@wickedlabs/wicked-mcp 0.5.0 → 0.6.0

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 WickedLabs
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 WickedLabs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -2,14 +2,16 @@
 
 MCP server for the whole [Wicked](https://wickedapi.com) suite — trading data, DeFi protocol health, token safety, brokerage sync, agent identity, reputation, a tool-reliability registry, hallucination checks, persistent agent memory, and x402 paywalls, in one server.
 
-**75 tools** across 10 live services. The first four are generated automatically from each service's own live `openapi.json`, so the list always matches what's deployed; the rest are hand-written because they use wallet signatures and non-`/v1` routes:
+**90 tools** across 12 live services. The first four are generated automatically from each service's own live `openapi.json`, so the list always matches what's deployed; the rest are hand-written because they use wallet signatures and non-`/v1` routes:
 
 | Service | Tools | Auth |
 | --- | --- | --- |
-| [Trading Data API](https://api.wickedapi.com) | 22 (unprefixed: `price`, `ohlcv`, `fvg`, `momentum_score`, `sentiment`, `macro_calendar`, …) | API key or x402, 5 free |
+| [Trading Data API](https://api.wickedapi.com) | 28 (unprefixed: `price`, `ohlcv`, `fvg`, `momentum_score`, `macro_calendar`, …, plus on-chain reads `chain_balance`, `chain_token_balance`, `chain_nonce`, `chain_block`, `chain_ens`, `chain_tx`) | API key or x402, 5 free |
 | [Protocol Health Oracle](https://protocol-health-oracle.wickedapi.com) | 6 (`protocol_health_*`) | API key or x402, scoreboard free |
 | [Token Risk Oracle](https://token-risk-oracle.wickedapi.com) | 1 (`token_risk`) | 100% free, no key |
 | [Broker Sync API](https://broker-sync-api.wickedapi.com) | 6 (`broker_sync_*`) | API key or x402 |
+| [Filings Oracle](https://filings.wickedapi.com) | 7 (`filings_search`, `filings_8k_events`, `filings_insider_trades`, `filings_insider_summary`, …) | freshness + preview free; rest key or x402 |
+| [Wallet Oracle](https://wallet.wickedapi.com) | 2 (`wallet_sanctions_check`, `wallet_check`) | OFAC sanctions lookup free; full check key or x402 |
 | [Wicked Reputation](https://stake.wickedapi.com) | 5 (`reputation_*`) | free, no key |
 | [Wicked Registry](https://registry.wickedapi.com) | 6 (`registry_*`) | search/detail: key or x402; featured/badge/report free; register needs your signature |
 | [Wicked Identity](https://verify.wickedapi.com) | 8 (`identity_*`) | no wallet? start with `identity_sandbox_register` (no signing); free test key via `identity_get_test_key`; real-wallet calls need your signature over a nonce |
@@ -23,7 +25,7 @@ These tools never sign anything or hold a key. Agents with no wallet can still t
 
 ## Remote endpoint (no install)
 
-The same 75 tools are served over streamable HTTP at **`https://mcp.wickedapi.com/mcp`** (stateless, rate-limited per IP; the public deployment carries no personal keys, so paid calls return the x402 challenge). Point any streamable-HTTP MCP client at it. To self-host, build the `Dockerfile` (or `npm run build && npm run start:http`); see `.env.example` for `RATE_LIMIT_PER_MINUTE`, `ALLOWED_HOSTS` and `TRUSTED_CLIENT_IP_HEADER`.
+The same 90 tools are served over streamable HTTP at **`https://mcp.wickedapi.com/mcp`** (stateless, rate-limited per IP; the public deployment carries no personal keys, so paid calls return the x402 challenge). Point any streamable-HTTP MCP client at it. To self-host, build the `Dockerfile` (or `npm run build && npm run start:http`); see `.env.example` for `RATE_LIMIT_PER_MINUTE`, `ALLOWED_HOSTS` and `TRUSTED_CLIENT_IP_HEADER`.
 
