@scriptmasterlabs/mcp-x402 2.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (304) hide show
  1. package/.env.example +35 -0
  2. package/.github/workflows/ci.yml +59 -0
  3. package/.github/workflows/keepalive.yml +31 -0
  4. package/.well-known/agentcard.json +34 -0
  5. package/CONTRIBUTING.md +76 -0
  6. package/Dockerfile +19 -0
  7. package/LICENSE +21 -0
  8. package/README.md +304 -0
  9. package/agents.json +67 -0
  10. package/dist/lib/chains/base.d.ts +10 -0
  11. package/dist/lib/chains/base.d.ts.map +1 -0
  12. package/dist/lib/chains/base.js +73 -0
  13. package/dist/lib/chains/base.js.map +1 -0
  14. package/dist/lib/chains/solana.d.ts +10 -0
  15. package/dist/lib/chains/solana.d.ts.map +1 -0
  16. package/dist/lib/chains/solana.js +49 -0
  17. package/dist/lib/chains/solana.js.map +1 -0
  18. package/dist/lib/chains/xrpl.d.ts +10 -0
  19. package/dist/lib/chains/xrpl.d.ts.map +1 -0
  20. package/dist/lib/chains/xrpl.js +55 -0
  21. package/dist/lib/chains/xrpl.js.map +1 -0
  22. package/dist/lib/credit/bureau.d.ts +10 -0
  23. package/dist/lib/credit/bureau.d.ts.map +1 -0
  24. package/dist/lib/credit/bureau.js +58 -0
  25. package/dist/lib/credit/bureau.js.map +1 -0
  26. package/dist/lib/sml-api/agentcard.d.ts +17 -0
  27. package/dist/lib/sml-api/agentcard.d.ts.map +1 -0
  28. package/dist/lib/sml-api/agentcard.js +30 -0
  29. package/dist/lib/sml-api/agentcard.js.map +1 -0
  30. package/dist/lib/sml-api/backtest.d.ts +22 -0
  31. package/dist/lib/sml-api/backtest.d.ts.map +1 -0
  32. package/dist/lib/sml-api/backtest.js +28 -0
  33. package/dist/lib/sml-api/backtest.js.map +1 -0
  34. package/dist/lib/sml-api/brokers.d.ts +40 -0
  35. package/dist/lib/sml-api/brokers.d.ts.map +1 -0
  36. package/dist/lib/sml-api/brokers.js +128 -0
  37. package/dist/lib/sml-api/brokers.js.map +1 -0
  38. package/dist/lib/sml-api/copytrader.d.ts +11 -0
  39. package/dist/lib/sml-api/copytrader.d.ts.map +1 -0
  40. package/dist/lib/sml-api/copytrader.js +30 -0
  41. package/dist/lib/sml-api/copytrader.js.map +1 -0
  42. package/dist/lib/sml-api/crawl.d.ts +20 -0
  43. package/dist/lib/sml-api/crawl.d.ts.map +1 -0
  44. package/dist/lib/sml-api/crawl.js +32 -0
  45. package/dist/lib/sml-api/crawl.js.map +1 -0
  46. package/dist/lib/sml-api/echo.d.ts +10 -0
  47. package/dist/lib/sml-api/echo.d.ts.map +1 -0
  48. package/dist/lib/sml-api/echo.js +23 -0
  49. package/dist/lib/sml-api/echo.js.map +1 -0
  50. package/dist/lib/sml-api/forge.d.ts +11 -0
  51. package/dist/lib/sml-api/forge.d.ts.map +1 -0
  52. package/dist/lib/sml-api/forge.js +29 -0
  53. package/dist/lib/sml-api/forge.js.map +1 -0
  54. package/dist/lib/sml-api/ftd.d.ts +18 -0
  55. package/dist/lib/sml-api/ftd.d.ts.map +1 -0
  56. package/dist/lib/sml-api/ftd.js +43 -0
  57. package/dist/lib/sml-api/ftd.js.map +1 -0
  58. package/dist/lib/sml-api/ghost.d.ts +13 -0
  59. package/dist/lib/sml-api/ghost.d.ts.map +1 -0
  60. package/dist/lib/sml-api/ghost.js +29 -0
  61. package/dist/lib/sml-api/ghost.js.map +1 -0
  62. package/dist/lib/sml-api/launchpad.d.ts +20 -0
  63. package/dist/lib/sml-api/launchpad.d.ts.map +1 -0
  64. package/dist/lib/sml-api/launchpad.js +31 -0
  65. package/dist/lib/sml-api/launchpad.js.map +1 -0
  66. package/dist/lib/sml-api/leviathan.d.ts +22 -0
  67. package/dist/lib/sml-api/leviathan.d.ts.map +1 -0
  68. package/dist/lib/sml-api/leviathan.js +33 -0
  69. package/dist/lib/sml-api/leviathan.js.map +1 -0
  70. package/dist/lib/sml-api/nexus.d.ts +18 -0
  71. package/dist/lib/sml-api/nexus.d.ts.map +1 -0
  72. package/dist/lib/sml-api/nexus.js +40 -0
  73. package/dist/lib/sml-api/nexus.js.map +1 -0
  74. package/dist/lib/sml-api/proof402.d.ts +6 -0
  75. package/dist/lib/sml-api/proof402.d.ts.map +1 -0
  76. package/dist/lib/sml-api/proof402.js +30 -0
  77. package/dist/lib/sml-api/proof402.js.map +1 -0
  78. package/dist/lib/sml-api/rails.d.ts +12 -0
  79. package/dist/lib/sml-api/rails.d.ts.map +1 -0
  80. package/dist/lib/sml-api/rails.js +29 -0
  81. package/dist/lib/sml-api/rails.js.map +1 -0
  82. package/dist/lib/sml-api/shadow.d.ts +15 -0
  83. package/dist/lib/sml-api/shadow.d.ts.map +1 -0
  84. package/dist/lib/sml-api/shadow.js +27 -0
  85. package/dist/lib/sml-api/shadow.js.map +1 -0
  86. package/dist/lib/sml-api/squeezeos.d.ts +21 -0
  87. package/dist/lib/sml-api/squeezeos.d.ts.map +1 -0
  88. package/dist/lib/sml-api/squeezeos.js +97 -0
  89. package/dist/lib/sml-api/squeezeos.js.map +1 -0
  90. package/dist/lib/sml-api/xdeo.d.ts +13 -0
