@wickedlabs/wicked-mcp 0.5.0 → 0.6.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +129 -127
- package/dist/http.js +6 -1
- package/dist/landing.js +9 -7
- package/dist/server.js +10 -1
- package/dist/suite.js +22 -1
- package/package.json +4 -4
package/README.md
CHANGED
|
@@ -1,127 +1,129 @@
|
|
|
1
|
-
# WickedAPI MCP Server
|
|
2
|
-
|
|
3
|
-
MCP server for the whole [Wicked](https://wickedapi.com) suite — trading data, DeFi protocol health, token safety, brokerage sync, agent identity, reputation, a tool-reliability registry, hallucination checks, persistent agent memory, and x402 paywalls, in one server.
|
|
4
|
-
|
|
5
|
-
**
|
|
6
|
-
|
|
7
|
-
| Service | Tools | Auth |
|
|
8
|
-
| --- | --- | --- |
|
|
9
|
-
| [Trading Data API](https://api.wickedapi.com) |
|
|
10
|
-
| [Protocol Health Oracle](https://protocol-health-oracle.wickedapi.com) | 6 (`protocol_health_*`) | API key or x402, scoreboard free |
|
|
11
|
-
| [Token Risk Oracle](https://token-risk-oracle.wickedapi.com) | 1 (`token_risk`) | 100% free, no key |
|
|
12
|
-
| [Broker Sync API](https://broker-sync-api.wickedapi.com) | 6 (`broker_sync_*`) | API key or x402 |
|
|
13
|
-
| [
|
|
14
|
-
| [
|
|
15
|
-
| [Wicked
|
|
16
|
-
| [Wicked
|
|
17
|
-
| [Wicked
|
|
18
|
-
| [
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
- **
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
"
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
}
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
"
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
}
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
- `wickedapi://
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
-
|
|
92
|
-
|
|
93
|
-
- **`
|
|
94
|
-
- **`
|
|
95
|
-
- **`
|
|
96
|
-
- **`
|
|
97
|
-
- **`
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
|
104
|
-
|
|
|
105
|
-
| `
|
|
106
|
-
| `
|
|
107
|
-
| `
|
|
108
|
-
| `
|
|
109
|
-
| `
|
|
110
|
-
| `
|
|
111
|
-
| `
|
|
112
|
-
| `
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
|
|
120
|
-
|
|
121
|
-
|
|
122
|
-
|
|
123
|
-
|
|
124
|
-
|
|
125
|
-
|
|
126
|
-
|
|
127
|
-
|
|
1
|
+
# WickedAPI MCP Server
|
|
2
|
+
|
|
3
|
+
MCP server for the whole [Wicked](https://wickedapi.com) suite — trading data, DeFi protocol health, token safety, brokerage sync, agent identity, reputation, a tool-reliability registry, hallucination checks, persistent agent memory, and x402 paywalls, in one server.
