@stratabook/mcp 0.2.16 → 0.2.17

package/CHANGELOG.md

@@ -3,6 +3,13 @@
 All notable changes to the Strata SDKs (`@stratabook/sdk`, `@stratabook/mcp`,
 and the `strata-sdk` Rust crate) are recorded here. Versions move together.
 
+## 0.2.17
+
+- Consume the matching strategy-timed TypeScript SDK and allow an optional
+  zero cadence floor in advanced setup calls.
+- Keep the local pairing listener alive longer and close its helper tab after
+  credentials are saved, with a branded Strata return page as the fallback.
+
 ## 0.2.16
 
 - Consume the matching TypeScript SDK 0.2.16 packaging-parity release. MCP

package/README.md

@@ -1,20 +1,46 @@
+<p align="center">
+  <a href="https://stratabook.app">
+    <img src="https://raw.githubusercontent.com/alsk1992/strata-mcp/main/assets/readme-hero.svg?v=20260826-2" alt="Strata MCP — The deepest book in DeFi" width="100%" />
+  </a>
+</p>
+
+<p align="center">
+  <a href="https://stratabook.app">Trade</a> ·
+  <a href="https://stratabook.org/docs/agent-mcp">Docs</a> ·
+  <a href="https://www.npmjs.com/package/@stratabook/mcp">npm</a> ·
+  <a href="https://api.stratabook.app/mcp">Hosted MCP</a>
+</p>
+
 # Strata MCP
 
-Official MCP access to Strata and Sonar for every MCP-compatible client. It is
-not tied to Codex, Claude, Cursor, or any other host. The server delegates to
-`@stratabook/sdk` and follows Strata's live public policy.
+Give any MCP-compatible agent direct access to Strata markets and Sonar. It
+works across Claude Desktop, Cursor, Windsurf, Codex and any standards-based
+MCP host.
+
+Read-only access works immediately. No wallet, API key, session key, environment
+variable or settings screen is required to explore markets, books, prices,
+candles, trades, quotes and public maker data.
+
+| How you connect | Best for | What stays private |
+| --- | --- | --- |
+| Hosted: `https://api.stratabook.app/mcp` | Instant reads, Sonar quotes and externally signed prepare/submit flows | The shared server never receives a session secret |
+| Local: `npx -y @stratabook/mcp` | Reads now; optional one-call trading after `connect` | The session secret remains in a mode-0600 file on the user's machine |
+
+Intent, Strand and Current controls are live. A connected local MCP can execute
+session-backed trades, orders, TWAPs and Intent updates in one call. The hosted
+shared MCP exposes Intent prepare/submit instead because it deliberately never
+stores a user's session secret. Current tracks Strata's live mark automatically.
 
-The official hosted endpoint currently exposes market, exact-output, and
-asset-to-asset Sonar quotes, together with quote-bound execution tools.
-"Capability gated" simply means a tool disappears if Strata disables that
-operation live. It does **not** mean quotes need activation or user setup.
+Tool availability follows Strata's live safety policy. If an operation is
+paused, its tool disappears immediately; everyday reads and quotes require no
+activation.
 
 The default tool mode is deliberately compact. Agents call the requested tool
 directly instead of burning discovery calls before a quote. Use
 `--mode advanced` (or `STRATA_MCP_MODE=advanced`) only when an integration
 needs the explicit challenge / prepare / submit protocol tools.
 
-## Local stdio
+## Start locally
 
 Read-only use needs no wallet, key, autonomy setting, or environment variable:
 
@@ -167,8 +193,8 @@ original confirmed signature while the packet remains live.
 For maker funding, initialize the market Vault if needed, activate the Strand
 or Current, then deposit with `strata_vault_deposit`. The market keeps that
 available collateral while a control is live and returns it after the final
-control is disabled, exhausted, expired, or cancelled. Current follows Strata's
-live mark and needs no separate publisher transaction.
+control is disabled, exhausted, expired, or cancelled. Current tracks Strata's
+live mark automatically.
 
