@warmio/mcp 1.2.3 → 2.1.0

package/dist/api-types.d.ts

@@ -0,0 +1,8 @@
+/**
+ * TypeScript API type definitions for MCP code mode.
+ * Embedded in the run_analysis tool description so the LLM
+ * knows the shape of each warm.* function.
+ *
+ * All monetary amounts are positive (normalized).
+ */
+export declare function generateApiTypeString(): string;

package/dist/api-types.js

@@ -0,0 +1,65 @@
+/**
+ * TypeScript API type definitions for MCP code mode.
+ * Embedded in the run_analysis tool description so the LLM
+ * knows the shape of each warm.* function.
+ *
+ * All monetary amounts are positive (normalized).
+ */
+export function generateApiTypeString() {
+    return `declare const warm: {
+  /** Get all connected bank accounts with balances */
+  getAccounts(): Promise<{
+    accounts: Array<{ name: string; type: string; balance: number; institution: string }>;
+  }>;
+
+  /** Get transactions. Amounts: positive = expense, negative = income. Category c: "INCOME"/"TRANSFER_IN" = income, others = expenses. */
+  getTransactions(params?: {
+    since?: string;   // YYYY-MM-DD inclusive
+    until?: string;   // YYYY-MM-DD inclusive
+    limit?: number;   // default: 200, max: 1000
+  }): Promise<{
+    summary: { total: number; count: number; avg: number };
+    txns: Array<{ d: string; a: number; m: string; c: string | null }>;
+    more?: number;
+  }>;
+
+  /** Get recurring payments and subscriptions. Amounts are positive. */
+  getRecurring(): Promise<{
+    recurring: Array<{ merchant: string; amount: number; frequency: string; next_date: string | null }>;
+  }>;
+
+  /** Get net worth history snapshots */
+  getSnapshots(params?: {
+    granularity?: "daily" | "monthly";
+    limit?: number;
+    since?: string;
+  }): Promise<{
+    granularity: string;
+    snapshots: Array<{ d: string; nw: number; a: number; l: number }>;
+  }>;
+
+  /** Get budgets with spending progress */
+  getBudgets(): Promise<{
+    budgets: Array<{ name: string; amount: number; spent: number; remaining: number; percent_used: number; period: string; status: string }>;
+  }>;
+
+  /** Get savings goals with progress */
+  getGoals(): Promise<{
+    goals: Array<{ name: string; target: number; current: number; progress_percent: number; target_date: string | null; status: string }>;
+  }>;
+
+  /** Get financial health score (0-100) with pillar breakdown */
+  getHealth(): Promise<{
+    score: number | null;
+    label: string | null;
+    pillars: { spend: number; save: number; borrow: number; build: number } | null;
+    data_completeness: number | null;
+  }>;
+
+  /** Get spending breakdown by category. Amounts are positive. */
+  getSpending(params?: { months?: number }): Promise<{
+    spending: Array<{ category: string; total: number; count: number }>;
+    period: { start: string; end: string };
+  }>;
+};`;
+}

package/dist/sandbox.d.ts

@@ -0,0 +1,10 @@
+/**
+ * QuickJS Sandbox for MCP Code Mode
+ *
+ * Executes user-provided JavaScript code in a sandboxed QuickJS WASM runtime.
+ * Injects `warm.*` functions that delegate to a `callApi` callback.
+ */
+export declare function executeSandboxedCode(code: string, callApi: (tool: string, params: Record<string, unknown>) => Promise<unknown>): Promise<{
+    output: string;
+    error?: string;
+}>;

package/dist/sandbox.js

@@ -0,0 +1,92 @@
+/**
+ * QuickJS Sandbox for MCP Code Mode
+ *
+ * Executes user-provided JavaScript code in a sandboxed QuickJS WASM runtime.
+ * Injects `warm.*` functions that delegate to a `callApi` callback.