|
|
4
|
+
|
|
5
|
+
**90 tools** across 12 live services. The first four are generated automatically from each service's own live `openapi.json`, so the list always matches what's deployed; the rest are hand-written because they use wallet signatures and non-`/v1` routes:
|
|
6
|
+
|
|
7
|
+
| Service | Tools | Auth |
|
|
8
|
+
| --- | --- | --- |
|
|
9
|
+
| [Trading Data API](https://api.wickedapi.com) | 28 (unprefixed: `price`, `ohlcv`, `fvg`, `momentum_score`, `macro_calendar`, …, plus on-chain reads `chain_balance`, `chain_token_balance`, `chain_nonce`, `chain_block`, `chain_ens`, `chain_tx`) | API key or x402, 5 free |
|
|
10
|
+
| [Protocol Health Oracle](https://protocol-health-oracle.wickedapi.com) | 6 (`protocol_health_*`) | API key or x402, scoreboard free |
|
|
11
|
+
| [Token Risk Oracle](https://token-risk-oracle.wickedapi.com) | 1 (`token_risk`) | 100% free, no key |
|
|
12
|
+
| [Broker Sync API](https://broker-sync-api.wickedapi.com) | 6 (`broker_sync_*`) | API key or x402 |
|
|
13
|
+
| [Filings Oracle](https://filings.wickedapi.com) | 7 (`filings_search`, `filings_8k_events`, `filings_insider_trades`, `filings_insider_summary`, …) | freshness + preview free; rest key or x402 |
|
|
14
|
+
| [Wallet Oracle](https://wallet.wickedapi.com) | 2 (`wallet_sanctions_check`, `wallet_check`) | OFAC sanctions lookup free; full check key or x402 |
|
|
15
|
+
| [Wicked Reputation](https://stake.wickedapi.com) | 5 (`reputation_*`) | free, no key |
|
|
16
|
+
| [Wicked Registry](https://registry.wickedapi.com) | 6 (`registry_*`) | search/detail: key or x402; featured/badge/report free; register needs your signature |
|
|
17
|
+
| [Wicked Identity](https://verify.wickedapi.com) | 8 (`identity_*`) | no wallet? start with `identity_sandbox_register` (no signing); free test key via `identity_get_test_key`; real-wallet calls need your signature over a nonce |
|
|
18
|
+
| [Wicked Sanity](https://sanity.wickedapi.com) | 2 (`sanity_check`, `sanity_check_batch`) | key or x402 |
|
|
19
|
+
| [Wicked Memory](https://memory.wickedapi.com) | 8 (`memory_prepare`, `memory_store`, `memory_search`, …) | wallet signature on every call; only search is metered |
|
|
20
|
+
| [x402 Paywall](https://paywall.wickedapi.com) | 8 (`paywall_*`) | `paywall_signup` is open; the rest need the tenant key |
|
|
21
|
+
|
|
22
|
+
Plus **6 resources** (the platform directory, `llms.txt`, and each service's live endpoint catalog) and **7 prompts** (`rug_check`, `vet_dependency`, `morning_briefing`, `fact_check`, `verify_agent`, `find_reliable_tool`, `agent_memory_guide`) that chain tools together the way the [cookbook](../cookbooks/wickedapi-cookbook.md) does.
|
|
23
|
+
|
|
24
|
+
These tools never sign anything or hold a key. Agents with no wallet can still try Wicked Identity end to end through a sandbox identity (`identity_sandbox_register`, then pass `sandbox_token` instead of a signature); sandbox results are for testing and are never reported as verified. Identity (real wallet), Registry registration and Memory take a signature you produce with your own wallet (`identity_get_nonce` / `memory_prepare` return the exact message to sign). Calls that need x402 payment return the real `402` challenge (decoded under `payment_required` for x402 v2) rather than auto-paying — `WICKEDAPI_PAYER_PRIVATE_KEY` auto-pay applies to the Trading, Protocol Health, Token Risk and Broker Sync tools.
|
|
25
|
+
|
|
26
|
+
## Remote endpoint (no install)
|
|
27
|
+
|
|
28
|
+
The same 90 tools are served over streamable HTTP at **`https://mcp.wickedapi.com/mcp`** (stateless, rate-limited per IP; the public deployment carries no personal keys, so paid calls return the x402 challenge). Point any streamable-HTTP MCP client at it. To self-host, build the `Dockerfile` (or `npm run build && npm run start:http`); see `.env.example` for `RATE_LIMIT_PER_MINUTE`, `ALLOWED_HOSTS` and `TRUSTED_CLIENT_IP_HEADER`.
|
|
29
|
+
|
|
30
|
+
## No signup required
|
|
31
|
+
|
|
32
|
+
Every tool hits a real endpoint gated by [x402](https://x402.org) (HTTP-native pay-per-call, USDC on Base) with an API-key fallback — and the Token Risk Oracle tool is free no matter what:
|
|
33
|
+
|
|
34
|
+
- **Zero config** — calls without credentials still work; paid endpoints return the real `402` payment challenge (price, network, `payTo`) as the tool result.
