@wickedlabs/wicked-mcp 0.7.2 → 0.7.3

package/README.md

@@ -19,7 +19,7 @@ MCP server for the whole [Wicked](https://wickedapi.com) suite — trading data,
 | [Wicked Memory](https://memory.wickedapi.com) | 8 (`memory_prepare`, `memory_store`, `memory_search`, …) | wallet signature on every call; only search is metered |
 | [x402 Paywall](https://paywall.wickedapi.com) | 8 (`paywall_*`) | `paywall_signup` is open; the rest need the tenant key |
 
-Plus **6 resources** (the platform directory, `llms.txt`, and each service's live endpoint catalog) and **7 prompts** (`rug_check`, `vet_dependency`, `morning_briefing`, `fact_check`, `verify_agent`, `find_reliable_tool`, `agent_memory_guide`) that chain tools together the way the [cookbook](../cookbooks/wickedapi-cookbook.md) does.
+Plus **6 resources** (the platform directory, `llms.txt`, and each service's live endpoint catalog) and **10 prompts** (`rug_check`, `vet_dependency`, `morning_briefing`, `fact_check`, `verify_agent`, `find_reliable_tool`, `agent_memory_guide`) that chain tools together the way the [cookbook](../cookbooks/wickedapi-cookbook.md) does.
 
 These tools never sign anything or hold a key. Agents with no wallet can still try Wicked Identity end to end through a sandbox identity (`identity_sandbox_register`, then pass `sandbox_token` instead of a signature); sandbox results are for testing and are never reported as verified. Identity (real wallet), Registry registration and Memory take a signature you produce with your own wallet (`identity_get_nonce` / `memory_prepare` return the exact message to sign). Calls that need x402 payment return the real `402` challenge (decoded under `payment_required` for x402 v2) rather than auto-paying — `WICKEDAPI_PAYER_PRIVATE_KEY` auto-pay applies to the Trading, Protocol Health, Token Risk and Broker Sync tools.
 
@@ -97,6 +97,9 @@ One-click workflows that chain real tool calls (Claude Desktop and other prompt-
 - **`verify_agent`** (`wallet`) — Identity assertion + Reputation stake/tier before you transact with an agent.
 - **`find_reliable_tool`** (`need`, optional `category`, `min_score`) — Registry search by real uptime/latency/schema scores.
 - **`agent_memory_guide`** (`wallet`, `task`) — the two-step signed Memory flow, explained to the model.
+- **`counterparty_check`** (`address`) — OFAC screening and wallet risk (plus Identity/Reputation) before you pay someone.
+- **`insider_watch`** (`ticker`, optional `days`) — insider trades, insider summary and 8-K events for a stock.
+- **`trade_idea_check`** (`symbol`, optional `timeframe`) — verdict, volatility, positioning and news for a trade idea.
 
 ## Environment variables
 

package/dist/landing.js

@@ -16,7 +16,7 @@ const GROUPS = [
     { id: "wallet", label: "Wallet Oracle", prefix: "wallet_", blurb: "Counterparty check: OFAC sanctions, malicious-address flags and on-chain profile for any EVM wallet." },
     { id: "paywall", label: "x402 Paywall", prefix: "paywall_", blurb: "Put any endpoint behind pay-per-call USDC." },
 ];
-export const PROMPT_NAMES = ["rug_check", "vet_dependency", "morning_briefing", "fact_check", "verify_agent", "find_reliable_tool", "agent_memory_guide"];
+export const PROMPT_NAMES = ["rug_check", "vet_dependency", "morning_briefing", "fact_check", "verify_agent", "find_reliable_tool", "agent_memory_guide", "counterparty_check", "insider_watch", "trade_idea_check"];
 function grouped(tools) {
     const claimed = new Set();
     const out = GROUPS.map((g) => {

