@wickedlabs/wicked-mcp 0.6.1 → 0.7.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/LICENSE +21 -21
  2. package/README.md +129 -129
  3. package/dist/landing.js +2 -2
  4. package/dist/server.js +25 -2
  5. package/dist/suite.js +16 -0
  6. package/package.json +3 -3
package/LICENSE CHANGED
@@ -1,21 +1,21 @@
1
- MIT License
2
-
3
- Copyright (c) 2026 WickedLabs
4
-
5
- Permission is hereby granted, free of charge, to any person obtaining a copy
6
- of this software and associated documentation files (the "Software"), to deal
7
- in the Software without restriction, including without limitation the rights
8
- to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
- copies of the Software, and to permit persons to whom the Software is
10
- furnished to do so, subject to the following conditions:
11
-
12
- The above copyright notice and this permission notice shall be included in all
13
- copies or substantial portions of the Software.
14
-
15
- THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
- IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
- FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
- AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
- LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
- OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
- SOFTWARE.
1
+ MIT License
2
+
3
+ Copyright (c) 2026 WickedLabs
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.
package/README.md CHANGED
@@ -1,129 +1,129 @@
1
- # WickedAPI MCP Server
2
-
3
- MCP server for the whole [Wicked](https://wickedapi.com) suite — trading data, DeFi protocol health, token safety, brokerage sync, agent identity, reputation, a tool-reliability registry, hallucination checks, persistent agent memory, and x402 paywalls, in one server.
4
-
5
- **90 tools** across 12 live services. The first four are generated automatically from each service's own live `openapi.json`, so the list always matches what's deployed; the rest are hand-written because they use wallet signatures and non-`/v1` routes:
6
-
7
- | Service | Tools | Auth |
8
- | --- | --- | --- |
9
- | [Trading Data API](https://api.wickedapi.com) | 28 (unprefixed: `price`, `ohlcv`, `fvg`, `momentum_score`, `macro_calendar`, …, plus on-chain reads `chain_balance`, `chain_token_balance`, `chain_nonce`, `chain_block`, `chain_ens`, `chain_tx`) | API key or x402, 5 free |
10
- | [Protocol Health Oracle](https://protocol-health-oracle.wickedapi.com) | 6 (`protocol_health_*`) | API key or x402, scoreboard free |
11
- | [Token Risk Oracle](https://token-risk-oracle.wickedapi.com) | 1 (`token_risk`) | 100% free, no key |
12
- | [Broker Sync API](https://broker-sync-api.wickedapi.com) | 6 (`broker_sync_*`) | API key or x402 |
13
- | [Filings Oracle](https://filings.wickedapi.com) | 7 (`filings_search`, `filings_8k_events`, `filings_insider_trades`, `filings_insider_summary`, …) | freshness + preview free; rest key or x402 |
14
- | [Wallet Oracle](https://wallet.wickedapi.com) | 2 (`wallet_sanctions_check`, `wallet_check`) | OFAC sanctions lookup free; full check key or x402 |
15
- | [Wicked Reputation](https://stake.wickedapi.com) | 5 (`reputation_*`) | free, no key |
16
- | [Wicked Registry](https://registry.wickedapi.com) | 6 (`registry_*`) | search/detail: key or x402; featured/badge/report free; register needs your signature |
17
- | [Wicked Identity](https://verify.wickedapi.com) | 8 (`identity_*`) | no wallet? start with `identity_sandbox_register` (no signing); free test key via `identity_get_test_key`; real-wallet calls need your signature over a nonce |
18
- | [Wicked Sanity](https://sanity.wickedapi.com) | 2 (`sanity_check`, `sanity_check_batch`) | key or x402 |
19
- | [Wicked Memory](https://memory.wickedapi.com) | 8 (`memory_prepare`, `memory_store`, `memory_search`, …) | wallet signature on every call; only search is metered |
20
- | [x402 Paywall](https://paywall.wickedapi.com) | 8 (`paywall_*`) | `paywall_signup` is open; the rest need the tenant key |
21
-
22
- Plus **6 resources** (the platform directory, `llms.txt`, and each service's live endpoint catalog) and **7 prompts** (`rug_check`, `vet_dependency`, `morning_briefing`, `fact_check`, `verify_agent`, `find_reliable_tool`, `agent_memory_guide`) that chain tools together the way the [cookbook](../cookbooks/wickedapi-cookbook.md) does.
23
-
24
- These tools never sign anything or hold a key. Agents with no wallet can still try Wicked Identity end to end through a sandbox identity (`identity_sandbox_register`, then pass `sandbox_token` instead of a signature); sandbox results are for testing and are never reported as verified. Identity (real wallet), Registry registration and Memory take a signature you produce with your own wallet (`identity_get_nonce` / `memory_prepare` return the exact message to sign). Calls that need x402 payment return the real `402` challenge (decoded under `payment_required` for x402 v2) rather than auto-paying — `WICKEDAPI_PAYER_PRIVATE_KEY` auto-pay applies to the Trading, Protocol Health, Token Risk and Broker Sync tools.