|
|
35
|
+
- **Autonomous pay-per-call** — set `WICKEDAPI_PAYER_PRIVATE_KEY` to a funded Base-mainnet wallet's private key, and every call auto-pays ~$0.001 in USDC and returns real data. No account, no subscription.
|
|
36
|
+
- **Partner API key** — set `WICKEDAPI_API_KEY` for free, rate-limited access across all four services (same key works everywhere).
|
|
37
|
+
|
|
38
|
+
## Install
|
|
39
|
+
|
|
40
|
+
```json
|
|
41
|
+
{
|
|
42
|
+
"mcpServers": {
|
|
43
|
+
"wickedapi": {
|
|
44
|
+
"command": "npx",
|
|
45
|
+
"args": ["-y", "@wickedlabs/wicked-mcp"],
|
|
46
|
+
"env": {
|
|
47
|
+
"WICKEDAPI_API_KEY": "your-key-here"
|
|
48
|
+
}
|
|
49
|
+
}
|
|
50
|
+
}
|
|
51
|
+
}
|
|
52
|
+
```
|
|
53
|
+
|
|
54
|
+
Or for autonomous pay-per-call instead of a key:
|
|
55
|
+
|
|
56
|
+
```json
|
|
57
|
+
{
|
|
58
|
+
"mcpServers": {
|
|
59
|
+
"wickedapi": {
|
|
60
|
+
"command": "npx",
|
|
61
|
+
"args": ["-y", "@wickedlabs/wicked-mcp"],
|
|
62
|
+
"env": {
|
|
63
|
+
"WICKEDAPI_PAYER_PRIVATE_KEY": "0xyour-base-wallet-private-key"
|
|
64
|
+
}
|
|
65
|
+
}
|
|
66
|
+
}
|
|
67
|
+
}
|
|
68
|
+
```
|
|
69
|
+
|
|
70
|
+
Nothing configured? The Token Risk Oracle tool and the 5 free Trading Data API endpoints (`sentiment`, `macro_calendar`, `market_overview`, `gas`, `kalshi_probability`) still work with zero setup.
|
|
71
|
+
|
|
72
|
+
## Resources
|
|
73
|
+
|
|
74
|
+
Read without calling a tool — useful for a client that surfaces resources in its UI:
|
|
75
|
+
|
|
76
|
+
- `wickedapi://platform/services` — the full service directory (JSON)
|
|
77
|
+
- `wickedapi://platform/llms` — the platform's `llms.txt`
|
|
78
|
+
- `wickedapi://trading/status`, `wickedapi://protocol_health/status`, `wickedapi://token_risk/status`, `wickedapi://broker_sync/status` — each service's live endpoint catalog
|
|
79
|
+
|
|
80
|
+
## Quick start
|
|
81
|
+
|
|
82
|
+
```bash
|
|
83
|
+
claude mcp add --transport http wicked https://mcp.wickedapi.com/mcp # Claude Code, no install
|
|
84
|
+
npx -y @wickedlabs/wicked-mcp # local stdio
|
|
85
|
+
```
|
|
86
|
+
|
|
87
|
+
Claude Desktop / Cursor / VS Code config and per-framework starters: see the [cookbooks](https://github.com/choaticpixels/api_services/tree/main/cookbooks). The remote also serves a landing page at `/`, `/llms.txt`, an MCP server card at `/.well-known/mcp/server-card.json`, and aggregate per-tool call counts at `/stats` (counts only; no arguments or IPs).
|
|
88
|
+
|
|
89
|
+
## Prompts
|
|
90
|
+
|
|
91
|
+
One-click workflows that chain real tool calls (Claude Desktop and other prompt-aware clients surface these directly):
|
|
92
|
+
|
|
93
|
+
- **`rug_check`** (`address`, `chain`, optional `symbol`) — token risk check + market sentiment + optional momentum read, before buying.