 The matching TypeScript package ships `strata-maker-conformance`. Its default
 `safe` mode exercises this hosted MCP's discovery, public maker reads, and

package/dist/src/pairing.d.ts

@@ -17,6 +17,8 @@ export interface PairingOptions {
     readonly env?: Readonly<Record<string, string | undefined>>;
     readonly nowMs?: () => number;
 }
+/** Local success page: close the helper tab when allowed, otherwise return to Strata. */
+export declare function pairingCompletionDocument(returnUrl: string): string;
 export declare function tradingCredentialsPath(env?: Readonly<Record<string, string | undefined>>, platform?: NodeJS.Platform, home?: string): string;
 export declare function readTradingConnection(path?: string): Promise<StoredTradingConnection | null>;
 export declare function writeTradingConnection(connection: StoredTradingConnection, path?: string): Promise<void>;

package/dist/src/pairing.js

@@ -7,8 +7,18 @@ import { dirname, join, resolve } from "node:path";
 import { DEFAULT_API_BASE, generateSessionKeypair, } from "@stratabook/sdk";
 const PUBLIC_KEY_PATTERN = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;
 const SECRET_KEY_PATTERN = /^[1-9A-HJ-NP-Za-km-z]{80,90}$/;
-const PAIRING_TIMEOUT_MS = 10 * 60_000;
+const PAIRING_TIMEOUT_MS = 30 * 60_000;
 export const DEFAULT_PAIRING_WEB_BASE = "https://stratabook.app";
+/** Local success page: close the helper tab when allowed, otherwise return to Strata. */
+export function pairingCompletionDocument(returnUrl) {
+    const destination = JSON.stringify(returnUrl).replaceAll("<", "\\u003c");
+    return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Agent connected · Strata</title><style>
+:root{color-scheme:dark}body{margin:0;min-height:100vh;display:grid;place-items:center;background:#090b10;color:#f4f7fa;font:16px/1.5 system-ui,sans-serif}.card{max-width:34rem;margin:2rem;padding:2rem;border:1px solid #1b8596;border-radius:18px;background:linear-gradient(135deg,#0c171d,#100d1e)}h1{margin:.25rem 0 .5rem;font-size:1.7rem}p{margin:0;color:#aeb8c5}.mark{color:#34d6c4;font-weight:700;letter-spacing:.08em;text-transform:uppercase;font-size:.75rem}
+</style></head><body><main class="card"><div class="mark">Strata</div><h1>Agent connected</h1><p>Your local credential is saved. You can close this tab.</p></main>
+<script>const destination=${destination};window.close();setTimeout(()=>location.replace(destination),700);</script></body></html>`;
+}
 function validPublicKey(value) {
     return typeof value === "string" && PUBLIC_KEY_PATTERN.test(value);
 }
@@ -198,13 +208,17 @@ async function waitForPairingCallback(sessionPublicKey, state, returnUrl, onComp
         finished = true;
         try {
             await onComplete(ownerWallet);
-            response.writeHead(303, {
-                location: returnUrl,
+            const document = pairingCompletionDocument(returnUrl);
+            response.writeHead(200, {
+                "content-type": "text/html; charset=utf-8",
+                "content-length": Buffer.byteLength(document),
                 "cache-control": "no-store",
+                "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; base-uri 'none'; frame-ancestors 'none'",
+                "referrer-policy": "no-referrer",
                 "x-content-type-options": "nosniff",
                 "x-frame-options": "DENY",
             });
-            response.end();
+            response.end(document);
             settle(ownerWallet);
         }
         catch (error) {
@@ -234,7 +248,7 @@ async function waitForPairingCallback(sessionPublicKey, state, returnUrl, onComp
             return;
         finished = true;
         server.close();
-        reject(new Error("Strata pairing timed out after 10 minutes"));
+        reject(new Error("Strata pairing timed out after 30 minutes"));
     }, PAIRING_TIMEOUT_MS);
     timeout.unref();
     completion.finally(() => clearTimeout(timeout)).catch(() => undefined);

package/dist/src/server.js

@@ -939,7 +939,7 @@ export async function createStrataMcpServer(options = {}) {
                 .max(4)
                 .optional(),
             expiresAtMs: z.number().int().positive().optional(),
-            minimumIntervalSeconds: z.number().int().min(1).max(86_400).optional(),
+            minimumIntervalSeconds: z.number().int().min(0).max(86_400).optional(),
             maximumToleranceBps: z.number().int().min(1).max(1_000).optional(),
         },
         annotations: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stratabook/mcp",
-  "version": "0.2.16",
+  "version": "0.2.17",
   "description": "Connect AI agents to Strata markets and Sonar quotes with MCP.",
   "type": "module",
   "license": "MIT OR Apache-2.0",
@@ -45,7 +45,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.30.0",
-    "@stratabook/sdk": "0.2.16",
+    "@stratabook/sdk": "0.2.17",
     "zod": "^3.25.76"
   },
   "devDependencies": {