25
-
26
- ## Remote endpoint (no install)
27
-
28
- The same 90 tools are served over streamable HTTP at **`https://mcp.wickedapi.com/mcp`** (stateless, rate-limited per IP; the public deployment carries no personal keys, so paid calls return the x402 challenge). Point any streamable-HTTP MCP client at it. To self-host, build the `Dockerfile` (or `npm run build && npm run start:http`); see `.env.example` for `RATE_LIMIT_PER_MINUTE`, `ALLOWED_HOSTS` and `TRUSTED_CLIENT_IP_HEADER`.
29
-
30
- ## No signup required
31
-
32
- Every tool hits a real endpoint gated by [x402](https://x402.org) (HTTP-native pay-per-call, USDC on Base) with an API-key fallback — and the Token Risk Oracle tool is free no matter what:
33
-
34
- - **Zero config** — calls without credentials still work; paid endpoints return the real `402` payment challenge (price, network, `payTo`) as the tool result.
35
- - **Autonomous pay-per-call** — set `WICKEDAPI_PAYER_PRIVATE_KEY` to a funded Base-mainnet wallet's private key, and every call auto-pays ~$0.001 in USDC and returns real data. No account, no subscription.
36
- - **Partner API key** — set `WICKEDAPI_API_KEY` for free, rate-limited access across all four services (same key works everywhere).
37
-
38
- ## Install
39
-
40
- ```json
41
- {
42
- "mcpServers": {
43
- "wickedapi": {
44
- "command": "npx",
45
- "args": ["-y", "@wickedlabs/wicked-mcp"],
46
- "env": {
47
- "WICKEDAPI_API_KEY": "your-key-here"
48
- }
49
- }
50
- }
51
- }
52
- ```
53
-
54
- Or for autonomous pay-per-call instead of a key:
55
-
56
- ```json
57
- {
58
- "mcpServers": {
59
- "wickedapi": {
60
- "command": "npx",
61
- "args": ["-y", "@wickedlabs/wicked-mcp"],
62
- "env": {
63
- "WICKEDAPI_PAYER_PRIVATE_KEY": "0xyour-base-wallet-private-key"
64
- }
65
- }
66
- }
67
- }
68
- ```
69
-
70
- Nothing configured? The Token Risk Oracle tool and the 5 free Trading Data API endpoints (`sentiment`, `macro_calendar`, `market_overview`, `gas`, `kalshi_probability`) still work with zero setup.
71
-
72
- ## Resources
73
-
74
- Read without calling a tool — useful for a client that surfaces resources in its UI:
75
-
76
- - `wickedapi://platform/services` — the full service directory (JSON)
77
- - `wickedapi://platform/llms` — the platform's `llms.txt`
78
- - `wickedapi://trading/status`, `wickedapi://protocol_health/status`, `wickedapi://token_risk/status`, `wickedapi://broker_sync/status` — each service's live endpoint catalog
79
-
80
- ## Quick start
81
-
82
- ```bash
83
- claude mcp add --transport http wicked https://mcp.wickedapi.com/mcp # Claude Code, no install
84
- npx -y @wickedlabs/wicked-mcp # local stdio
85
- ```
86
-
87
- Claude Desktop / Cursor / VS Code config and per-framework starters: see the [cookbooks](https://github.com/choaticpixels/api_services/tree/main/cookbooks). The remote also serves a landing page at `/`, `/llms.txt`, an MCP server card at `/.well-known/mcp/server-card.json`, and aggregate per-tool call counts at `/stats` (counts only; no arguments or IPs).
88
-
89
- ## Prompts
90
-
91
- One-click workflows that chain real tool calls (Claude Desktop and other prompt-aware clients surface these directly):
92
-
93
- - **`rug_check`** (`address`, `chain`, optional `symbol`) — token risk check + market sentiment + optional momentum read, before buying.
94
- - **`vet_dependency`** (`slug`, optional `token_address`, `chain`) — protocol health + optional contract-level risk check, before building on a DeFi protocol.
95
- - **`morning_briefing`** (optional `symbol`) — macro calendar + earnings calendar + sentiment + momentum verdict, as one digest.
96
- - **`fact_check`** (`output`, optional `source`) — split an answer into claims and verify each with Wicked Sanity.
97
- - **`verify_agent`** (`wallet`) — Identity assertion + Reputation stake/tier before you transact with an agent.
98
- - **`find_reliable_tool`** (`need`, optional `category`, `min_score`) — Registry search by real uptime/latency/schema scores.
99
- - **`agent_memory_guide`** (`wallet`, `task`) — the two-step signed Memory flow, explained to the model.