|
|
94
|
+
- **`vet_dependency`** (`slug`, optional `token_address`, `chain`) — protocol health + optional contract-level risk check, before building on a DeFi protocol.
|
|
95
|
+
- **`morning_briefing`** (optional `symbol`) — macro calendar + earnings calendar + sentiment + momentum verdict, as one digest.
|
|
96
|
+
- **`fact_check`** (`output`, optional `source`) — split an answer into claims and verify each with Wicked Sanity.
|
|
97
|
+
- **`verify_agent`** (`wallet`) — Identity assertion + Reputation stake/tier before you transact with an agent.
|
|
98
|
+
- **`find_reliable_tool`** (`need`, optional `category`, `min_score`) — Registry search by real uptime/latency/schema scores.
|
|
99
|
+
- **`agent_memory_guide`** (`wallet`, `task`) — the two-step signed Memory flow, explained to the model.
|
|
100
|
+
|
|
101
|
+
## Environment variables
|
|
102
|
+
|
|
103
|
+
| Var | Required | Notes |
|
|
104
|
+
| --- | --- | --- |
|
|
105
|
+
| `WICKEDAPI_API_KEY` | no | Free, rate-limited access across all four services (same key works everywhere). |
|
|
106
|
+
| `WICKEDAPI_PAYER_PRIVATE_KEY` | no | Base-mainnet wallet private key. If set, every call auto-pays the x402 challenge in USDC — no key needed. |
|
|
107
|
+
| `WICKEDAPI_BASE_URL` | no | Override the Trading Data API base (default `https://api.wickedapi.com`). |
|
|
108
|
+
| `WICKEDAPI_PROTOCOL_HEALTH_URL` | no | Override the Protocol Health Oracle base (default `https://protocol-health-oracle.wickedapi.com`). |
|
|
109
|
+
| `WICKEDAPI_TOKEN_RISK_URL` | no | Override the Token Risk Oracle base (default `https://token-risk-oracle.wickedapi.com`). |
|
|
110
|
+
| `WICKEDAPI_BROKER_SYNC_URL` | no | Override the Broker Sync API base (default `https://broker-sync-api.wickedapi.com`). |
|
|
111
|
+
| `REGISTRY_API_KEY` / `IDENTITY_API_KEY` / `SANITY_API_KEY` / `MEMORY_API_KEY` | no | Free-tier keys for the paid calls of Registry, Identity, Sanity and Memory search. Omit to get the x402 challenge instead. |
|
|
112
|
+
| `PAYWALL_API_KEY` | for `paywall_*` | Tenant Bearer key returned once by `paywall_signup`. |
|
|
113
|
+
| `REPUTATION_BASE_URL` / `REGISTRY_BASE_URL` / `IDENTITY_BASE_URL` / `SANITY_BASE_URL` / `MEMORY_BASE_URL` / `PAYWALL_BASE_URL` | no | Override the matching service base (defaults are the `*.wickedapi.com` hosts). |
|
|
114
|
+
| `WICKEDAPI_SHOWCASE_URL` | no | Override the platform directory base used by resources (default `https://wickedapi.com`). |
|
|
115
|
+
|
|
116
|
+
If neither `WICKEDAPI_API_KEY` nor `WICKEDAPI_PAYER_PRIVATE_KEY` is set, paid calls still succeed at the protocol level — you'll get the real `402` challenge back as the tool result instead of data. If one service's spec fails to load (network hiccup, that service is down), its tools are simply skipped for the session — the rest still register normally.
|
|
117
|
+
|
|
118
|
+
## Local development
|
|
119
|
+
|
|
120
|
+
```bash
|
|
121
|
+
npm install
|
|
122
|
+
npm test # builds, then unit + end-to-end tests (e2e needs network)
|
|
123
|
+
node dist/index.js # stdio
|
|
124
|
+
node dist/http.js # streamable HTTP on $PORT (default 8080)
|
|
125
|
+
```
|
|
126
|
+
|
|
127
|
+
## What this is not
|
|
128
|
+
|
|
129
|
+
This server doesn't reimplement any data logic — it's a thin bridge from MCP tool calls to the live Wicked HTTP endpoints across all ten services. All the actual market data, indicators, scoring, and risk signals live in the APIs themselves.