+ */
+import { newAsyncContext } from 'quickjs-emscripten';
+const MEMORY_LIMIT = 16 * 1024 * 1024; // 16MB
+const TIMEOUT_MS = 30_000; // 30s
+export async function executeSandboxedCode(code, callApi) {
+    const ctx = await newAsyncContext();
+    const outputLines = [];
+    try {
+        // Set memory limit
+        const rt = ctx.runtime;
+        rt.setMemoryLimit(MEMORY_LIMIT);
+        // Set execution timeout
+        let expired = false;
+        const deadline = Date.now() + TIMEOUT_MS;
+        rt.setInterruptHandler(() => {
+            if (Date.now() > deadline) {
+                expired = true;
+                return true; // interrupt
+            }
+            return false;
+        });
+        // Inject console.log
+        const consoleObj = ctx.newObject();
+        const logFn = ctx.newFunction('log', (...args) => {
+            const parts = args.map((arg) => {
+                const str = ctx.getString(arg);
+                return str;
+            });
+            outputLines.push(parts.join(' '));
+        });
+        ctx.setProp(consoleObj, 'log', logFn);
+        ctx.setProp(ctx.global, 'console', consoleObj);
+        logFn.dispose();
+        consoleObj.dispose();
+        // Inject __callApi as a native async function
+        const callApiFn = ctx.newAsyncifiedFunction('__callApi', async (toolHandle, paramsHandle) => {
+            const tool = ctx.getString(toolHandle);
+            const paramsJson = ctx.getString(paramsHandle);
+            const params = paramsJson ? JSON.parse(paramsJson) : {};
+            const result = await callApi(tool, params);
+            return ctx.newString(JSON.stringify(result));
+        });
+        ctx.setProp(ctx.global, '__callApi', callApiFn);
+        callApiFn.dispose();
+        // Wrapper code that creates the warm.* API using __callApi
+        const wrappedCode = `
+async function __run() {
+  const warm = {
+    getAccounts: () => __callApi('get_accounts', '{}').then(JSON.parse),
+    getTransactions: (p) => __callApi('get_transactions', JSON.stringify(p || {})).then(JSON.parse),
+    getRecurring: () => __callApi('get_recurring', '{}').then(JSON.parse),
+    getSnapshots: (p) => __callApi('get_snapshots', JSON.stringify(p || {})).then(JSON.parse),
+    getBudgets: () => __callApi('get_budgets', '{}').then(JSON.parse),
+    getGoals: () => __callApi('get_goals', '{}').then(JSON.parse),
+    getHealth: () => __callApi('get_health', '{}').then(JSON.parse),
+    getSpending: (p) => __callApi('get_spending', JSON.stringify(p || {})).then(JSON.parse),
+  };
+  ${code}
+}
+__run();
+`;
+        const result = await ctx.evalCodeAsync(wrappedCode);
+        if (expired) {
+            result.dispose();
+            return { output: outputLines.join('\n'), error: `Execution timed out after ${TIMEOUT_MS / 1000}s` };
+        }
+        if (result.error) {
+            const errorMsg = ctx.getString(result.error);
+            result.error.dispose();
+            return { output: outputLines.join('\n'), error: errorMsg };
+        }
+        // If the result is a promise, await it
+        const promiseResult = await ctx.resolvePromise(result.value);
+        if (promiseResult.error) {
+            const errorMsg = ctx.getString(promiseResult.error);
+            promiseResult.error.dispose();
+            result.value.dispose();
+            return { output: outputLines.join('\n'), error: errorMsg };
+        }
+        promiseResult.value.dispose();
+        result.value.dispose();
+        return { output: outputLines.join('\n') };
+    }
+    finally {
+        ctx.dispose();
+    }
+}

package/dist/server.js

@@ -10,6 +10,8 @@ import { CallToolRequestSchema, ListToolsRequestSchema } from '@modelcontextprot
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
+import { generateApiTypeString } from './api-types.js';
+import { executeSandboxedCode } from './sandbox.js';
 const API_URL = process.env.WARM_API_URL || 'https://warm.io';
 const MAX_RESPONSE_SIZE = 50_000;
 const MAX_TRANSACTION_PAGES = 10;
@@ -22,13 +24,17 @@ const REQUEST_TIMEOUT_MS = (() => {
 let cachedApiKey;
 function compactTransaction(t) {
     return {
-        d: t.date,
-        a: t.amount,
+        d: t.date || '',
+        // Positive = expense, negative = income/deposit (Plaid convention)
+        a: t.amount ? Math.round(t.amount * 100) / 100 : 0,
         m: t.merchant_name || t.name || 'Unknown',
-        c: t.category || null,
+        // Include category (null if not set)