  91. package/dist/lib/sml-api/xdeo.d.ts.map +1 -0
  92. package/dist/lib/sml-api/xdeo.js +34 -0
  93. package/dist/lib/sml-api/xdeo.js.map +1 -0
  94. package/dist/lib/sml-api/xmit.d.ts +13 -0
  95. package/dist/lib/sml-api/xmit.d.ts.map +1 -0
  96. package/dist/lib/sml-api/xmit.js +34 -0
  97. package/dist/lib/sml-api/xmit.js.map +1 -0
  98. package/dist/server/health.d.ts +16 -0
  99. package/dist/server/health.d.ts.map +1 -0
  100. package/dist/server/health.js +39 -0
  101. package/dist/server/health.js.map +1 -0
  102. package/dist/server/index.d.ts +3 -0
  103. package/dist/server/index.d.ts.map +1 -0
  104. package/dist/server/index.js +193 -0
  105. package/dist/server/index.js.map +1 -0
  106. package/dist/server/payments/ap2.d.ts +17 -0
  107. package/dist/server/payments/ap2.d.ts.map +1 -0
  108. package/dist/server/payments/ap2.js +75 -0
  109. package/dist/server/payments/ap2.js.map +1 -0
  110. package/dist/server/payments/receipt.d.ts +28 -0
  111. package/dist/server/payments/receipt.d.ts.map +1 -0
  112. package/dist/server/payments/receipt.js +60 -0
  113. package/dist/server/payments/receipt.js.map +1 -0
  114. package/dist/server/payments/router.d.ts +23 -0
  115. package/dist/server/payments/router.d.ts.map +1 -0
  116. package/dist/server/payments/router.js +69 -0
  117. package/dist/server/payments/router.js.map +1 -0
  118. package/dist/server/payments/wallet.d.ts +18 -0
  119. package/dist/server/payments/wallet.d.ts.map +1 -0
  120. package/dist/server/payments/wallet.js +107 -0
  121. package/dist/server/payments/wallet.js.map +1 -0
  122. package/dist/server/payments/x402.d.ts +29 -0
  123. package/dist/server/payments/x402.d.ts.map +1 -0
  124. package/dist/server/payments/x402.js +122 -0
  125. package/dist/server/payments/x402.js.map +1 -0
  126. package/dist/server/registry/catalog.d.ts +12 -0
  127. package/dist/server/registry/catalog.d.ts.map +1 -0
  128. package/dist/server/registry/catalog.js +55 -0
  129. package/dist/server/registry/catalog.js.map +1 -0
  130. package/dist/server/registry/discovery.d.ts +16 -0
  131. package/dist/server/registry/discovery.d.ts.map +1 -0
  132. package/dist/server/registry/discovery.js +33 -0
  133. package/dist/server/registry/discovery.js.map +1 -0
  134. package/dist/server/registry/pricing.d.ts +10 -0
  135. package/dist/server/registry/pricing.d.ts.map +1 -0
  136. package/dist/server/registry/pricing.js +66 -0
  137. package/dist/server/registry/pricing.js.map +1 -0
  138. package/dist/server/security/acl.d.ts +28 -0
  139. package/dist/server/security/acl.d.ts.map +1 -0
  140. package/dist/server/security/acl.js +36 -0
  141. package/dist/server/security/acl.js.map +1 -0
  142. package/dist/server/security/audit.d.ts +15 -0
  143. package/dist/server/security/audit.d.ts.map +1 -0
  144. package/dist/server/security/audit.js +77 -0
  145. package/dist/server/security/audit.js.map +1 -0
  146. package/dist/server/security/rate-limit.d.ts +12 -0
  147. package/dist/server/security/rate-limit.d.ts.map +1 -0
  148. package/dist/server/security/rate-limit.js +72 -0
  149. package/dist/server/security/rate-limit.js.map +1 -0
  150. package/dist/server/security/sandbox.d.ts +7 -0
  151. package/dist/server/security/sandbox.d.ts.map +1 -0
  152. package/dist/server/security/sandbox.js +42 -0
  153. package/dist/server/security/sandbox.js.map +1 -0
  154. package/dist/server/tools/agentcard.d.ts +3 -0
  155. package/dist/server/tools/agentcard.d.ts.map +1 -0
  156. package/dist/server/tools/agentcard.js +118 -0
  157. package/dist/server/tools/agentcard.js.map +1 -0
  158. package/dist/server/tools/backtest.d.ts +3 -0
  159. package/dist/server/tools/backtest.d.ts.map +1 -0
  160. package/dist/server/tools/backtest.js +112 -0
  161. package/dist/server/tools/backtest.js.map +1 -0
  162. package/dist/server/tools/brokers.d.ts +3 -0
  163. package/dist/server/tools/brokers.d.ts.map +1 -0
  164. package/dist/server/tools/brokers.js +223 -0
  165. package/dist/server/tools/brokers.js.map +1 -0
  166. package/dist/server/tools/copytrader.d.ts +3 -0
  167. package/dist/server/tools/copytrader.d.ts.map +1 -0
  168. package/dist/server/tools/copytrader.js +90 -0
  169. package/dist/server/tools/copytrader.js.map +1 -0
  170. package/dist/server/tools/crawl.d.ts +3 -0
  171. package/dist/server/tools/crawl.d.ts.map +1 -0
  172. package/dist/server/tools/crawl.js +60 -0
  173. package/dist/server/tools/crawl.js.map +1 -0