|
package/dist/http.js
CHANGED
|
@@ -11,6 +11,7 @@ import { rateLimited } from "./rateLimit.js";
|
|
|
11
11
|
import { landingHtml, llmsTxt, serverCard } from "./landing.js";
|
|
12
12
|
import { knownTools, usageHooks, usageSnapshot } from "./usage.js";
|
|
13
13
|
import { buildServer, loadWorld, SERVER_VERSION } from "./server.js";
|
|
14
|
+
import { configuredKeys } from "./suite.js";
|
|
14
15
|
import { captureServerError, flushSentry, initSentry } from "./observability.js";
|
|
15
16
|
initSentry(SERVER_VERSION);
|
|
16
17
|
const PORT = Number(process.env.PORT || 8080);
|
|
@@ -97,7 +98,11 @@ async function main() {
|
|
|
97
98
|
}
|
|
98
99
|
}
|
|
99
100
|
});
|
|
100
|
-
http.listen(PORT, "0.0.0.0", () =>
|
|
101
|
+
http.listen(PORT, "0.0.0.0", () => {
|
|
102
|
+
console.error(`[wickedapi-mcp] http on :${PORT}/mcp - ${summary}.`);
|
|
103
|
+
const keys = Object.entries(configuredKeys()).map(([k, v]) => `${k}=${v ? "set" : "MISSING"}`);
|
|
104
|
+
console.error(`[wickedapi-mcp] upstream api keys: ${keys.join(" ")}`);
|
|
105
|
+
});
|
|
101
106
|
}
|
|
102
107
|
main().catch((err) => {
|
|
103
108
|
console.error("[wickedapi-mcp] fatal:", err);
|
package/dist/landing.js
CHANGED
|
@@ -12,6 +12,8 @@ const GROUPS = [
|
|
|
12
12
|
{ id: "identity", label: "Wicked Identity", prefix: "identity_", blurb: "Know-Your-Agent verification with signed assertions." },
|
|
13
13
|
{ id: "sanity", label: "Wicked Sanity", prefix: "sanity_", blurb: "Hallucination check against your source or live web evidence." },
|
|
14
14
|
{ id: "memory", label: "Wicked Memory", prefix: "memory_", blurb: "Persistent, wallet-scoped agent memory with semantic search." },
|
|
15
|
+
{ id: "filings", label: "Filings Oracle", prefix: "filings_", blurb: "Real-time SEC alerts: 8-K events classified by item, Form 4 insider trades, 13D/13G, 10-K, 10-Q." },
|
|
16
|
+
{ id: "wallet", label: "Wallet Oracle", prefix: "wallet_", blurb: "Counterparty check: OFAC sanctions, malicious-address flags and on-chain profile for any EVM wallet." },
|
|
15
17
|
{ id: "paywall", label: "x402 Paywall", prefix: "paywall_", blurb: "Put any endpoint behind pay-per-call USDC." },
|
|
16
18
|
];
|
|
17
19
|
export const PROMPT_NAMES = ["rug_check", "vet_dependency", "morning_briefing", "fact_check", "verify_agent", "find_reliable_tool", "agent_memory_guide"];
|
|
@@ -23,14 +25,14 @@ function grouped(tools) {
|
|
|
23
25
|
return { ...g, tools: names };
|
|
24