+        c: t.primary_category ?? null,
     };
 }
 function inDateRange(t, since, until) {
+    if (!t.date)
+        return false;
     if (since && t.date < since)
         return false;
     if (until && t.date > until)
@@ -111,12 +117,208 @@ async function apiRequest(endpoint, params = {}) {
     }
     return response.json();
 }
-const server = new Server({ name: 'warm', version: '1.2.3' }, { capabilities: { tools: {} } });
+function sizeCheck(data, maxSize) {
+    let output = JSON.stringify(data);
+    if (output.length > maxSize) {
+        const reducedCount = Math.floor(data.length * (maxSize / output.length) * 0.8);
+        return data.slice(0, reducedCount);
+    }
+    return data;
+}
+// ============================================
+// EXTRACTED TOOL HANDLERS
+// ============================================
+async function handleGetAccounts() {
+    const response = (await apiRequest('/api/accounts'));
+    return {
+        accounts: response.accounts || [],
+    };
+}
+async function handleGetTransactions(args) {
+    const since = args?.since ? String(args.since) : undefined;
+    const until = args?.until ? String(args.until) : undefined;
+    const parsedLimit = args?.limit ? Number(args.limit) : 200;
+    const requestedLimit = Number.isFinite(parsedLimit)
+        ? Math.max(1, Math.min(Math.floor(parsedLimit), 1000))
+        : 200;
+    let transactions = [];
+    let cursor;
+    let pagesFetched = 0;
+    let scanned = 0;
+    do {
+        const params = {
+            limit: String(TRANSACTION_PAGE_SIZE),
+        };
+        if (since)
+            params.last_knowledge = since;
+        if (cursor)
+            params.cursor = cursor;
+        const response = (await apiRequest('/api/transactions', params));
+        const batch = (response.transactions || []);
+        transactions.push(...batch);
+        scanned += batch.length;
+        pagesFetched += 1;
+        cursor = response.pagination?.next_cursor ?? undefined;
+    } while (cursor && pagesFetched < MAX_TRANSACTION_PAGES && scanned < MAX_TRANSACTION_SCAN);
+    if (until) {
+        transactions = transactions.filter((t) => inDateRange(t, since, until));
+    }
+    const compactTxns = transactions.map(compactTransaction);
+    const summary = calculateSummary(compactTxns);
+    const limited = compactTxns.slice(0, requestedLimit);
+    const truncated = compactTxns.length > requestedLimit;
+    const result = { summary, txns: limited };
+    if (truncated) {
+        result.more = compactTxns.length - requestedLimit;
+    }
+    let output = JSON.stringify(result);
+    if (output.length > MAX_RESPONSE_SIZE) {
+        const reducedCount = Math.floor(limited.length * (MAX_RESPONSE_SIZE / output.length) * 0.8);
+        result.txns = limited.slice(0, reducedCount);
+        result.more = compactTxns.length - reducedCount;
+    }
+    return result;
+}
+async function handleGetRecurring() {
+    const response = (await apiRequest('/api/subscriptions'));
+    const raw = response.recurring_transactions || [];
+    const recurring = raw.map((r) => ({
+        merchant: String(r.merchant_name || r.merchant || r.name || 'Unknown'),
+        // Normalize to positive amounts
+        amount: Math.round(Math.abs(Number(r.amount) || 0) * 100) / 100,
+        frequency: String(r.frequency || ''),
+        next_date: r.next_date ?? null,
+    }));
+    const checked = sizeCheck(recurring, MAX_RESPONSE_SIZE);
+    const result = { recurring: checked };
+    if (checked.length < recurring.length) {
+        result.more = recurring.length - checked.length;
+    }
+    return result;
+}
+async function handleGetSnapshots(args) {
+    const response = (await apiRequest('/api/snapshots'));
+    const snapshots = response.snapshots || [];
+    const granularity = args?.granularity || 'daily';
+    const defaultLimit = granularity === 'daily' ? 30 : 0;
+    const limit = args?.limit ? Number(args.limit) : defaultLimit;
+    const since = args?.since;
+    // Normalize snapshot dates (support both snapshot_date and d)
+    const normalized = snapshots.map((s) => ({
+        date: s.snapshot_date || s.d || '',
+        net_worth: s.net_worth ?? s.nw ?? 0,
+        total_assets: s.total_assets ?? s.a ?? 0,
+        total_liabilities: s.total_liabilities ?? s.l ?? 0,
+    }));
+    let filtered = normalized;
+    if (since) {
+        filtered = filtered.filter((s) => s.date >= since);
+    }
+    if (granularity === 'monthly') {
+        const byMonth = new Map();