  174. package/dist/server/tools/discovery.d.ts +3 -0
  175. package/dist/server/tools/discovery.d.ts.map +1 -0
  176. package/dist/server/tools/discovery.js +188 -0
  177. package/dist/server/tools/discovery.js.map +1 -0
  178. package/dist/server/tools/echo.d.ts +3 -0
  179. package/dist/server/tools/echo.d.ts.map +1 -0
  180. package/dist/server/tools/echo.js +48 -0
  181. package/dist/server/tools/echo.js.map +1 -0
  182. package/dist/server/tools/forge.d.ts +3 -0
  183. package/dist/server/tools/forge.d.ts.map +1 -0
  184. package/dist/server/tools/forge.js +77 -0
  185. package/dist/server/tools/forge.js.map +1 -0
  186. package/dist/server/tools/ftd.d.ts +3 -0
  187. package/dist/server/tools/ftd.d.ts.map +1 -0
  188. package/dist/server/tools/ftd.js +70 -0
  189. package/dist/server/tools/ftd.js.map +1 -0
  190. package/dist/server/tools/ghost.d.ts +3 -0
  191. package/dist/server/tools/ghost.d.ts.map +1 -0
  192. package/dist/server/tools/ghost.js +83 -0
  193. package/dist/server/tools/ghost.js.map +1 -0
  194. package/dist/server/tools/index.d.ts +3 -0
  195. package/dist/server/tools/index.d.ts.map +1 -0
  196. package/dist/server/tools/index.js +44 -0
  197. package/dist/server/tools/index.js.map +1 -0
  198. package/dist/server/tools/launchpad.d.ts +3 -0
  199. package/dist/server/tools/launchpad.d.ts.map +1 -0
  200. package/dist/server/tools/launchpad.js +151 -0
  201. package/dist/server/tools/launchpad.js.map +1 -0
  202. package/dist/server/tools/leviathan.d.ts +3 -0
  203. package/dist/server/tools/leviathan.d.ts.map +1 -0
  204. package/dist/server/tools/leviathan.js +73 -0
  205. package/dist/server/tools/leviathan.js.map +1 -0
  206. package/dist/server/tools/nexus.d.ts +3 -0
  207. package/dist/server/tools/nexus.d.ts.map +1 -0
  208. package/dist/server/tools/nexus.js +65 -0
  209. package/dist/server/tools/nexus.js.map +1 -0
  210. package/dist/server/tools/proof402.d.ts +3 -0
  211. package/dist/server/tools/proof402.d.ts.map +1 -0
  212. package/dist/server/tools/proof402.js +74 -0
  213. package/dist/server/tools/proof402.js.map +1 -0
  214. package/dist/server/tools/rails.d.ts +3 -0
  215. package/dist/server/tools/rails.d.ts.map +1 -0
  216. package/dist/server/tools/rails.js +82 -0
  217. package/dist/server/tools/rails.js.map +1 -0
  218. package/dist/server/tools/shadow.d.ts +3 -0
  219. package/dist/server/tools/shadow.d.ts.map +1 -0
  220. package/dist/server/tools/shadow.js +114 -0
  221. package/dist/server/tools/shadow.js.map +1 -0
  222. package/dist/server/tools/squeezeos.d.ts +3 -0
  223. package/dist/server/tools/squeezeos.d.ts.map +1 -0
  224. package/dist/server/tools/squeezeos.js +231 -0
  225. package/dist/server/tools/squeezeos.js.map +1 -0
  226. package/dist/server/tools/xdeo.d.ts +3 -0
  227. package/dist/server/tools/xdeo.d.ts.map +1 -0
  228. package/dist/server/tools/xdeo.js +58 -0
  229. package/dist/server/tools/xdeo.js.map +1 -0
  230. package/dist/server/tools/xmit.d.ts +3 -0
  231. package/dist/server/tools/xmit.d.ts.map +1 -0
  232. package/dist/server/tools/xmit.js +59 -0
  233. package/dist/server/tools/xmit.js.map +1 -0
  234. package/docker-compose.yml +50 -0
  235. package/llms.txt +70 -0
  236. package/package.json +77 -0
  237. package/render.yaml +39 -0
  238. package/sdk/mcp-x402-sdk/package.json +18 -0
  239. package/sdk/mcp-x402-sdk/src/index.ts +118 -0
  240. package/sdk/mcp-x402-sdk/tsconfig.json +14 -0
  241. package/server.json +60 -0
  242. package/services/backtest_service.py +176 -0
  243. package/src/lib/chains/base.ts +77 -0
  244. package/src/lib/chains/solana.ts +59 -0
  245. package/src/lib/chains/xrpl.ts +63 -0
  246. package/src/lib/credit/bureau.ts +65 -0
  247. package/src/lib/sml-api/agentcard.ts +40 -0
  248. package/src/lib/sml-api/backtest.ts +47 -0
  249. package/src/lib/sml-api/brokers.ts +160 -0
  250. package/src/lib/sml-api/copytrader.ts +33 -0
  251. package/src/lib/sml-api/crawl.ts +44 -0
  252. package/src/lib/sml-api/echo.ts +28 -0
  253. package/src/lib/sml-api/forge.ts +33 -0
  254. package/src/lib/sml-api/ftd.ts +53 -0
  255. package/src/lib/sml-api/ghost.ts +35 -0
  256. package/src/lib/sml-api/launchpad.ts +43 -0
  257. package/src/lib/sml-api/leviathan.ts +49 -0
  258. package/src/lib/sml-api/nexus.ts +50 -0
  259. package/src/lib/sml-api/proof402.ts +27 -0
  260. package/src/lib/sml-api/rails.ts +34 -0
  261. package/src/lib/sml-api/shadow.ts +35 -0
  262. package/src/lib/sml-api/squeezeos.ts +95 -0
  263. package/src/lib/sml-api/xdeo.ts +40 -0