100
-
101
- ## Environment variables
102
-
103
- | Var | Required | Notes |
104
- | --- | --- | --- |
105
- | `WICKEDAPI_API_KEY` | no | Free, rate-limited access across all four services (same key works everywhere). |
106
- | `WICKEDAPI_PAYER_PRIVATE_KEY` | no | Base-mainnet wallet private key. If set, every call auto-pays the x402 challenge in USDC — no key needed. |
107
- | `WICKEDAPI_BASE_URL` | no | Override the Trading Data API base (default `https://api.wickedapi.com`). |
108
- | `WICKEDAPI_PROTOCOL_HEALTH_URL` | no | Override the Protocol Health Oracle base (default `https://protocol-health-oracle.wickedapi.com`). |
109
- | `WICKEDAPI_TOKEN_RISK_URL` | no | Override the Token Risk Oracle base (default `https://token-risk-oracle.wickedapi.com`). |
110
- | `WICKEDAPI_BROKER_SYNC_URL` | no | Override the Broker Sync API base (default `https://broker-sync-api.wickedapi.com`). |
111
- | `REGISTRY_API_KEY` / `IDENTITY_API_KEY` / `SANITY_API_KEY` / `MEMORY_API_KEY` | no | Free-tier keys for the paid calls of Registry, Identity, Sanity and Memory search. Omit to get the x402 challenge instead. |
112
- | `PAYWALL_API_KEY` | for `paywall_*` | Tenant Bearer key returned once by `paywall_signup`. |
113
- | `REPUTATION_BASE_URL` / `REGISTRY_BASE_URL` / `IDENTITY_BASE_URL` / `SANITY_BASE_URL` / `MEMORY_BASE_URL` / `PAYWALL_BASE_URL` | no | Override the matching service base (defaults are the `*.wickedapi.com` hosts). |
114
- | `WICKEDAPI_SHOWCASE_URL` | no | Override the platform directory base used by resources (default `https://wickedapi.com`). |
115
-
116
- If neither `WICKEDAPI_API_KEY` nor `WICKEDAPI_PAYER_PRIVATE_KEY` is set, paid calls still succeed at the protocol level — you'll get the real `402` challenge back as the tool result instead of data. If one service's spec fails to load (network hiccup, that service is down), its tools are simply skipped for the session — the rest still register normally.
117
-
118
- ## Local development
119
-
120
- ```bash
121
- npm install
122
- npm test # builds, then unit + end-to-end tests (e2e needs network)
123
- node dist/index.js # stdio
124
- node dist/http.js # streamable HTTP on $PORT (default 8080)
125
- ```
126
-
127
- ## What this is not
128
-
129
- This server doesn't reimplement any data logic — it's a thin bridge from MCP tool calls to the live Wicked HTTP endpoints across all ten services. All the actual market data, indicators, scoring, and risk signals live in the APIs themselves.
1
+ # WickedAPI MCP Server
2
+
3
+ MCP server for the whole [Wicked](https://wickedapi.com) suite — trading data, DeFi protocol health, token safety, brokerage sync, agent identity, reputation, a tool-reliability registry, hallucination checks, persistent agent memory, and x402 paywalls, in one server.
4
+
5
+ **105 tools** across 12 live services. The first four are generated automatically from each service's own live `openapi.json`, so the list always matches what's deployed; the rest are hand-written because they use wallet signatures and non-`/v1` routes:
6
+
7
+ | Service | Tools | Auth |
8
+ | --- | --- | --- |
9
+ | [Trading Data API](https://api.wickedapi.com) | 28 (unprefixed: `price`, `ohlcv`, `fvg`, `momentum_score`, `macro_calendar`, …, plus on-chain reads `chain_balance`, `chain_token_balance`, `chain_nonce`, `chain_block`, `chain_ens`, `chain_tx`) | API key or x402, 5 free |
10
+ | [Protocol Health Oracle](https://protocol-health-oracle.wickedapi.com) | 6 (`protocol_health_*`) | API key or x402, scoreboard free |
11
+ | [Token Risk Oracle](https://token-risk-oracle.wickedapi.com) | 1 (`token_risk`) | 100% free, no key |
12
+ | [Broker Sync API](https://broker-sync-api.wickedapi.com) | 6 (`broker_sync_*`) | API key or x402 |
13
+ | [Filings Oracle](https://filings.wickedapi.com) | 7 (`filings_search`, `filings_8k_events`, `filings_insider_trades`, `filings_insider_summary`, …) | freshness + preview free; rest key or x402 |
14
+ | [Wallet Oracle](https://wallet.wickedapi.com) | 2 (`wallet_sanctions_check`, `wallet_check`) | OFAC sanctions lookup free; full check key or x402 |
15
+ | [Wicked Reputation](https://stake.wickedapi.com) | 5 (`reputation_*`) | free, no key |
16
+ | [Wicked Registry](https://registry.wickedapi.com) | 6 (`registry_*`) | search/detail: key or x402; featured/badge/report free; register needs your signature |
17
+ | [Wicked Identity](https://verify.wickedapi.com) | 8 (`identity_*`) | no wallet? start with `identity_sandbox_register` (no signing); free test key via `identity_get_test_key`; real-wallet calls need your signature over a nonce |
18
+ | [Wicked Sanity](https://sanity.wickedapi.com) | 2 (`sanity_check`, `sanity_check_batch`) | key or x402 |
19
+ | [Wicked Memory](https://memory.wickedapi.com) | 8 (`memory_prepare`, `memory_store`, `memory_search`, …) | wallet signature on every call; only search is metered |
20
+ | [x402 Paywall](https://paywall.wickedapi.com) | 8 (`paywall_*`) | `paywall_signup` is open; the rest need the tenant key |
21
+
22
+ Plus **6 resources** (the platform directory, `llms.txt`, and each service's live endpoint catalog) and **7 prompts** (`rug_check`, `vet_dependency`, `morning_briefing`, `fact_check`, `verify_agent`, `find_reliable_tool`, `agent_memory_guide`) that chain tools together the way the [cookbook](../cookbooks/wickedapi-cookbook.md) does.