+        filtered.forEach((s) => {
+            const month = s.date.substring(0, 7);
+            if (!byMonth.has(month) || s.date > (byMonth.get(month)?.date || '')) {
+                byMonth.set(month, s);
+            }
+        });
+        filtered = Array.from(byMonth.values());
+    }
+    filtered.sort((a, b) => b.date.localeCompare(a.date));
+    if (limit > 0) {
+        filtered = filtered.slice(0, limit);
+    }
+    const result = filtered.map((s) => ({
+        d: s.date,
+        nw: Math.round(s.net_worth * 100) / 100,
+        a: Math.round(s.total_assets * 100) / 100,
+        l: Math.round(s.total_liabilities * 100) / 100,
+    }));
+    return { granularity, snapshots: result };
+}
+async function handleVerifyKey() {
+    const response = (await apiRequest('/api/verify'));
+    return {
+        valid: response.valid === true,
+        status: response.status || (response.valid ? 'ok' : 'invalid'),
+    };
+}
+async function handleGetBudgets() {
+    const response = (await apiRequest('/api/budgets'));
+    // Filter to only include spec-defined fields
+    const budgets = (response.budgets || []).map((b) => ({
+        name: String(b.name || ''),
+        amount: Number(b.amount || 0),
+        spent: Number(b.spent || 0),
+        remaining: Number(b.remaining || 0),
+        percent_used: Number(b.percent_used || 0),
+        period: String(b.period || ''),
+        status: String(b.status || ''),
+    }));
+    return { budgets };
+}
+async function handleGetGoals() {
+    const response = (await apiRequest('/api/goals'));
+    // Filter to only include spec-defined fields
+    const goals = (response.goals || []).map((g) => ({
+        name: String(g.name || ''),
+        target: Number(g.target || 0),
+        current: Number(g.current || 0),
+        progress_percent: Number(g.progress_percent || 0),
+        target_date: g.target_date ?? null,
+        status: String(g.status || ''),
+    }));
+    return { goals };
+}
+async function handleGetHealth() {
+    const response = (await apiRequest('/api/health'));
+    return {
+        score: response.score ?? null,
+        label: response.label ?? null,
+        pillars: response.pillars
+            ? {
+                spend: Number(response.pillars.spend || 0),
+                save: Number(response.pillars.save || 0),
+                borrow: Number(response.pillars.borrow || 0),
+                build: Number(response.pillars.build || 0),
+            }
+            : null,
+        data_completeness: response.data_completeness ?? null,
+    };
+}
+async function handleGetSpending(args) {
+    const months = args?.months ? String(args.months) : '6';
+    const response = (await apiRequest('/api/spending', { months }));
+    return {
+        spending: (response.spending || []).map((s) => ({
+            category: String(s.category || ''),
+            total: Math.round(Number(s.total || 0) * 100) / 100,
+            count: Number(s.count || 0),
+        })),
+        period: response.period || { start: '', end: '' },
+    };
+}
+// Tool name → handler mapping for sandbox dispatch
+const toolHandlers = {
+    get_accounts: handleGetAccounts,
+    get_transactions: handleGetTransactions,
+    get_recurring: handleGetRecurring,
+    get_snapshots: handleGetSnapshots,
+    verify_key: handleVerifyKey,
+    get_budgets: handleGetBudgets,
+    get_goals: handleGetGoals,
+    get_health: handleGetHealth,
+    get_spending: handleGetSpending,
+};
+// ============================================
+// SERVER SETUP
+// ============================================
+const server = new Server({ name: 'warm', version: '2.0.0' }, { capabilities: { tools: {} } });
 server.setRequestHandler(ListToolsRequestSchema, async () => ({
     tools: [
         {
             name: 'get_accounts',
-            description: 'Get all connected bank accounts with balances. Use for: "What accounts do I have?", "What is my checking balance?", "Show my credit cards". Returns: array of {name, type, balance, institution}.',
+            description: 'Get all connected bank accounts with balances. Use for: "What accounts do I have?", "What is my checking balance?", "Show my credit cards".\nReturns: { accounts: Array<{ name: string; type: string; balance: number; institution: string }> }',
             inputSchema: {
                 type: 'object',
                 properties: {},
@@ -125,7 +327,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
         },
         {