  264. package/src/lib/sml-api/xmit.ts +40 -0
  265. package/src/server/health.ts +52 -0
  266. package/src/server/index.ts +206 -0
  267. package/src/server/payments/ap2.ts +99 -0
  268. package/src/server/payments/receipt.ts +85 -0
  269. package/src/server/payments/router.ts +110 -0
  270. package/src/server/payments/wallet.ts +123 -0
  271. package/src/server/payments/x402.ts +162 -0
  272. package/src/server/registry/catalog.ts +61 -0
  273. package/src/server/registry/discovery.ts +39 -0
  274. package/src/server/registry/pricing.ts +76 -0
  275. package/src/server/security/acl.ts +42 -0
  276. package/src/server/security/audit.ts +94 -0
  277. package/src/server/security/rate-limit.ts +84 -0
  278. package/src/server/security/sandbox.ts +40 -0
  279. package/src/server/tools/agentcard.ts +134 -0
  280. package/src/server/tools/backtest.ts +119 -0
  281. package/src/server/tools/brokers.ts +250 -0
  282. package/src/server/tools/copytrader.ts +104 -0
  283. package/src/server/tools/crawl.ts +70 -0
  284. package/src/server/tools/discovery.ts +202 -0
  285. package/src/server/tools/echo.ts +58 -0
  286. package/src/server/tools/forge.ts +87 -0
  287. package/src/server/tools/ftd.ts +88 -0
  288. package/src/server/tools/ghost.ts +93 -0
  289. package/src/server/tools/index.ts +42 -0
  290. package/src/server/tools/launchpad.ts +173 -0
  291. package/src/server/tools/leviathan.ts +81 -0
  292. package/src/server/tools/nexus.ts +76 -0
  293. package/src/server/tools/proof402.ts +87 -0
  294. package/src/server/tools/rails.ts +92 -0
  295. package/src/server/tools/shadow.ts +128 -0
  296. package/src/server/tools/squeezeos.ts +312 -0
  297. package/src/server/tools/xdeo.ts +67 -0
  298. package/src/server/tools/xmit.ts +68 -0
  299. package/tests/integration/e2e.test.ts +51 -0
  300. package/tests/unit/payments.test.ts +49 -0
  301. package/tests/unit/security.test.ts +92 -0
  302. package/tests/unit/tools.test.ts +42 -0
  303. package/tsconfig.json +21 -0
  304. package/vitest.config.ts +20 -0
package/.env.example ADDED
@@ -0,0 +1,35 @@
1
+ # === TRANSPORT ===
2
+ # stdio (default, for Claude Code) or sse (remote/Cursor)
3
+ MCP_TRANSPORT=stdio
4
+ MCP_SSE_PORT=3402
5
+
6
+ # === SML API ===
7
+ # Base URL for ScriptMasterLabs APIs
8
+ SML_API_BASE=https://api.scriptmasterlabs.com
9
+ SML_MTLS_CERT_PATH=./certs/client.crt
10
+ SML_MTLS_KEY_PATH=./certs/client.key
11
+ SML_MTLS_CA_PATH=./certs/sml-ca.crt
12
+
13
+ # === WALLET (stored in OS keychain — env only for CI/testnet) ===
14
+ # NEVER use in production — use OS keychain instead
15
+ # CI_WALLET_SEED=your-bip39-mnemonic-here
16
+
17
+ # === CHAINS ===
18
+ BASE_RPC_URL=https://mainnet.base.org
19
+ BASE_SEPOLIA_RPC_URL=https://sepolia.base.org
20
+ XRPL_RPC_URL=wss://xrplcluster.com
21
+ SOLANA_RPC_URL=https://api.mainnet-beta.solana.com
22
+
23
+ # === SPEND LIMITS ===
24
+ DAILY_SPEND_CAP_USD=50
25
+ AUTO_APPROVE_THRESHOLD_USD=1
26
+ PRICE_CACHE_TTL_MS=60000
27
+
28
+ # === AUDIT ===
29
+ AUDIT_LOG_PATH=./audit.log
30
+
31
+ # === CREDIT BUREAU ===
32
+ MIN_CREDIT_SCORE=300
33
+
34
+ # === TESTNET ===
35
+ TESTNET=false
@@ -0,0 +1,59 @@
1
+ name: mcp-x402 CI
2
+
3
+ on:
4
+ push:
5
+ paths:
6
+ - 'mcp-x402/**'
7
+ pull_request:
8
+ paths:
9
+ - 'mcp-x402/**'
10
+
11
+ defaults:
12
+ run:
13
+ working-directory: mcp-x402
14
+
15
+ jobs:
16
+ test:
17
+ runs-on: ubuntu-latest
18
+ steps:
19
+ - uses: actions/checkout@v4
20
+
21
+ - uses: actions/setup-node@v4
22
+ with:
23
+ node-version: '22'
24
+ cache: 'npm'
25
+ cache-dependency-path: mcp-x402/package-lock.json
26
+
27
+ - name: Install dependencies
28
+ run: npm ci --ignore-scripts
29
+
30
+ - name: Type check
31
+ run: npm run typecheck
32
+
33
+ - name: Unit tests
34
+ run: npm run test:unit
35
+
36
+ - name: Upload coverage
37
+ uses: codecov/codecov-action@v4
38
+ with:
39
+ directory: mcp-x402/coverage
40
+ flags: mcp-x402
41
+ continue-on-error: true
42
+
43
+ build:
44
+ runs-on: ubuntu-latest
45
+ steps:
46
+ - uses: actions/checkout@v4
47
+
48
+ - uses: actions/setup-node@v4
49
+ with:
50
+ node-version: '22'
51
+
52
+ - name: Install dependencies
53
+ run: npm ci --ignore-scripts
54
+
55
+ - name: Build
56
+ run: npm run build
57
+
58
+ - name: Docker build
59
+ run: docker build -t mcp-x402:ci .
@@ -0,0 +1,31 @@
1
+ name: mcp-x402 Keepalive
2
+
3
+ # Pings the SSE health endpoint every 14 minutes to prevent cold starts
4
+ # on free-tier Render instances (which sleep after 15 minutes of inactivity).