26
|
});
|
|
25
27
|
const trading = tools.filter((t) => !claimed.has(t));
|
|
26
|
-
return [{ id: "trading", label: "Trading Data API", blurb: "Prices, OHLCV, indicators, funding/OI, macro, prediction markets, momentum score.", tools: trading }, ...out];
|
|
28
|
+
return [{ id: "trading", label: "Trading Data API", blurb: "Prices, OHLCV, indicators, funding/OI, macro, prediction markets, momentum score, plus on-chain reads (balances, blocks, nonces, ENS, transactions).", tools: trading }, ...out];
|
|
27
29
|
}
|
|
28
30
|
export function llmsTxt(tools, version) {
|
|
29
31
|
const g = grouped(tools);
|
|
30
32
|
return [
|
|
31
33
|
"# Wicked MCP",
|
|
32
34
|
"",
|
|
33
|
-
`> One MCP server for the whole Wicked suite: ${tools.length} tools across ${g.length} services - market data, DeFi and token risk, brokerage sync, agent identity, reputation, tool registry, hallucination checks, persistent memory and x402 paywalls. Version ${version}.`,
|
|
35
|
+
`> One MCP server for the whole Wicked suite: ${tools.length} tools across ${g.length} services - market data, on-chain reads, SEC filings alerts, wallet and sanctions checks, DeFi and token risk, brokerage sync, agent identity, reputation, tool registry, hallucination checks, persistent memory and x402 paywalls. Version ${version}.`,
|
|
34
36
|
"",
|
|
35
37
|
"## Connect",
|
|
36
38
|
`- Remote (streamable HTTP, no install): ${SITE}/mcp`,
|
|
@@ -47,9 +49,9 @@ export function llmsTxt(tools, version) {
|
|
|
47
49
|
"",
|
|
48
50
|
"## Links",
|
|
49
51
|
"- Platform: https://wickedapi.com (service directory at https://wickedapi.com/services.json)",
|
|
50
|
-
"- Source: https://github.com/
|
|
52
|
+
"- Source: https://github.com/WickedAPI/wicked-mcp",
|
|
51
53
|
"- npm: https://www.npmjs.com/package/@wickedlabs/wicked-mcp",
|
|
52
|
-
"- Registry: io.github.
|
|
54
|
+
"- Registry: io.github.wickedapi/wicked-mcp on https://registry.modelcontextprotocol.io",
|
|
53
55
|
"- Server card: " + SITE + "/.well-known/mcp/server-card.json",
|
|
54
56
|
"",
|
|
55
57
|
"Wallet-signed tools (identity, memory, registry registration) never sign for you: you supply the signature from your own wallet.",
|
|
@@ -61,9 +63,9 @@ export function serverCard(tools, version) {
|
|
|
61
63
|
$schema: "https://static.modelcontextprotocol.io/schemas/mcp-server-card/v1.json",
|
|
62
64
|
version: "1.0",
|
|
63
65
|
protocolVersion: "2025-06-18",
|
|
64
|
-
serverInfo: { name: "io.github.
