@parabolicfamily/mcp 0.1.2 → 0.1.3

package/src/server.ts

@@ -69,18 +69,23 @@ export function createServer(opts: ServerOptions = {}): McpServer {
   const whole = z.union([z.string(), z.number()]);
   const slippageBps = z.number().int().min(0).max(9999).optional().describe("Slippage tolerance in basis points used to derive the minimum output (default 100 = 1%)");
   const buyer = z.string().optional().describe("Wallet that will send the buy; when given, its snipe-tax exemption is checked on the curve");
-  const readOnly = { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true } as const;
+  // Tool arguments are validated strictly: an argument the tool does not know (a misspelling, or
+// `referral` at the top level instead of inside `memo`) is an error, not something silently dropped
+// and quietly changing what the tool does.
+const strictArgs = <T extends z.ZodRawShape>(shape: T) => z.object(shape).strict();
+
+const readOnly = { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true } as const;
 
   server.registerTool(
     "parabolic.list_coins",
     {
       title: "List Parabolic coins",
-      description: "Coins on Parabolic with status, raised / threshold / progress, price and market cap. From the subgraph when PARABOLIC_SUBGRAPH_URL is set (adds holders, 24h volume, 24h change), otherwise from a TokenLaunched log scan of the factory (newest 50).",
-      inputSchema: {
+      description: "Coins on Parabolic with status, raised / threshold / progress, price and market cap. From the subgraph when PARABOLIC_SUBGRAPH_URL is set (adds holders, 24h volume, 24h change), otherwise from Parabolic's public read API (PARABOLIC_API_URL); a TokenLaunched log scan of the factory is the last resort when both are unavailable.",
+      inputSchema: strictArgs({
         status: z.enum(["climbing", "graduated"]).optional().describe("climbing = still on the bonding curve; graduated = in its Uniswap v4 pool"),
         sort: z.enum(SORT_KEYS).optional().describe("trending (24h volume, then last trade), new (launch time), near_graduation (curve progress, climbing first), market_cap"),
         limit: z.number().int().min(1).max(100).optional().describe("Max coins to return (default 20)"),
-      },
+      }),
       annotations: readOnly,
     },
     (args) => run(() => api.listCoins(args)),
@@ -91,7 +96,7 @@ export function createServer(opts: ServerOptions = {}): McpServer {
     {
       title: "Get a Parabolic coin",
       description: "Everything about one coin, read from the factory, curve and token (plus the subgraph when configured): name, ticker, creator, curve, status/phase, raised/threshold/progress, price, market cap, holders, pool id, fee terms and split, snipe-tax window and the current snipe-tax bps.",
-      inputSchema: { address },
+      inputSchema: strictArgs({ address }),
       annotations: readOnly,
     },
     (args) => run(() => api.getCoin(args.address)),
@@ -102,7 +107,7 @@ export function createServer(opts: ServerOptions = {}): McpServer {
     {
       title: "Quote a curve buy",
       description: "Tokens received for `quoteIn` USDC (or EURC) using the curve's exact math on live reserves: fee, creator tax and snipe tax breakdown, spot vs effective price, price impact, whether the buy graduates the coin, and a suggested minTokensOut.",
-      inputSchema: { address, quoteIn: whole.describe("Quote to spend, whole units (e.g. \"50\" = 50 USDC)"), buyer, slippageBps },
+      inputSchema: strictArgs({ address, quoteIn: whole.describe("Quote to spend, whole units (e.g. \"50\" = 50 USDC)"), buyer, slippageBps }),
       annotations: readOnly,
     },
     (args) => run(() => api.quoteBuy(args)),
@@ -113,7 +118,7 @@ export function createServer(opts: ServerOptions = {}): McpServer {
     {
       title: "Quote a curve sell",
       description: "Quote received for `tokensIn` coins using the curve's exact math on live reserves: gross, fee and creator tax, effective price, price impact and a suggested minQuoteOut. Sells carry no snipe tax.",
-      inputSchema: { address, tokensIn: whole.describe("Coins to sell, whole tokens (e.g. \"1000000\")"), slippageBps },
+      inputSchema: strictArgs({ address, tokensIn: whole.describe("Coins to sell, whole tokens (e.g. \"1000000\")"), slippageBps }),
       annotations: readOnly,
     },
     (args) => run(() => api.quoteSell(args)),
@@ -124,7 +129,7 @@ export function createServer(opts: ServerOptions = {}): McpServer {
     {
       title: "Build an unsigned buy",
       description: "Unsigned `curve.buy(quoteIn, minTokensOut, recipient)` as { to, data, value, chainId } for the caller's wallet to sign. Native-USDC curves take the quote as value; EURC curves return an approval step too. Pass `memo` for the memo-routed variant (referral code in an Arc memo; EOA-only).",
-      inputSchema: {
+      inputSchema: strictArgs({
         address,
         quoteIn: whole.describe("Quote to spend, whole units"),
         minTokensOut: whole.optional().describe("Minimum coins to receive, whole tokens; derived from the live quote and slippageBps when omitted"),
@@ -132,7 +137,7 @@ export function createServer(opts: ServerOptions = {}): McpServer {
         buyer,
         slippageBps,
         memo: z.object({ referral: z.string().optional().describe("Referrer's 16-hex referral code or wallet address"), note: z.string().max(280).optional() }).optional().describe("Route through ParabolicMemoRouter via Arc's Memo contract (EOA-only, needs PARABOLIC_MEMO_ROUTER)"),
-      },
+      }),
       annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: false, openWorldHint: true },
     },
     (args) => run(() => api.buildBuyTx(args)),
@@ -143,13 +148,13 @@ export function createServer(opts: ServerOptions = {}): McpServer {
     {
       title: "Build an unsigned sell",
       description: "Unsigned ERC-20 approval plus `curve.sell(tokensIn, minQuoteOut, recipient)` as { to, data, value, chainId } for the caller's wallet to sign.",
-      inputSchema: {
+      inputSchema: strictArgs({
         address,
         tokensIn: whole.describe("Coins to sell, whole tokens"),
         minQuoteOut: whole.optional().describe("Minimum quote to receive, whole units; derived from the live quote and slippageBps when omitted"),
         recipient: z.string().describe("Address that receives the quote (normally the signer)"),
         slippageBps,
-      },
+      }),
       annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: false, openWorldHint: true },
     },
     (args) => run(() => api.buildSellTx(args)),
@@ -160,7 +165,7 @@ export function createServer(opts: ServerOptions = {}): McpServer {
     {
       title: "Build an unsigned launch",
       description: "Unsigned `factory.launchToken(TokenParams, launchConfigId, pairToken)` with the launch fee as value, using the same TokenParams shape as the web Create form (expectedEconomics pinned from the factory, random salt). Optional devBuy returns the follow-up buy calldata for the creator to send once the curve address is known.",
-      inputSchema: {
+      inputSchema: strictArgs({
         name: z.string().min(1).max(64),
         ticker: z.string().min(1).max(16).describe("Symbol, letters and digits"),
         image: z.string().max(512).optional().describe("https:// or ipfs:// pointer to a square image"),
@@ -171,7 +176,7 @@ export function createServer(opts: ServerOptions = {}): McpServer {
         creatorTaxBps: z.number().int().min(0).max(1000).optional().describe("Creator tax in basis points, 0–500 (5%) on the adopted parameters"),
         creator: z.string().describe("Wallet that signs the launch; becomes deployer and creatorFeeRecipient"),
         buybackEnabled: z.boolean().optional().describe("Default true"),
-      },
+      }),
       annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: false, openWorldHint: true },
     },
     (args) => run(() => api.buildLaunchTx(args)),