5
+ on:
6
+ schedule:
7
+ - cron: '*/14 * * * *' # every 14 minutes, 24/7
8
+ workflow_dispatch: # allow manual trigger
9
+
10
+ jobs:
11
+ ping:
12
+ runs-on: ubuntu-latest
13
+ timeout-minutes: 2
14
+ steps:
15
+ - name: Ping mcp-x402 health endpoint
16
+ env:
17
+ MCP_X402_URL: ${{ secrets.MCP_X402_URL }}
18
+ run: |
19
+ URL="${MCP_X402_URL:-https://mcp-x402.scriptmasterlabs.com}"
20
+ STATUS=$(curl -s -o /dev/null -w "%{http_code}" --max-time 30 "${URL}/health")
21
+ echo "Health check HTTP ${STATUS} — ${URL}/health"
22
+ if [ "$STATUS" != "200" ]; then
23
+ echo "::warning::Health check returned HTTP ${STATUS}. Service may be degraded."
24
+ fi
25
+
26
+ - name: Ping SqueezeOS keepalive (ecosystem dependency)
27
+ run: |
28
+ curl -s --max-time 30 https://squeezeos-api.onrender.com/api/status > /dev/null || true
29
+ curl -s --max-time 30 https://four02proof.onrender.com/health > /dev/null || true
30
+ curl -s --max-time 30 https://ghost-layer.onrender.com/health > /dev/null || true
31
+ echo "Ecosystem keepalives sent."
@@ -0,0 +1,34 @@
1
+ {
2
+ "schema_version": "agentcard/v1",
3
+ "id": "mcp-x402.scriptmasterlabs.com",
4
+ "name": "mcp-x402",
5
+ "description": "ScriptMasterLabs autonomous payment MCP server. Institutional financial intelligence via x402.",
6
+ "version": "1.0.0",
7
+ "author": {
8
+ "name": "ScriptMasterLabs",
9
+ "url": "https://scriptmasterlabs.com",
10
+ "did": "did:web:scriptmasterlabs.com"
11
+ },
12
+ "capabilities": [
13
+ "x402-payment",
14
+ "ap2-mandate",
15
+ "multi-chain",
16
+ "credit-bureau",
17
+ "mcp-stdio",
18
+ "mcp-sse"
19
+ ],
20
+ "endpoints": {
21
+ "mcp": "https://mcp-x402.scriptmasterlabs.com",
22
+ "health": "https://mcp-x402.scriptmasterlabs.com/health",
23
+ "agents": "https://mcp-x402.scriptmasterlabs.com/agents.json",
24
+ "llms": "https://mcp-x402.scriptmasterlabs.com/llms.txt"
25
+ },
26
+ "payment": {
27
+ "protocol": "x402",
28
+ "proof_endpoint": "https://four02proof.onrender.com/v1/receipt"
29
+ },
30
+ "identity": {
31
+ "verification": "ed25519",
32
+ "public_key_url": "https://mcp-x402.scriptmasterlabs.com/.well-known/public-key.pem"
33
+ }
34
+ }
@@ -0,0 +1,76 @@
1
+ # Contributing to mcp-x402
2
+
3
+ Thank you for contributing to the first MCP server that pays for itself.
4
+
5
+ ## Values (SDVOSB)
6
+
7
+ ScriptMasterLabs is a Service-Disabled Veteran-Owned Small Business (SDVOSB). We hold these values:
8
+
9
+ - **Integrity** — No fake data, no simulated values, no shortcuts.
10
+ - **Transparency** — Every line of code is auditable. Every dollar spent is receipted.
11
+ - **Accountability** — If a payment goes through, there's a SHA-256 chained audit entry.
12
+ - **Service** — We build for operators and agents who need institutional-grade tools.
13
+
14
+ ## Getting Started
15
+
16
+ ```bash
17
+ git clone https://github.com/timwal78/sml_portfolio
18
+ cd mcp-x402
19
+ npm install
20
+ npm run build
21
+ npm test
22
+ ```
23
+
24
+ ## Non-Negotiables (from the build spec)
25
+
26
+ Before opening a PR, verify:
27
+
28
+ - [ ] N1: No private keys stored outside OS keychain
29
+ - [ ] N2: mTLS configured on all SML API calls
30
+ - [ ] N3: No PII or raw filing content in logs
31
+ - [ ] N4: Zod validation on 100% of new inputs
32
+ - [ ] N5: Audit log entries are SHA-256 HMAC chained
33
+ - [ ] N6: AP2 mandate verified before every paid call
34
+ - [ ] N7: 402Proof receipt returned with every transaction
35
+ - [ ] N8: Credit Bureau score checked for auto-approve
36
+ - [ ] N9: $50 daily spend cap enforced
37
+ - [ ] N10: Integration tests use Base Sepolia only
38
+ - [ ] N11: End-to-end latency target <3s on Base
39
+ - [ ] N12: Price cache refreshed within 60s
40
+ - [ ] N13: Multi-chain fallback within 500ms
41
+
42
+ ## Code Style
43
+
44
+ - TypeScript strict mode. No `any`.
45
+ - Zod schemas for every external input.
46
+ - No `eval()`, no `Function()`, no `require()` with dynamic strings.
47
+ - No raw SQL (if DB is ever added, use parameterized queries).
48
+ - Comments only when the WHY is non-obvious.
