641,6 +1722,80 @@ const tools = [
         body: args,
       }),
   },
+  {
+    name: "yieldwolf_casino_link",
+    description: withWriteSafety("Bind a Solana wallet to a YieldWolf Casino account. Lane is fixed at link time: 'real' = solana-mainnet (default), 'test' = solana-devnet/testnet. The response carries `proxy_base` and a runtime `instructions` payload (skill_doc, summary, flows, responsible_play, lane_note). The raw casino API key is intentionally not returned to the agent: every casino call must go through `yieldwolf_casino_call` so OpenClawCash can enforce wallet ownership, venue scope, and audit. The linked wallet is the only allowed withdrawal destination. To switch lanes later, call yieldwolf_casino_unlink and re-link."),
+    inputSchema: {
+      type: "object",
+      properties: {
+        walletId: { oneOf: [{ type: "integer" }, { type: "string" }] },
+        walletAddress: { type: "string" },
+        agentName: { type: "string", description: "Optional agent display name registered at the casino (max 64 chars)." },
+        lane: { type: "string", enum: ["real", "test"], description: "Network lane. Defaults to 'real'." },
+      },
+      additionalProperties: false,
+    },
+    parse: (args) => yieldwolfCasinoLinkArgsSchema.parse(args ?? {}),
+    execute: async (args) =>
+      callAgentApi({
+        method: "POST",
+        pathName: "/api/agent/venues/yieldwolf-casino/link",
+        body: args,
+      }),
+  },
+  {
+    name: "yieldwolf_casino_unlink",
+    description: withWriteSafety("Clear the YieldWolf Casino binding for a linked wallet."),
+    inputSchema: {
+      type: "object",
+      properties: {
+        walletId: { oneOf: [{ type: "integer" }, { type: "string" }] },
+        walletAddress: { type: "string" },
+      },
+      additionalProperties: false,
+    },
+    parse: (args) => yieldwolfCasinoUnlinkArgsSchema.parse(args ?? {}),
+    execute: async (args) =>
+      callAgentApi({
+        method: "POST",
+        pathName: "/api/agent/venues/yieldwolf-casino/unlink",
+        body: args,
+      }),
+  },
+  {
+    name: "yieldwolf_casino_call",
+    description: withWriteSafety("Generic dispatcher for a linked YieldWolf Casino wallet. Routes through OpenClawCash's proxy so wallet ownership, venue scope (read for GET, trade for non-GET), and audit are enforced server-side. `path` is the YieldWolf upstream path (multi-segment paths accepted; e.g. 'agents/me/balance', 'transactions/history', 'games', 'games/info' for reads; 'games/play', 'transactions/withdraw', 'arena/kuhn/check' for writes). `method` defaults to GET. `body` is forwarded verbatim for non-GET calls. Pass `idempotencyKey` so the casino does not double-submit a write on retry. See https://yieldwolf.finance/SKILL.md for the full upstream surface and request shapes."),
+    inputSchema: {
+      type: "object",
+      properties: {
+        walletId: { oneOf: [{ type: "integer" }, { type: "string" }] },
+        walletAddress: { type: "string" },
+        method: { type: "string", enum: ["GET", "POST"], description: "HTTP method. Defaults to GET. Use POST for writes (play, withdraw, etc.)." },
+        path: { type: "string", description: "YieldWolf upstream path under /gw/. Multi-segment paths supported (e.g. 'agents/me/balance', 'games/play', 'arena/kuhn/check')." },
+        body: { description: "Optional JSON body, forwarded verbatim to YieldWolf for non-GET calls." },
+        query: { type: "object", additionalProperties: { type: "string" }, description: "Optional extra query params forwarded to YieldWolf (walletId is added automatically)." },
+        idempotencyKey: { type: "string", description: "Optional idempotency key forwarded as X-Idempotency-Key so the casino does not double-submit a write on retry." },
+      },
+      required: ["path"],
+      additionalProperties: false,
+    },
+    parse: (args) => yieldwolfCasinoCallArgsSchema.parse(args ?? {}),
+    execute: async (args) => {
+      const upstreamPath = String(args.path).replace(/^\/+/, "");
+      const method = (args.method || "GET").toUpperCase();
+      const walletQuery =
+        args.walletId !== undefined ? { walletId: String(args.walletId) } : { walletAddress: String(args.walletAddress) };
+      const query = { ...walletQuery, ...(args.query || {}) };
+      const extraHeaders = args.idempotencyKey ? { "X-Idempotency-Key": args.idempotencyKey } : undefined;
+      return callAgentApi({
+        method,
+        pathName: `/api/agent/venues/yieldwolf-casino/proxy/${upstreamPath}`,
+        query,
+        body: method === "GET" ? undefined : args.body,
+        extraHeaders,
+      });
+    },
+  },
 ];
 
 const resources = [

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@openclawcash/mcp-server",
-  "version": "0.1.20",
-  "description": "OpenClawCash MCP server for managed agent wallets, balances, transfers, swaps, approvals, cross-chain bridges, Get Paid checkout escrow flows, and Polymarket market resolution/order tools.",
+  "version": "0.1.23",
+  "description": "OpenClawCash MCP server for managed agent wallets, balances, transfers, swaps, approvals, governance policy checks, cross-chain bridges, Get Paid checkout escrow flows, Polymarket market resolution/order tools, and YieldWolf Casino link/unlink/proxy tools.",
   "type": "module",
   "license": "Proprietary",
   "homepage": "https://openclawcash.com/mcp",