 ## No signup required
 

package/dist/landing.js

@@ -12,6 +12,8 @@ const GROUPS = [
     { id: "identity", label: "Wicked Identity", prefix: "identity_", blurb: "Know-Your-Agent verification with signed assertions." },
     { id: "sanity", label: "Wicked Sanity", prefix: "sanity_", blurb: "Hallucination check against your source or live web evidence." },
     { id: "memory", label: "Wicked Memory", prefix: "memory_", blurb: "Persistent, wallet-scoped agent memory with semantic search." },
+    { id: "filings", label: "Filings Oracle", prefix: "filings_", blurb: "Real-time SEC alerts: 8-K events classified by item, Form 4 insider trades, 13D/13G, 10-K, 10-Q." },
+    { id: "wallet", label: "Wallet Oracle", prefix: "wallet_", blurb: "Counterparty check: OFAC sanctions, malicious-address flags and on-chain profile for any EVM wallet." },
     { id: "paywall", label: "x402 Paywall", prefix: "paywall_", blurb: "Put any endpoint behind pay-per-call USDC." },
 ];
 export const PROMPT_NAMES = ["rug_check", "vet_dependency", "morning_briefing", "fact_check", "verify_agent", "find_reliable_tool", "agent_memory_guide"];
@@ -23,14 +25,14 @@ function grouped(tools) {
         return { ...g, tools: names };
     });
     const trading = tools.filter((t) => !claimed.has(t));
-    return [{ id: "trading", label: "Trading Data API", blurb: "Prices, OHLCV, indicators, funding/OI, macro, prediction markets, momentum score.", tools: trading }, ...out];
+    return [{ id: "trading", label: "Trading Data API", blurb: "Prices, OHLCV, indicators, funding/OI, macro, prediction markets, momentum score, plus on-chain reads (balances, blocks, nonces, ENS, transactions).", tools: trading }, ...out];
 }
 export function llmsTxt(tools, version) {
     const g = grouped(tools);
     return [
         "# Wicked MCP",
         "",
-        `> One MCP server for the whole Wicked suite: ${tools.length} tools across ${g.length} services - market data, DeFi and token risk, brokerage sync, agent identity, reputation, tool registry, hallucination checks, persistent memory and x402 paywalls. Version ${version}.`,
+        `> One MCP server for the whole Wicked suite: ${tools.length} tools across ${g.length} services - market data, on-chain reads, SEC filings alerts, wallet and sanctions checks, DeFi and token risk, brokerage sync, agent identity, reputation, tool registry, hallucination checks, persistent memory and x402 paywalls. Version ${version}.`,
         "",
         "## Connect",
         `- Remote (streamable HTTP, no install): ${SITE}/mcp`,

package/dist/server.js

@@ -11,6 +11,8 @@ const SERVICES = [
     { id: "protocol_health", name: "Protocol Health Oracle", baseUrl: envUrl("WICKEDAPI_PROTOCOL_HEALTH_URL", "https://protocol-health-oracle.wickedapi.com") },
     { id: "token_risk", name: "Token Risk Oracle", baseUrl: envUrl("WICKEDAPI_TOKEN_RISK_URL", "https://token-risk-oracle.wickedapi.com") },
     { id: "broker_sync", name: "Broker Sync API", baseUrl: envUrl("WICKEDAPI_BROKER_SYNC_URL", "https://broker-sync-api.wickedapi.com") },
+    { id: "filings", name: "Filings Oracle", baseUrl: envUrl("WICKEDAPI_FILINGS_URL", "https://filings.wickedapi.com") },
+    { id: "wallet", name: "Wallet Oracle", baseUrl: envUrl("WICKEDAPI_WALLET_URL", "https://wallet.wickedapi.com") },
 ];
 const SHOWCASE_URL = envUrl("WICKEDAPI_SHOWCASE_URL", "https://wickedapi.com");
 const API_KEY = process.env.WICKEDAPI_API_KEY;
@@ -29,6 +31,13 @@ const TOOL_NAME_OVERRIDES = {
     broker_sync: {
         "POST /v1/users": "broker_sync_register_user",
     },
+    filings: {
+        "GET /v1/filings": "filings_search",
+    },
+    wallet: {
+        "GET /v1/wallet-check": "wallet_check",
+        "GET /v1/sanctions-check": "wallet_sanctions_check",
+    },
 };
 // If a funded Base-mainnet wallet key is provided, every call auto-pays the
 // x402 402 challenge in USDC — no API key or signup needed at all. Loaded
@@ -299,7 +308,7 @@ function registerPrompts(server) {
         };
     });
 }
-export const SERVER_VERSION = "0.5.0";
+export const SERVER_VERSION = "0.6.0";
 export async function loadWorld() {
     const doFetch = await buildFetcher();
     const specs = [];

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@wickedlabs/wicked-mcp",
-  "version": "0.5.0",
-  "description": "MCP server for the whole Wicked suite — trading data, DeFi protocol health, token safety, brokerage sync, agent identity, reputation, tool registry, hallucination checks, persistent memory, and x402 paywalls. 75 tools, 6 resources, 3 prompts. No signup required: pay per call in USDC via x402, or use a partner API key.",
+  "version": "0.6.0",
+  "description": "MCP server for the whole Wicked suite — trading data, DeFi protocol health, token safety, SEC filings alerts, wallet and sanctions checks, brokerage sync, agent identity, reputation, tool registry, hallucination checks, persistent memory, and x402 paywalls. 90 tools, 6 resources, 3 prompts. No signup required: pay per call in USDC via x402, or use a partner API key.",
   "type": "module",
   "bin": {
     "wickedapi-mcp": "dist/index.js"