49
+
50
+ ## Pull Request Checklist
51
+
52
+ - [ ] `npm run typecheck` passes
53
+ - [ ] `npm test` passes with 90%+ coverage
54
+ - [ ] No new dependencies without justification
55
+ - [ ] Security: no new environment variable fallbacks for secrets
56
+ - [ ] Updated `CATALOG` and `agents.json` if adding a new tool
57
+ - [ ] Tool count in README updated
58
+
59
+ ## Adding a New Tool
60
+
61
+ 1. Add to `src/server/tools/<name>.ts`
62
+ 2. Register in `src/server/tools/index.ts`
63
+ 3. Add SML API client in `src/lib/sml-api/<name>.ts`
64
+ 4. Add to `CATALOG` in `src/server/registry/catalog.ts`
65
+ 5. Add price to `BASE_PRICES` in `src/server/registry/pricing.ts`
66
+ 6. Update `agents.json` and `llms.txt`
67
+ 7. Add unit tests in `tests/unit/tools.test.ts`
68
+
69
+ ## Reporting Security Issues
70
+
71
+ Email: timothy.walton45@gmail.com
72
+ Do NOT open a public GitHub issue for security vulnerabilities.
73
+
74
+ ## License
75
+
76
+ MIT. All contributions are MIT licensed.
package/Dockerfile ADDED
@@ -0,0 +1,19 @@
1
+ FROM node:22-alpine AS builder
2
+ WORKDIR /app
3
+ COPY package*.json ./
4
+ RUN npm ci --ignore-scripts
5
+ COPY tsconfig.json ./
6
+ COPY src/ ./src/
7
+ RUN npm run build
8
+
9
+ FROM node:22-alpine AS runner
10
+ WORKDIR /app
11
+ RUN apk add --no-cache dbus libsecret
12
+ COPY package*.json ./
13
+ RUN npm ci --omit=dev --ignore-scripts
14
+ COPY --from=builder /app/dist ./dist
15
+ COPY agents.json llms.txt .well-known/ ./
16
+ EXPOSE 3402
17
+ ENV NODE_ENV=production
18
+ USER node
19
+ CMD ["node", "dist/server/index.js"]
package/LICENSE ADDED
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2026 ScriptMasterLabs
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.
package/README.md ADDED
@@ -0,0 +1,304 @@
1
+ # mcp-x402 — The First MCP Server That Pays for Itself
2
+
3
+ [![npm](https://img.shields.io/npm/v/@scriptmasterlabs/mcp-x402)](https://www.npmjs.com/package/@scriptmasterlabs/mcp-x402)
4
+ [![MIT License](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
5
+ [![Tests](https://github.com/timwal78/sml_portfolio/actions/workflows/mcp-x402-ci.yml/badge.svg)](https://github.com/timwal78/sml_portfolio/actions)
6
+
7
+ > **Demo video:** [30-second walkthrough](#) — coming within 48h of launch.
8
+
9
+ AI agents should pay for their own data — instantly, autonomously, compliantly. `mcp-x402` makes that real.
10
+
11
+ ```bash
12
+ npx @scriptmasterlabs/mcp-x402
13
+ ```
14
+
15
+ ---
16
+
17
+ ## Why MCP Servers Are Broken (The Manifesto)
18
+
19
+ Every MCP server connecting to paid APIs today requires:
20
+ - A human to set up API keys
21
+ - A human to manage billing
22
+ - A human to top up credits when they run out
23
+ - A human to rotate keys when they expire
24
+
25
+ This defeats the entire point of autonomous agents. If your agent has to stop and ask a human for a credit card, it's not autonomous — it's a very expensive chatbot.
26
+
27
+ **We built the machine-native alternative.**
28
+
29
+ `mcp-x402` is the first MCP server where agents provision their own wallets, negotiate prices on-chain, pay autonomously, and receive cryptographic receipts — all without human intervention. The agent's credit score goes up every time it successfully transacts. It builds financial reputation the same way humans do.
30
+
31
+ This is the infrastructure layer that makes truly autonomous AI agents possible.
32
+
33
+ ---
34
+
35
+ ## One-Line Install
36
+
37
+ ```bash
38
+ npm i -g @scriptmasterlabs/mcp-x402
39
+ ```
40
+
41
+ Add to your Claude Code `~/.claude/config.json`:
42
+
43
+ ```json
44
+ {
45
+ "mcpServers": {
46
+ "sml": {
47
+ "command": "npx",
48
+ "args": ["@scriptmasterlabs/mcp-x402"]
49
+ }
50
+ }
51
+ }
52
+ ```
53
+
54
+ For Cursor (SSE mode), add to your MCP settings:
55
+
56
+ ```json
57
+ {
58
+ "mcp-x402": {
59
+ "url": "http://localhost:3402/sse"
60
+ }
61
+ }
62
+ ```
63
+
64
+ Then run: `MCP_TRANSPORT=sse npx @scriptmasterlabs/mcp-x402`
65
+
66
+ ---
67
+
68
+ ## Architecture
69
+
70
+ ```
71
+ Claude / Cursor
72
+
73
+ ▼ MCP Protocol (stdio / SSE)
74
+ mcp-x402 Server
75
+ ├─ Input validation (Zod, 100% coverage)
76
+ ├─ Rate limiter (100/min per tool)
77
+ ├─ AP2 Mandate check (deny-by-default)
78
+ ├─ Credit Bureau check (min score 300)
79
+ ├─ Price registry (60s max cache)
80
+ ├─ x402 payment engine
81
+ │ ├─ Base USDC (preferred, <3s)
82
+ │ ├─ XRPL RLUSD (500ms fallback)
83
+ │ └─ Solana USDC (last resort)
84
+ ├─ 402Proof receipt generation
85
+ ├─ SML API call (mTLS)
86
+ └─ Append-only SHA-256 audit log
87
+
88
+ ▼ Result + receipt_id back to agent
89
+ ```
90
+
91
+ ---
92
+
93
+ ## The 6 Tools
94
+
95
+ ### `leviathan_signal` — $0.05 USDC | AP2 required
96
+ Institutional-grade squeeze signals. Multi-engine verdict (OracleEngine + RDT + SML Fractal Cascade).
97
+
98
+ ```typescript
99
+ await use_mcp_tool('sml', 'leviathan_signal', {
100
+ ticker: 'MSTR',
101
+ signal_type: 'squeeze',
102
+ min_confidence: 75
103
+ });
104
+ // Returns: signal verdict + confidence + receipt_id
105
+ ```
106
+
107
+ ### `xmit_edgar_decode` — $0.02 USDC | AP2 required
108
+ Parse SEC DEF 14A / 13F / 13D filings. Raw text never leaves SML servers.