             name: 'get_transactions',
-            description: 'Get transactions and analyze spending. Use for: "How much did I spend on coffee?", "Show my purchases", "What did I buy last month?". Returns: {summary: {total, count, avg}, txns: [{d, a, m, c}]} where d=date, a=amount, m=merchant, c=category. IMPORTANT: Do NOT pre-filter—fetch all transactions then analyze the `c` (category) field to answer category questions (coffee, dining, groceries, etc.). Category details take priority over merchant name string matching.',
+            description: 'Get transactions and analyze spending. Use for: "How much did I spend on coffee?", "Show my purchases", "What did I buy last month?", "Show my income". Use the `c` (category) field to filter: INCOME and TRANSFER_IN = income, all others = expenses. Amounts: positive = expense, negative = income/deposit.\nReturns: { summary: { total: number; count: number; avg: number }; txns: Array<{ d: string; a: number; m: string; c: string | null }>; more?: number }',
             inputSchema: {
                 type: 'object',
                 properties: {
@@ -147,7 +349,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
         },
         {
             name: 'get_recurring',
-            description: 'Get detected subscriptions and recurring payments. Use for: "What subscriptions do I have?", "Show my monthly bills", "What are my recurring charges?". Returns: {recurring: [{merchant, amount, frequency, next_date}]}.',
+            description: 'Get detected subscriptions and recurring payments. Use for: "What subscriptions do I have?", "Show my monthly bills", "What are my recurring charges?".\nReturns: { recurring: Array<{ merchant: string; amount: number; frequency: string; next_date: string | null }> }',
             inputSchema: {
                 type: 'object',
                 properties: {},
@@ -156,7 +358,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
         },
         {
             name: 'get_snapshots',
-            description: 'Get net worth history over time. Use for: "How has my net worth changed?", "Show my financial progress", "What was my balance last month?". Returns: {snapshots: [{d, nw, a, l}]} where nw=net_worth, a=assets, l=liabilities.',
+            description: 'Get net worth history over time. Use for: "How has my net worth changed?", "Show my financial progress", "What was my balance last month?".\nReturns: { granularity: string; snapshots: Array<{ d: string; nw: number; a: number; l: number }> }',
             inputSchema: {
                 type: 'object',
                 properties: {
@@ -177,9 +379,65 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
             },
             annotations: { readOnlyHint: true },
         },
+        {
+            name: 'get_budgets',
+            description: 'Get all budgets with current spending progress. Use for: "How are my budgets?", "Am I over budget?", "Show my budget status".\nReturns: { budgets: Array<{ name: string; amount: number; spent: number; remaining: number; percent_used: number; period: string; status: string }> }',
+            inputSchema: {
+                type: 'object',
+                properties: {},
+            },
+            annotations: { readOnlyHint: true },
+        },
+        {
+            name: 'get_goals',
+            description: 'Get savings goals with progress. Use for: "How are my goals?", "Savings progress", "Am I on track for my goals?".\nReturns: { goals: Array<{ name: string; target: number; current: number; progress_percent: number; target_date: string | null; status: string }> }',
+            inputSchema: {
+                type: 'object',
+                properties: {},
+            },
+            annotations: { readOnlyHint: true },
+        },
+        {
+            name: 'get_health',
+            description: 'Get financial health score and pillar breakdown. Use for: "What\'s my financial health?", "How am I doing financially?", "Health score".\nReturns: { score: number | null; label: string | null; pillars: { spend: number; save: number; borrow: number; build: number } | null; data_completeness: number | null }',
+            inputSchema: {
+                type: 'object',
+                properties: {},
+            },
+            annotations: { readOnlyHint: true },
+        },
+        {
+            name: 'get_spending',