23
+
24
+ These tools never sign anything or hold a key. Agents with no wallet can still try Wicked Identity end to end through a sandbox identity (`identity_sandbox_register`, then pass `sandbox_token` instead of a signature); sandbox results are for testing and are never reported as verified. Identity (real wallet), Registry registration and Memory take a signature you produce with your own wallet (`identity_get_nonce` / `memory_prepare` return the exact message to sign). Calls that need x402 payment return the real `402` challenge (decoded under `payment_required` for x402 v2) rather than auto-paying — `WICKEDAPI_PAYER_PRIVATE_KEY` auto-pay applies to the Trading, Protocol Health, Token Risk and Broker Sync tools.
25
+
26
+ ## Remote endpoint (no install)
27
+
28
+ The same 105 tools are served over streamable HTTP at **`https://mcp.wickedapi.com/mcp`** (stateless, rate-limited per IP; the public deployment carries no personal keys, so paid calls return the x402 challenge). Point any streamable-HTTP MCP client at it. To self-host, build the `Dockerfile` (or `npm run build && npm run start:http`); see `.env.example` for `RATE_LIMIT_PER_MINUTE`, `ALLOWED_HOSTS` and `TRUSTED_CLIENT_IP_HEADER`.
29
+
30
+ ## No signup required
31
+
32
+ Every tool hits a real endpoint gated by [x402](https://x402.org) (HTTP-native pay-per-call, USDC on Base) with an API-key fallback — and the Token Risk Oracle tool is free no matter what:
33
+
34
+ - **Zero config** — calls without credentials still work; paid endpoints return the real `402` payment challenge (price, network, `payTo`) as the tool result.
35
+ - **Autonomous pay-per-call** — set `WICKEDAPI_PAYER_PRIVATE_KEY` to a funded Base-mainnet wallet's private key, and every call auto-pays ~$0.001 in USDC and returns real data. No account, no subscription.
36
+ - **Partner API key** — set `WICKEDAPI_API_KEY` for free, rate-limited access across all four services (same key works everywhere).
37
+
38
+ ## Install
39
+
40
+ ```json
41
+ {
42
+ "mcpServers": {
43
+ "wickedapi": {
44
+ "command": "npx",
45
+ "args": ["-y", "@wickedlabs/wicked-mcp"],
46
+ "env": {
47
+ "WICKEDAPI_API_KEY": "your-key-here"
48
+ }
49
+ }
50
+ }
51
+ }
52
+ ```
53
+
54
+ Or for autonomous pay-per-call instead of a key:
55
+
56
+ ```json
57
+ {
58
+ "mcpServers": {
59
+ "wickedapi": {
60
+ "command": "npx",
61
+ "args": ["-y", "@wickedlabs/wicked-mcp"],
62
+ "env": {
63
+ "WICKEDAPI_PAYER_PRIVATE_KEY": "0xyour-base-wallet-private-key"
64
+ }
65
+ }
66
+ }
67
+ }
68
+ ```
69
+
70
+ Nothing configured? The Token Risk Oracle tool and the 5 free Trading Data API endpoints (`sentiment`, `macro_calendar`, `market_overview`, `gas`, `kalshi_probability`) still work with zero setup.