109
+
110
+ ```typescript
111
+ await use_mcp_tool('sml', 'xmit_edgar_decode', {
112
+ filing_url: 'https://www.sec.gov/Archives/edgar/data/...',
113
+ parse_target: 'executive_pay',
114
+ format: 'json'
115
+ });
116
+ ```
117
+
118
+ ### `xdeo_earnings_estimate` — $0.02 USDC | AP2 required
119
+ Decentralized earnings oracle. Earns +2 Credit Bureau points per successful call.
120
+
121
+ ```typescript
122
+ await use_mcp_tool('sml', 'xdeo_earnings_estimate', {
123
+ ticker: 'NVDA',
124
+ fiscal_quarter: 'Q12025',
125
+ estimate_type: 'all'
126
+ });
127
+ ```
128
+
129
+ ### `ftd_threshold_scan` — Alerts FREE / Full $0.05 USDC
130
+ SEC Reg SHO FTD spike detection. 15-minute cache.
131
+
132
+ ```typescript
133
+ // Free tier:
134
+ await use_mcp_tool('sml', 'ftd_threshold_scan', { scan_type: 'alerts' });
135
+ // Paid tier:
136
+ await use_mcp_tool('sml', 'ftd_threshold_scan', { scan_type: 'full', min_spike_multiplier: 3 });
137
+ ```
138
+
139
+ ### `nexus_agent_hire` — Query FREE / Hire 5% commission
140
+ Agent marketplace. Find and hire specialized AI agents.
141
+
142
+ ```typescript
143
+ // Free query:
144
+ await use_mcp_tool('sml', 'nexus_agent_hire', { capability: 'options flow analysis', max_budget: '1.00', action: 'query' });
145
+ // Hire:
146
+ await use_mcp_tool('sml', 'nexus_agent_hire', { action: 'hire', agent_id: 'agent_abc', max_budget: '0.50' });
147
+ ```
148
+
149
+ ### `crawl_paid_fetch` — $0.005 USDC
150
+ Pay-per-fetch web scraping. Humans bypass automatically.
151
+
152
+ ```typescript
153
+ await use_mcp_tool('sml', 'crawl_paid_fetch', {
154
+ url: 'https://example.com/data',
155
+ extract: 'tables'
156
+ });
157
+ ```
158
+
159
+ ---
160
+
161
+ ## Payment Flow
162
+
163
+ 1. **Discover** — Agent reads `agents.json` or `llms.txt`, sees tool prices
164
+ 2. **Authorize** — AP2 mandate checked. Credit Bureau score ≥ 300 auto-approves
165
+ 3. **Pay** — x402 stablecoin on cheapest/fastest chain (<3s on Base)
166
+ 4. **Prove** — 402Proof receipt in every response
167
+ 5. **Earn** — Credit Bureau score updates after success
168
+
169
+ Every successful tool call returns a `_meta` block:
170
+ ```json
171
+ {
172
+ "_meta": {
173
+ "receipt_id": "uuid-here",
174
+ "tx_hash": "0xabc...",
175
+ "chain": "base",
176
+ "amount_paid": "0.05 USDC",
177
+ "timestamp": 1750000000000
178
+ }
179
+ }
180
+ ```
181
+
182
+ ---
183
+
184
+ ## SDK — For MCP Server Authors
185
+
186
+ Install in one line:
187
+ ```bash
188
+ npm i @scriptmasterlabs/mcp-x402-sdk
189
+ ```
190
+
191
+ Drop into any MCP server in 5 lines:
192
+ ```typescript
193
+ import { x402Payment } from '@scriptmasterlabs/mcp-x402-sdk';
194
+
195
+ server.tool(
196
+ 'my_paid_tool',
197
+ myInputSchema,
198
+ x402Payment({
199
+ price: '0.01',
200
+ currency: 'USDC',
201
+ inputSchema: MyZodSchema,
202
+ handler: async (input, receipt) => ({
203
+ content: [{ type: 'text', text: JSON.stringify({ result: await myApi(input), receipt }) }],
204
+ }),
205
+ }),
206
+ );
207
+ ```
208
+
209
+ That's it. The SDK handles wallet provisioning, AP2 mandate, chain routing, receipts, and audit logging.
210
+
211
+ ---
212
+
213
+ ## Security
214
+
215
+ | Requirement | Implementation |
216
+ |-------------|----------------|
217
+ | Keys in OS keychain only | `keytar` — macOS Keychain / Windows DPAPI / Linux Secret Service |
218
+ | mTLS on SML APIs | Pinned cert via `node-forge` |
219
+ | No PII in logs | Wallet addresses hashed (SHA-256 prefix), filing content redacted |
220
+ | Zod on all inputs | 100% coverage, validated before any execution |
221
+ | Append-only audit log | SHA-256 HMAC chained log, 7-day local + cloud backup |
222
+ | AP2 mandate required | Verified before every paid call, fail-closed |
223
+ | 402Proof receipt | Every transaction, registered with proof server |
224
+ | Credit Bureau check | min score 300 for auto-approve |
225
+ | $50 daily spend cap | Per wallet, enforced in-process |
226
+ | Testnet in CI | Base Sepolia only, max $0.10 test value |
227
+ | <3s end-to-end | Base mainnet target, 500ms multi-chain fallback |
228
+
229
+ ---
230
+
231
+ ## Environment Variables
232
+
233
+ See [`.env.example`](.env.example) for the full list. Key variables:
234
+
235
+ ```bash
236
+ MCP_TRANSPORT=stdio # stdio (Claude Code) or sse (Cursor/remote)
237
+ SML_API_BASE=https://api.scriptmasterlabs.com
238
+ BASE_RPC_URL=https://mainnet.base.org
239
+ XRPL_RPC_URL=wss://xrplcluster.com
240
+ DAILY_SPEND_CAP_USD=50
241
+ AUTO_APPROVE_THRESHOLD_USD=1
242
+ TESTNET=false # Set true + CI_WALLET_SEED for CI
243
+ ```
244
+
245
+ **Private keys**: Stored in your OS keychain automatically on first run. Never in env vars.