|
|
66
|
+
serverInfo: { name: "io.github.wickedapi/wicked-mcp", title: "Wicked MCP", version },
|
|
65
67
|
description: `The whole Wicked suite for agents: ${tools.length} tools across market data, DeFi/token risk, identity, reputation, registry, sanity checks, memory and paywalls. x402-native.`,
|
|
66
|
-
documentationUrl: "https://github.com/
|
|
68
|
+
documentationUrl: "https://github.com/WickedAPI/wicked-mcp",
|
|
67
69
|
transport: { type: "streamable-http", endpoint: "/mcp" },
|
|
68
70
|
capabilities: { tools: { listChanged: false }, resources: {}, prompts: {} },
|
|
69
71
|
authentication: { required: false, note: "Optional keys unlock free tiers; otherwise paid calls return an x402 challenge." },
|
|
@@ -91,6 +93,6 @@ code{display:block;margin-top:8px;font-size:13px;color:var(--mut);word-break:bre
|
|
|
91
93
|
<p>No signup. Priced calls return a real x402 payment challenge (USDC on Base). The public endpoint is rate limited per IP.</p>
|
|
92
94
|
<h3>What's inside</h3>
|
|
93
95
|
${rows}
|
|
94
|
-
<footer><a href="https://wickedapi.com">wickedapi.com</a> · <a href="https://github.com/
|
|
96
|
+
<footer><a href="https://wickedapi.com">wickedapi.com</a> · <a href="https://github.com/WickedAPI/wicked-mcp">GitHub</a> · <a href="https://www.npmjs.com/package/@wickedlabs/wicked-mcp">npm</a> · <a href="/llms.txt">llms.txt</a> · <a href="/.well-known/mcp/server-card.json">server card</a> · <a href="/stats">usage</a></footer>
|
|
95
97
|
</main></body></html>`;
|
|
96
98
|
}
|
package/dist/server.js
CHANGED
|
@@ -11,6 +11,8 @@ const SERVICES = [
|
|
|
11
11
|
{ id: "protocol_health", name: "Protocol Health Oracle", baseUrl: envUrl("WICKEDAPI_PROTOCOL_HEALTH_URL", "https://protocol-health-oracle.wickedapi.com") },
|
|
12
12
|
{ id: "token_risk", name: "Token Risk Oracle", baseUrl: envUrl("WICKEDAPI_TOKEN_RISK_URL", "https://token-risk-oracle.wickedapi.com") },
|
|
13
13
|
{ id: "broker_sync", name: "Broker Sync API", baseUrl: envUrl("WICKEDAPI_BROKER_SYNC_URL", "https://broker-sync-api.wickedapi.com") },
|
|
14
|
+
{ id: "filings", name: "Filings Oracle", baseUrl: envUrl("WICKEDAPI_FILINGS_URL", "https://filings.wickedapi.com") },
|
|
15
|
+
{ id: "wallet", name: "Wallet Oracle", baseUrl: envUrl("WICKEDAPI_WALLET_URL", "https://wallet.wickedapi.com") },
|
|
14
16
|
];
|
|
15
17
|
const SHOWCASE_URL = envUrl("WICKEDAPI_SHOWCASE_URL", "https://wickedapi.com");
|
|
16
18
|
const API_KEY = process.env.WICKEDAPI_API_KEY;
|
|
@@ -29,6 +31,13 @@ const TOOL_NAME_OVERRIDES = {
|
|
|
29
31
|
broker_sync: {
|
|
30
32
|
"POST /v1/users": "broker_sync_register_user",
|
|
31
33
|
},
|
|
34
|
+
filings: {
|
|
35
|
+
"GET /v1/filings": "filings_search",
|
|
36
|
+
},
|
|
37
|
+
wallet: {
|
|
38
|
+
"GET /v1/wallet-check": "wallet_check",
|
|
39
|
+
"GET /v1/sanctions-check": "wallet_sanctions_check",
|
|
40
|
+
},
|
|
32
41
|
};
|
|
33
42
|
// If a funded Base-mainnet wallet key is provided, every call auto-pays the
|
|
34
43
|
// x402 402 challenge in USDC — no API key or signup needed at all. Loaded
|
|
@@ -299,7 +308,7 @@ function registerPrompts(server) {
|
|
|
299
308
|
};
|
|
300
309
|
});
|
|
301
310
|
}
|
|
302
|
-
export const SERVER_VERSION = "0.