71
+
72
+ ## Resources
73
+
74
+ Read without calling a tool — useful for a client that surfaces resources in its UI:
75
+
76
+ - `wickedapi://platform/services` — the full service directory (JSON)
77
+ - `wickedapi://platform/llms` — the platform's `llms.txt`
78
+ - `wickedapi://trading/status`, `wickedapi://protocol_health/status`, `wickedapi://token_risk/status`, `wickedapi://broker_sync/status` — each service's live endpoint catalog
79
+
80
+ ## Quick start
81
+
82
+ ```bash
83
+ claude mcp add --transport http wicked https://mcp.wickedapi.com/mcp # Claude Code, no install
84
+ npx -y @wickedlabs/wicked-mcp # local stdio
85
+ ```
86
+
87
+ Claude Desktop / Cursor / VS Code config and per-framework starters: see the [cookbooks](https://github.com/choaticpixels/api_services/tree/main/cookbooks). The remote also serves a landing page at `/`, `/llms.txt`, an MCP server card at `/.well-known/mcp/server-card.json`, and aggregate per-tool call counts at `/stats` (counts only; no arguments or IPs).
88
+
89
+ ## Prompts
90
+
91
+ One-click workflows that chain real tool calls (Claude Desktop and other prompt-aware clients surface these directly):
92
+
93
+ - **`rug_check`** (`address`, `chain`, optional `symbol`) — token risk check + market sentiment + optional momentum read, before buying.
94
+ - **`vet_dependency`** (`slug`, optional `token_address`, `chain`) — protocol health + optional contract-level risk check, before building on a DeFi protocol.
95
+ - **`morning_briefing`** (optional `symbol`) — macro calendar + earnings calendar + sentiment + momentum verdict, as one digest.
96
+ - **`fact_check`** (`output`, optional `source`) — split an answer into claims and verify each with Wicked Sanity.
97
+ - **`verify_agent`** (`wallet`) — Identity assertion + Reputation stake/tier before you transact with an agent.
98
+ - **`find_reliable_tool`** (`need`, optional `category`, `min_score`) — Registry search by real uptime/latency/schema scores.
99
+ - **`agent_memory_guide`** (`wallet`, `task`) — the two-step signed Memory flow, explained to the model.
100
+
101
+ ## Environment variables
102
+
103
+ | Var | Required | Notes |
104
+ | --- | --- | --- |
105
+ | `WICKEDAPI_API_KEY` | no | Free, rate-limited access across all four services (same key works everywhere). |
106
+ | `WICKEDAPI_PAYER_PRIVATE_KEY` | no | Base-mainnet wallet private key. If set, every call auto-pays the x402 challenge in USDC — no key needed. |
107
+ | `WICKEDAPI_BASE_URL` | no | Override the Trading Data API base (default `https://api.wickedapi.com`). |
108
+ | `WICKEDAPI_PROTOCOL_HEALTH_URL` | no | Override the Protocol Health Oracle base (default `https://protocol-health-oracle.wickedapi.com`). |
109
+ | `WICKEDAPI_TOKEN_RISK_URL` | no | Override the Token Risk Oracle base (default `https://token-risk-oracle.wickedapi.com`). |
110
+ | `WICKEDAPI_BROKER_SYNC_URL` | no | Override the Broker Sync API base (default `https://broker-sync-api.wickedapi.com`). |
111
+ | `REGISTRY_API_KEY` / `IDENTITY_API_KEY` / `SANITY_API_KEY` / `MEMORY_API_KEY` | no | Free-tier keys for the paid calls of Registry, Identity, Sanity and Memory search. Omit to get the x402 challenge instead. |
112
+ | `PAYWALL_API_KEY` | for `paywall_*` | Tenant Bearer key returned once by `paywall_signup`. |
113
+ | `REPUTATION_BASE_URL` / `REGISTRY_BASE_URL` / `IDENTITY_BASE_URL` / `SANITY_BASE_URL` / `MEMORY_BASE_URL` / `PAYWALL_BASE_URL` | no | Override the matching service base (defaults are the `*.wickedapi.com` hosts). |
114
+ | `WICKEDAPI_SHOWCASE_URL` | no | Override the platform directory base used by resources (default `https://wickedapi.com`). |
115
+
116
+ If neither `WICKEDAPI_API_KEY` nor `WICKEDAPI_PAYER_PRIVATE_KEY` is set, paid calls still succeed at the protocol level — you'll get the real `402` challenge back as the tool result instead of data. If one service's spec fails to load (network hiccup, that service is down), its tools are simply skipped for the session — the rest still register normally.