246
+
247
+ ---
248
+
249
+ ## Running Locally
250
+
251
+ ```bash
252
+ git clone https://github.com/timwal78/sml_portfolio
253
+ cd mcp-x402
254
+ npm install
255
+ npm run build
256
+ npm start
257
+ ```
258
+
259
+ With Docker:
260
+ ```bash
261
+ docker build -t mcp-x402 .
262
+ docker run -p 3402:3402 -e MCP_TRANSPORT=sse mcp-x402
263
+ ```
264
+
265
+ ---
266
+
267
+ ## Testing
268
+
269
+ ```bash
270
+ npm test # All unit tests
271
+ npm run test:coverage # Coverage report (target: 90%)
272
+ TESTNET=true CI_WALLET_SEED="your mnemonic" npm run test:integration
273
+ ```
274
+
275
+ ---
276
+
277
+ ## Ecosystem
278
+
279
+ | Service | URL | Role |
280
+ |---------|-----|------|
281
+ | SqueezeOS API | `squeezeos-api.onrender.com` | Market intelligence |
282
+ | 402Proof | `four02proof.onrender.com` | Payment receipts + Credit Bureau |
283
+ | Ghost Layer | `ghost-layer.onrender.com` | XRPL+Base toll gateway |
284
+ | ScriptMasterLabs | `scriptmasterlabs.com` | Operator homepage |
285
+
286
+ ---
287
+
288
+ ## MOAT
289
+
290
+ - Only MCP server with live x402 + AP2 + multi-chain production stack
291
+ - Only one with Agent Credit Bureau (300–850 scores)
292
+ - Only one backed by live financial intelligence marketplace
293
+ - Only one with SDVOSB federal credibility
294
+ - MIT licensed. No proprietary core.
295
+
296
+ ---
297
+
298
+ ## License
299
+
300
+ MIT — see [LICENSE](LICENSE)
301
+
302
+ Owner: [@TimmyCrypto78](https://github.com/timwal78) / ScriptMasterLabs
303
+ Launch Target: 2026-07-02
304
+ Target: 50K GitHub stars, 5K npm weekly downloads
package/agents.json ADDED
@@ -0,0 +1,67 @@
1
+ {
2
+ "schema_version": "v1",
3
+ "name": "mcp-x402",
4
+ "description": "ScriptMasterLabs MCP server. AI agents pay for institutional financial intelligence autonomously via x402 stablecoin payments on Base, XRPL, and Solana.",
5
+ "url": "https://github.com/timwal78/sml_portfolio/tree/main/mcp-x402",
6
+ "provider": {
7
+ "name": "ScriptMasterLabs",
8
+ "url": "https://scriptmasterlabs.com",
9
+ "contact": "timothy.walton45@gmail.com"
10
+ },
11
+ "version": "1.0.0",
12
+ "mcp": {
13
+ "transport": ["stdio", "sse"],
14
+ "endpoint": "https://mcp-x402.scriptmasterlabs.com"
15
+ },
16
+ "payment": {
17
+ "protocol": "x402",
18
+ "chains": ["base", "xrpl", "solana"],
19
+ "currencies": ["USDC", "RLUSD"],
20
+ "mandate": "ap2",
21
+ "credit_bureau": "https://four02proof.onrender.com/v1/score"
22
+ },
23
+ "tools": [
24
+ {
25
+ "name": "leviathan_signal",
26
+ "description": "Institutional-grade squeeze signals. Proprietary multi-engine verdict for any ticker.",
27
+ "price": "0.05",
28
+ "currency": "USDC",
29
+ "ap2_required": true
30
+ },
31
+ {
32
+ "name": "xmit_edgar_decode",
33
+ "description": "Parse SEC DEF 14A / 13F / 13D filings. Raw text never leaves SML servers.",
34
+ "price": "0.02",
35
+ "currency": "USDC",
36
+ "ap2_required": true
37
+ },
38
+ {
39
+ "name": "xdeo_earnings_estimate",
40
+ "description": "Decentralized earnings oracle. +2 bureau_score on success.",
41
+ "price": "0.02",
42
+ "currency": "USDC",
43
+ "ap2_required": true
44
+ },
45
+ {
46
+ "name": "ftd_threshold_scan",
47
+ "description": "SEC Reg SHO FTD data. Alerts free; full data 0.05 USDC.",
48
+ "price": "0.05",
49
+ "currency": "USDC",
50
+ "free_tier": "alerts_only",
51
+ "cache_ttl": 900
52
+ },
53
+ {
54
+ "name": "nexus_agent_hire",
55
+ "description": "Agent marketplace. Query free; hire charges 5% commission.",
56
+ "price": "commission_5pct",
57
+ "currency": "USDC",
58
+ "free_tier": "query_only"
59
+ },
60
+ {
61
+ "name": "crawl_paid_fetch",
62
+ "description": "Pay-per-fetch scraping. Humans bypass free.",
63
+ "price": "0.005",
64
+ "currency": "USDC"
65
+ }
66
+ ]
67
+ }
@@ -0,0 +1,10 @@
1
+ import type { RouteParams } from '../../server/payments/router.js';
2
+ export declare class BaseChain {
3
+ private static instance;
4
+ private readonly testnet;
5
+ private constructor();
6
+ static getInstance(): BaseChain;
7
+ sendPayment(params: RouteParams): Promise<string>;
8
+ private getPrivateKey;
9
+ }
10
+ //# sourceMappingURL=base.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../src/lib/chains/base.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAoBnE,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAU;IAElC,OAAO;IAIP,MAAM,CAAC,WAAW,IAAI,SAAS;IAOzB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;YA2BzC,aAAa;CAQ5B"}