+            description: 'Get spending breakdown by category over a period. Use for: "Where does my money go?", "Spending by category", "Top spending categories".\nReturns: { spending: Array<{ category: string; total: number; count: number }>; period: { start: string; end: string } }',
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    months: {
+                        type: 'number',
+                        description: 'Number of months to analyze (default: 6, max: 24)',
+                    },
+                },
+            },
+            annotations: { readOnlyHint: true },
+        },
+        {
+            name: 'run_analysis',
+            description: `Run JavaScript code that calls warm.* functions for complex multi-step analysis. Use when a query requires combining data from multiple tools, custom calculations, or comparisons that would take 3+ tool calls.\n\nAvailable API:\n${generateApiTypeString()}\n\nUse console.log() to output results. Example:\nconst [accounts, txns] = await Promise.all([warm.getAccounts(), warm.getTransactions({ since: "2024-01-01" })]);\nconst total = txns.txns.reduce((s, t) => s + t.a, 0);\nconsole.log(JSON.stringify({ accounts: accounts.accounts.length, totalSpent: total }));`,
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    code: {
+                        type: 'string',
+                        description: 'JavaScript code to execute. Use warm.* functions and console.log() for output.',
+                    },
+                },
+                required: ['code'],
+            },
+            annotations: { readOnlyHint: true },
+        },
         {
             name: 'verify_key',
-            description: 'Check if API key is valid and working.',
+            description: 'Check if API key is valid and working.\nReturns: { valid: boolean; user_id: string }',
             inputSchema: {
                 type: 'object',
                 properties: {},
@@ -191,108 +449,35 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
 server.setRequestHandler(CallToolRequestSchema, async (request) => {
     const { name, arguments: args } = request.params;
     try {
-        switch (name) {
-            case 'get_accounts': {
-                const data = await apiRequest('/api/accounts');
-                return { content: [{ type: 'text', text: JSON.stringify(data) }] };
+        // Handle run_analysis separately (sandbox execution)
+        if (name === 'run_analysis') {
+            const code = args?.code ? String(args.code) : '';
+            if (!code) {
+                throw new Error('Code parameter is required');
             }
-            case 'get_transactions': {
-                const since = args?.since ? String(args.since) : undefined;
-                const until = args?.until ? String(args.until) : undefined;
-                const parsedLimit = args?.limit ? Number(args.limit) : 200;
-                const requestedLimit = Number.isFinite(parsedLimit)
-                    ? Math.max(1, Math.min(Math.floor(parsedLimit), 1000))
-                    : 200;
-                let transactions = [];
-                let cursor;
-                let pagesFetched = 0;
-                let scanned = 0;
-                do {
-                    const params = {
-                        limit: String(TRANSACTION_PAGE_SIZE),
-                    };
-                    if (since)
-                        params.last_knowledge = since;
-                    if (cursor)
-                        params.cursor = cursor;
-                    const response = (await apiRequest('/api/transactions', params));
-                    const batch = (response.transactions || []);
-                    transactions.push(...batch);
-                    scanned += batch.length;
-                    pagesFetched += 1;
-                    cursor = response.cursor;
-                } while (cursor && pagesFetched < MAX_TRANSACTION_PAGES && scanned < MAX_TRANSACTION_SCAN);
-                // Apply date range filter (until is client-side since API only supports since)
-                if (until) {
-                    transactions = transactions.filter((t) => inDateRange(t, since, until));
+            const callApi = async (tool, params) => {
+                const handler = toolHandlers[tool];
+                if (!handler) {
+                    throw new Error(`Unknown tool: ${tool}`);
                 }
-                const compactTxns = transactions.map(compactTransaction);
-                // Calculate summary on ALL matching transactions
-                const summary = calculateSummary(compactTxns);