117
+
118
+ ## Local development
119
+
120
+ ```bash
121
+ npm install
122
+ npm test # builds, then unit + end-to-end tests (e2e needs network)
123
+ node dist/index.js # stdio
124
+ node dist/http.js # streamable HTTP on $PORT (default 8080)
125
+ ```
126
+
127
+ ## What this is not
128
+
129
+ This server doesn't reimplement any data logic — it's a thin bridge from MCP tool calls to the live Wicked HTTP endpoints across all ten services. All the actual market data, indicators, scoring, and risk signals live in the APIs themselves.
package/dist/landing.js CHANGED
@@ -51,7 +51,7 @@ export function llmsTxt(tools, version) {
51
51
  "- Platform: https://wickedapi.com (service directory at https://wickedapi.com/services.json)",
52
52
  "- Source: https://github.com/WickedAPI/wicked-mcp",
53
53
  "- npm: https://www.npmjs.com/package/@wickedlabs/wicked-mcp",
54
- "- Registry: io.github.wickedapi/wicked-mcp on https://registry.modelcontextprotocol.io",
54
+ "- Registry: io.github.WickedAPI/wicked-mcp on https://registry.modelcontextprotocol.io",
55
55
  "- Server card: " + SITE + "/.well-known/mcp/server-card.json",
56
56
  "",
57
57
  "Wallet-signed tools (identity, memory, registry registration) never sign for you: you supply the signature from your own wallet.",
@@ -63,7 +63,7 @@ export function serverCard(tools, version) {
63
63
  $schema: "https://static.modelcontextprotocol.io/schemas/mcp-server-card/v1.json",
64
64
  version: "1.0",
65
65
  protocolVersion: "2025-06-18",
66
- serverInfo: { name: "io.github.wickedapi/wicked-mcp", title: "Wicked MCP", version },
66
+ serverInfo: { name: "io.github.WickedAPI/wicked-mcp", title: "Wicked MCP", version },
67
67
  description: `The whole Wicked suite for agents: ${tools.length} tools across market data, DeFi/token risk, identity, reputation, registry, sanity checks, memory and paywalls. x402-native.`,
68
68
  documentationUrl: "https://github.com/WickedAPI/wicked-mcp",
69
69
  transport: { type: "streamable-http", endpoint: "/mcp" },
package/dist/server.js CHANGED
@@ -167,8 +167,31 @@ function registerServiceTools(server, service, doc, doFetch) {
167
167
  catch {
168
168
  body = text;
169
169
  }
170
+ if (!r.ok) {
171
+ // x402 v2 services answer an unpaid call with an empty body and put the
172
+ // price/payTo challenge only in the base64 Payment-Required header; surface
173
+ // it (and the status) so an agent sees what to pay instead of a blank error.
174
+ const env = body && typeof body === "object" && !Array.isArray(body) ? { ...body } : body === "" ? {} : { raw_body: body };
175
+ env.http_status = r.status;
176
+ const header = r.headers.get("payment-required");
177
+ if (header) {
178
+ try {
179
+ env.payment_required = JSON.parse(Buffer.from(header, "base64").toString("utf8"));
180
+ }
181
+ catch {
182
+ /* leave undecoded */
183
+ }
184
+ }
185
+ if (r.status === 402) {
186
+ env.how_to_pay =
187
+ "Priced endpoint. Pay the x402 challenge in payment_required (USDC on Base), or set WICKEDAPI_API_KEY for the free tier, " +
188
+ "or run `npx -y @wickedlabs/wicked-mcp` locally with WICKEDAPI_PAYER_PRIVATE_KEY to auto-pay.";
189
+ }
190
+ body = env;
191
+ }
170
192
  return {
171
- isError: !r.ok,
193
+ // A 402 is the price, not a tool failure; everything else non-2xx is an error.
194
+ isError: !r.ok && r.status !== 402,
172
195
  content: [{ type: "text", text: JSON.stringify(body, null, 2) }],
173
196
  };
174
197
  });
@@ -308,7 +331,7 @@ function registerPrompts(server) {
308
331
  };
309
332
  });
310
333
  }
311
- export const SERVER_VERSION = "0.6.1";
334
+ export const SERVER_VERSION = "0.7.1";
312
335
  export async function loadWorld() {
313
336
  const doFetch = await buildFetcher();
314
337
  const specs = [];
package/dist/suite.js CHANGED
@@ -248,6 +248,19 @@ export function registerSuiteTools(server) {
248
248
  }, (a) => call("GET", REPUTATION_URL, "/agents/query", { query: { sort: "-stake_amount", limit: 20, ...clean(a) } }));
249
249
  tool("reputation_tiers", "[Wicked Reputation] Live tier thresholds and benefits (min stake, rate-limit multiplier, fee discount). Read at call time — thresholds are admin-configurable.", {}, () => call("GET", REPUTATION_URL, "/tiers"));
250
250
  tool("reputation_transparency", "[Wicked Reputation] Live transparency numbers: treasury address, custody model, unbonding cooldown, total stake, agents, slash events, founding-slot counts.", {}, () => call("GET", REPUTATION_URL, "/transparency"));
251