|
|
311
|
+
export const SERVER_VERSION = "0.6.1";
|
|
303
312
|
export async function loadWorld() {
|
|
304
313
|
const doFetch = await buildFetcher();
|
|
305
314
|
const specs = [];
|
package/dist/suite.js
CHANGED
|
@@ -23,6 +23,17 @@ const IDENTITY_API_KEY = process.env.IDENTITY_API_KEY || "";
|
|
|
23
23
|
const SANITY_API_KEY = process.env.SANITY_API_KEY || "";
|
|
24
24
|
const MEMORY_API_KEY = process.env.MEMORY_API_KEY || "";
|
|
25
25
|
const PAYWALL_API_KEY = process.env.PAYWALL_API_KEY || "";
|
|
26
|
+
/** Which upstream API keys this process has (yes/no only, never the values). */
|
|
27
|
+
export function configuredKeys() {
|
|
28
|
+
return {
|
|
29
|
+
wickedapi: Boolean(process.env.WICKEDAPI_API_KEY),
|
|
30
|
+
registry: Boolean(REGISTRY_API_KEY),
|
|
31
|
+
identity: Boolean(IDENTITY_API_KEY),
|
|
32
|
+
sanity: Boolean(SANITY_API_KEY),
|
|
33
|
+
memory: Boolean(MEMORY_API_KEY),
|
|
34
|
+
paywall: Boolean(PAYWALL_API_KEY),
|
|
35
|
+
};
|
|
36
|
+
}
|
|
26
37
|
const DEFAULT_TIMEOUT_MS = 20_000;
|
|
27
38
|
const SANITY_TIMEOUT_MS = 90_000; // open mode runs a live web search per claim
|
|
28
39
|
// x402 v2 services put the payment instructions in a base64 PAYMENT-REQUIRED
|
|
@@ -77,7 +88,17 @@ async function call(method, base, path, opts = {}) {
|
|
|
77
88
|
init.body = JSON.stringify(clean(opts.json));
|
|
78
89
|
}
|
|
79
90
|
try {
|
|
80
|
-
|
|
91
|
+
const body = await finalize(await fetch(url.toString(), init));
|
|
92
|
+
// These services answer 402 both when no key is sent and when a key is
|
|
93
|
+
// rejected, so the status alone can't say which. Say what THIS server did
|
|
94
|
+
// (never the key itself), so an agent or operator can tell the cases apart.
|
|
95
|
+
if (body.http_status === 402) {
|
|
96
|
+
const sentKey = Boolean(headers["x-api-key"] || headers["authorization"]);
|
|
97
|
+
body.auth_hint = sentKey
|
|
98
|
+
? "An API key was sent with this request but the service still asked for payment. These services return 402 for a rejected key too, so the key configured on this server is probably invalid, revoked or out of quota. Pay via x402 instead, or tell the server operator."
|
|
99
|
+
: "No API key was sent with this request: none is configured on this server for this service. Pay via x402, or tell the server operator.";
|
|
100
|
+
}
|
|
101
|
+
return body;
|
|
81
102
|
}
|
|
82
103
|
catch (err) {
|
|
83
104
|
return { error: err.message, source: "mcp", http_status: 502 };
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@wickedlabs/wicked-mcp",
|
|
3
|
-
"version": "0.
|
|
4
|
-
"description": "MCP server for the whole Wicked suite — trading data, DeFi protocol health, token safety, brokerage sync, agent identity, reputation, tool registry, hallucination checks, persistent memory, and x402 paywalls.
|
|
3
|
+
"version": "0.6.1",
|
|
4
|
+
"description": "MCP server for the whole Wicked suite — trading data, DeFi protocol health, token safety, SEC filings alerts, wallet and sanctions checks, brokerage sync, agent identity, reputation, tool registry, hallucination checks, persistent memory, and x402 paywalls. 90 tools, 6 resources, 3 prompts. No signup required: pay per call in USDC via x402, or use a partner API key.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"bin": {
|
|
7
7
|
"wickedapi-mcp": "dist/index.js"
|
|
@@ -57,7 +57,7 @@
|
|
|
57
57
|
},
|
|
58
58
|
"repository": {
|
|
59
59
|
"type": "git",
|
|
60
|
-
"url": "git+https://github.com/
|
|
60
|
+
"url": "git+https://github.com/WickedAPI/wicked-mcp.git"
|
|
61
61
|
},
|
|
62
|
-
"mcpName": "io.github.
|
|
62
|
+
"mcpName": "io.github.wickedapi/wicked-mcp"
|
|
63
63
|
}
|