-                // Apply limit for display
-                const limited = compactTxns.slice(0, requestedLimit);
-                const truncated = compactTxns.length > requestedLimit;
-                // Build compact result
-                const result = { summary, txns: limited };
-                if (truncated) {
-                    result.more = compactTxns.length - requestedLimit;
-                }
-                // Size check and reduce if needed
-                let output = JSON.stringify(result);
-                if (output.length > MAX_RESPONSE_SIZE) {
-                    const reducedCount = Math.floor(limited.length * (MAX_RESPONSE_SIZE / output.length) * 0.8);
-                    result.txns = limited.slice(0, reducedCount);
-                    result.more = compactTxns.length - reducedCount;
-                    output = JSON.stringify(result);
-                }
-                return { content: [{ type: 'text', text: output }] };
-            }
-            case 'get_recurring': {
-                const response = (await apiRequest('/api/transactions', { limit: '1' }));
-                const recurring = response.recurring || [];
-                return { content: [{ type: 'text', text: JSON.stringify({ recurring }) }] };
-            }
-            case 'get_snapshots': {
-                const response = (await apiRequest('/api/transactions', { limit: '1' }));
-                const snapshots = response.snapshots || [];
-                const granularity = args?.granularity || 'daily';
-                const defaultLimit = granularity === 'daily' ? 30 : 0;
-                const limit = args?.limit ? Number(args.limit) : defaultLimit;
-                const since = args?.since;
-                let filtered = snapshots;
-                if (since) {
-                    filtered = filtered.filter((s) => String(s.snapshot_date) >= since);
-                }
-                if (granularity === 'monthly') {
-                    const byMonth = new Map();
-                    filtered.forEach((s) => {
-                        const month = String(s.snapshot_date).substring(0, 7);
-                        if (!byMonth.has(month) || String(s.snapshot_date) > String(byMonth.get(month).snapshot_date)) {
-                            byMonth.set(month, s);
-                        }
-                    });
-                    filtered = Array.from(byMonth.values());
-                }
-                filtered.sort((a, b) => String(b.snapshot_date).localeCompare(String(a.snapshot_date)));
-                if (limit > 0) {
-                    filtered = filtered.slice(0, limit);
-                }
-                // Compact output
-                const result = filtered.map((s) => ({
-                    d: s.snapshot_date,
-                    nw: s.net_worth,
-                    a: s.total_assets,
-                    l: s.total_liabilities,
-                }));
-                return { content: [{ type: 'text', text: JSON.stringify({ granularity, snapshots: result }) }] };
-            }
-            case 'verify_key': {
-                const data = await apiRequest('/api/verify');
-                return { content: [{ type: 'text', text: JSON.stringify(data) }] };
-            }
-            default:
-                throw new Error(`Unknown tool: ${name}`);
+                return handler(params);
+            };
+            const result = await executeSandboxedCode(code, callApi);
+            const text = result.error
+                ? `Output:\n${result.output}\n\nError: ${result.error}`
+                : result.output;
+            return {
+                content: [{ type: 'text', text }],
+                isError: !!result.error,
+            };
+        }
+        // Standard tool dispatch
+        const handler = toolHandlers[name];
+        if (!handler) {
+            throw new Error(`Unknown tool: ${name}`);
         }
+        const data = await handler(args);
+        return { content: [{ type: 'text', text: JSON.stringify(data) }] };
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@warmio/mcp",
-  "version": "1.2.3",
+  "version": "2.1.0",
   "description": "MCP server for Warm Financial API",
   "type": "module",
   "main": "dist/index.js",
@@ -23,7 +23,8 @@
   ],
   "license": "MIT",
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.25.0"
+    "@modelcontextprotocol/sdk": "^1.25.0",
+    "quickjs-emscripten": "^0.31.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",