+ tool("reputation_leaderboard", "[Wicked Reputation] Public leaderboard: every agent's current active stake, tier and slash count. Free.", { limit: z.coerce.number().optional().describe("Max rows (default set by the service).") }, ({ limit }) => call("GET", REPUTATION_URL, "/leaderboard", { query: { limit } }));
252
+ tool("reputation_history", "[Wicked Reputation] An agent's history of reputation/tier changes over time. Free. 404 means the wallet never registered.", { wallet }, ({ wallet }) => call("GET", REPUTATION_URL, `/agents/${addr(wallet)}/history`));
253
+ tool("reputation_erc8004", "[Wicked Reputation] Cross-reference a wallet against the open ERC-8004 Identity and Reputation registries (read-only). Free.", { wallet }, ({ wallet }) => call("GET", REPUTATION_URL, `/agents/${addr(wallet)}/erc8004`));
254
+ const repSig = {
255
+ wallet: z.string().describe("Your 0x wallet address on Base."),
256
+ nonce: z.string().describe("Nonce from a FRESH reputation_get_nonce call."),
257
+ signature: z.string().describe("0x-prefixed ECDSA signature (EIP-191) over that nonce's message, from YOUR wallet."),
258
+ };
259
+ tool("reputation_get_nonce", "[Wicked Reputation] Step 1 of every signed Reputation call (register, stake, unstake, withdraw): a one-time nonce plus the exact message to sign. Each signed call needs a fresh nonce.", { wallet }, ({ wallet }) => call("GET", REPUTATION_URL, `/agents/${addr(wallet)}/nonce`));
260
+ tool("reputation_register", "[Wicked Reputation] Register your wallet as an agent (no stake required). Needs your signature over reputation_get_nonce's message; this tool never signs.", repSig, ({ wallet, nonce, signature }) => call("POST", REPUTATION_URL, "/agents/register", { json: { wallet_address: wallet, nonce, signature } }));
261
+ tool("reputation_stake", "[Wicked Reputation] Record a USDC stake that YOU already sent on-chain to the treasury (see reputation_transparency for the address). Real funds: send the transfer from your own wallet first, then pass its tx_hash with a signed nonce. This tool never moves funds or signs.", { ...repSig, tx_hash: z.string().describe("Hash of your on-chain USDC transfer to the treasury."), amount: z.coerce.number().describe("USDC amount staked.") }, ({ wallet, nonce, signature, tx_hash, amount }) => call("POST", REPUTATION_URL, `/agents/${addr(wallet)}/stake`, { json: { nonce, signature, tx_hash, amount } }));
262
+ tool("reputation_unstake", "[Wicked Reputation] Start the unbonding period for `amount` of your active stake. It stops counting toward tier/reputation immediately; withdraw after the cooldown (see reputation_transparency). Needs a signed nonce.", { ...repSig, amount: z.coerce.number().describe("USDC amount to unbond.") }, ({ wallet, nonce, signature, amount }) => call("POST", REPUTATION_URL, `/agents/${addr(wallet)}/unstake`, { json: { nonce, signature, amount } }));
263
+ tool("reputation_withdraw", "[Wicked Reputation] Pay out every unbonding stake whose cooldown has elapsed, in one on-chain transfer to your wallet. Safe to retry if a payout fails. Needs a signed nonce.", repSig, ({ wallet, nonce, signature }) => call("POST", REPUTATION_URL, `/agents/${addr(wallet)}/withdraw`, { json: { nonce, signature } }));
251
264
  // ---- Wicked Registry ----
252
265
  tool("registry_search_tools", "[Wicked Registry] Search x402/MCP tools by real reliability data (uptime, latency, schema conformance). Works via x402 (402 carries payment instructions) or a free API key (pass api_key, or set REGISTRY_API_KEY). No key yet? Call registry_onboarding_message then registry_create_api_key to get one yourself. For a quick free check of a known tool, use registry_lookup.", {
253
266
  api_key: z.string().optional().describe("Free Wicked Registry API key (wr_...). Overrides REGISTRY_API_KEY."),
@@ -279,6 +292,8 @@ export function registerSuiteTools(server) {
279
292
  signature: z.string().describe("0x-prefixed ECDSA signature over the message."),
280
293
  label: z.string().optional().describe("Optional label for the key."),
281
294
  }, (a) => call("POST", REGISTRY_URL, "/keys", { json: { wallet: a.wallet, timestamp: a.timestamp, signature: a.signature, label: a.label } }));
295
+ tool("registry_key_info", "[Wicked Registry] Metadata and usage for a Registry API key (wr_...): label, created time, call counts. Pass api_key, or set REGISTRY_API_KEY.", { api_key: z.string().optional().describe("Registry API key to inspect. Overrides REGISTRY_API_KEY.") }, ({ api_key }) => call("GET", REGISTRY_URL, "/keys/self", { headers: keyHeader(api_key || REGISTRY_API_KEY) }));
296
+ tool("registry_revoke_key", "[Wicked Registry] PERMANENTLY revoke a Registry API key (the one presented). Use if a key leaked. Pass api_key, or set REGISTRY_API_KEY.", { api_key: z.string().optional().describe("Registry API key to revoke. Overrides REGISTRY_API_KEY.") }, ({ api_key }) => call("DELETE", REGISTRY_URL, "/keys/self", { headers: keyHeader(api_key || REGISTRY_API_KEY) }));
282
297
  tool("registry_featured_tools", "[Wicked Registry] Top scored active tools. Public and free.", {}, () => call("GET", REGISTRY_URL, "/featured-tools"));
283
298
  tool("registry_tool_badge", "[Wicked Registry] A tool's current composite reliability score. Public and free.", { tool_id: z.string().describe("The tool's Wicked Registry id.") }, ({ tool_id }) => call("GET", REGISTRY_URL, `/tools/${encodeURIComponent(tool_id)}/badge`));
284
299
  tool("registry_report_tool", "[Wicked Registry] File a complaint about a tool's reliability or behaviour. Public, rate-limited; reviewed manually, never auto-suspends.", {
@@ -341,6 +356,7 @@ export function registerSuiteTools(server) {
341
356
  const modeShape = z.string().optional().describe('"grounded" (default; check against context) or "open" (check against live web evidence — consistency with the web, not objective truth).');
342
357
  tool("sanity_check", '[Wicked Sanity] Verify one claim before acting on it. Verdicts: supported | contradicted | unsupported | insufficient_evidence (see `data`). confidence_score is raw consistency (a "contradicted" verdict scores near 0). Policy: act on supported; treat unsupported/insufficient_evidence as unverified; reject contradicted. x402 or SANITY_API_KEY; 429 means a rate limit — see retry_after.', { claim: z.string().describe("The single statement to verify (max 5,000 chars)."), context: contextShape, mode: modeShape }, ({ claim, context, mode }) => call("POST", SANITY_URL, "/check", { headers: keyHeader(SANITY_API_KEY), json: { claim, context, mode: mode ?? "grounded" }, timeoutMs: SANITY_TIMEOUT_MS }));
343
358
  tool("sanity_check_batch", "[Wicked Sanity] Verify up to 50 claims against one shared context in a single call — prefer this over one sanity_check per sentence. `data` is a list in the same order as `claims`.", { claims: z.array(z.string()).min(1).max(50).describe("1-50 statements, each up to 5,000 chars."), context: contextShape, mode: modeShape }, ({ claims, context, mode }) => call("POST", SANITY_URL, "/check/batch", { headers: keyHeader(SANITY_API_KEY), json: { claims, context, mode: mode ?? "grounded" }, timeoutMs: SANITY_TIMEOUT_MS }));
359
+ tool("sanity_get_check", "[Wicked Sanity] Fetch a previously run check by its check_id (returned by sanity_check / sanity_check_batch). x402 or SANITY_API_KEY like the other Sanity calls.", { check_id: z.string().describe("The check_id from an earlier sanity_check result.") }, ({ check_id }) => call("GET", SANITY_URL, `/checks/${encodeURIComponent(check_id)}`, { headers: keyHeader(SANITY_API_KEY) }));
344
360
  // ---- Wicked Memory (wallet-scoped, signature per call) ----
345
361
  tool("memory_prepare", 'Wicked Memory step 1 of every call: returns the exact `message_to_sign`. Sign it with your own wallet (EIP-191 personal_sign), then call the matching memory_* tool with the SAME arguments plus the returned timestamp, nonce and your signature. Timestamp must be within 5 minutes; nonce is single-use, so prepare again for every call.', {
346
362
  operation: z.string().describe('"store", "search", "get", "update", "history", "delete" or "deletions".'),
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "@wickedlabs/wicked-mcp",
3
- "version": "0.6.1",
4
- "description": "MCP server for the whole Wicked suite — trading data, DeFi protocol health, token safety, SEC filings alerts, wallet and sanctions checks, brokerage sync, agent identity, reputation, tool registry, hallucination checks, persistent memory, and x402 paywalls. 90 tools, 6 resources, 3 prompts. No signup required: pay per call in USDC via x402, or use a partner API key.",
3
+ "version": "0.7.1",
4
+ "description": "MCP server for the whole Wicked suite — trading data, DeFi protocol health, token safety, SEC filings alerts, wallet and sanctions checks, brokerage sync, agent identity, reputation, tool registry, hallucination checks, persistent memory, and x402 paywalls. 105 tools, 6 resources, 3 prompts. No signup required: pay per call in USDC via x402, or use a partner API key.",
5
5
  "type": "module",
6
6
  "bin": {
7
7
  "wickedapi-mcp": "dist/index.js"
@@ -59,5 +59,5 @@
59
59
  "type": "git",
60
60
  "url": "git+https://github.com/WickedAPI/wicked-mcp.git"
61
61
  },
62
- "mcpName": "io.github.wickedapi/wicked-mcp"
62
+ "mcpName": "io.github.WickedAPI/wicked-mcp"
63
63
  }