package/dist/prompts.js

@@ -82,4 +82,74 @@ export function registerSuitePrompts(server) {
                 `Report exactly what the tools returned.`),
         ],
     }));
+    server.registerPrompt("counterparty_check", {
+        title: "Check a counterparty before you pay",
+        description: "Screen a wallet or contract before sending funds: OFAC sanctions, malicious-address flags, and (if it is an agent) its identity and stake.",
+        argsSchema: { address: z.string().describe("The 0x wallet or contract address you are about to transact with.") },
+    }, ({ address }) => ({
+        description: "Counterparty screening",
+        messages: [
+            text(`Before I send anything to ${address}, screen it with real data - never guess:
+
+` +
+                `1. Call \`wallet_sanctions_check\` (free) with the address. Report whether it is on the OFAC SDN list and the sanctioned entity if so.
+` +
+                `2. Call \`wallet_check\` for the broader pre-transaction check (malicious-address flags and on-chain signals). If it returns http_status 402, show me the price from payment_required and continue with what is free.
+` +
+                `3. If this address is an agent I might deal with repeatedly, also call \`identity_status\` and \`reputation_status\` for it (a 404 from reputation means never registered, not an error).
+
+` +
+                `Summarize: sanctioned or not, any flags, and what is unknown. These are signals, not a guarantee.`),
+        ],
+    }));
+    server.registerPrompt("insider_watch", {
+        title: "Insider and filings watch",
+        description: "For a stock ticker, combine recent insider trading, an insider summary and classified 8-K events from SEC filings.",
+        argsSchema: {
+            ticker: z.string().describe('US stock ticker, e.g. "NVDA".'),
+            days: z.string().optional().describe("Lookback window in days (default 30)."),
+        },
+    }, ({ ticker, days }) => ({
+        description: "Insider and filings watch",
+        messages: [
+            text(`Build an insider and filings view of ${ticker} over the last ${days || "30"} days using real data only:
+
+` +
+                `1. \`filings_insider_summary\` for the ticker: open-market buy and sell counts and dollar totals.
+` +
+                `2. \`filings_insider_trades\` for the individual Form 4 trades (insider, role, code, size). Report exact values.
+` +
+                `3. \`filings_8k_events\` for material events (earnings, executive changes, agreements).
+` +
+                `4. Optionally \`earnings_calendar\` for the next report date.
+
+` +
+                `If any call returns http_status 402, show the price from payment_required rather than guessing. Then summarize what the filings actually show; do not speculate beyond them.`),
+        ],
+    }));
+    server.registerPrompt("trade_idea_check", {
+        title: "Check a trade idea",
+        description: "Pressure-test a trade on one asset with the verdict engine, volatility, positioning and fresh news, without inventing numbers.",
+        argsSchema: {
+            symbol: z.string().describe("Asset symbol, e.g. BTC, ETH, SOL, NVDA."),
+            timeframe: z.string().optional().describe("Timeframe such as 1h or 1D (default 1h)."),
+        },
+    }, ({ symbol, timeframe }) => ({
+        description: "Trade idea check",
+        messages: [
+            text(`Pressure-test a trade on ${symbol} (${timeframe || "1h"}) from real tool output only:
+
+` +
+                `1. \`verdict\` for the bias, confidence, thesis, entry, invalidation and targets.
+` +
+                `2. \`atr\` for volatility and regime (size the stop from it).
+` +
+                `3. For crypto: \`funding_oi\` and \`long_short_ratio\` for crowding; \`liquidity_levels\` for nearby pools.
+` +
+                `4. \`crypto_news\` for fresh headlines that could invalidate the idea.
+
+` +
+                `Quote exact values. If a call returns 402, show the price instead of guessing. End with a plain verdict and what would invalidate it. This is analysis from tools, not financial advice.`),
+        ],
+    }));
 }

package/dist/server.js

@@ -361,7 +361,7 @@ function registerPrompts(server) {
         };
     });
 }
-export const SERVER_VERSION = "0.7.2";
+export const SERVER_VERSION = "0.7.3";
 export async function loadWorld() {
     const doFetch = await buildFetcher();
     const specs = [];

package/dist/suite.js

@@ -22,7 +22,9 @@ const REGISTRY_URL = envUrl("REGISTRY_BASE_URL", "https://registry.wickedapi.com
 const IDENTITY_URL = envUrl("IDENTITY_BASE_URL", "https://verify.wickedapi.com");
 const SANITY_URL = envUrl("SANITY_BASE_URL", "https://sanity.wickedapi.com");
 const MEMORY_URL = envUrl("MEMORY_BASE_URL", "https://memory.wickedapi.com");
-const PAYWALL_URL = envUrl("PAYWALL_BASE_URL", "https://paywall.wickedapi.com");
+// The tenant/config API lives on paywall-admin; paywall.wickedapi.com is the gateway that serves the paid routes.
+const PAYWALL_URL = envUrl("PAYWALL_BASE_URL", "https://paywall-admin.wickedapi.com");
+const PAYWALL_GATEWAY_URL = envUrl("PAYWALL_GATEWAY_URL", "https://paywall.wickedapi.com");
 const REGISTRY_API_KEY = process.env.REGISTRY_API_KEY || "";
 const IDENTITY_API_KEY = process.env.IDENTITY_API_KEY || "";
 const SANITY_API_KEY = process.env.SANITY_API_KEY || "";
@@ -450,6 +452,7 @@ export function registerSuiteTools(server) {
         description: z.string().optional().describe("Up to 200 chars: letters, digits, space . _ -"),
         upstreamUrl: z.string().optional().describe("Your https backend. Omit for the demo confirmation payload."),
     };
+    tool("paywall_demo_weather", "[x402 Paywall] Call the live demo route on the paywall gateway (GET /wickedapi/weather) to see a real x402 challenge: unpaid, it returns HTTP 402 with the decoded price, network and payTo in payment_required. A safe way to learn what a paywalled endpoint looks like before creating your own.", {}, () => call("GET", PAYWALL_GATEWAY_URL, "/wickedapi/weather"));
     tool("paywall_signup", "[x402 Paywall] Create a tenant account. Returns a Bearer apiKey ONCE — store it and set PAYWALL_API_KEY. Rate-limited to 5/hour per IP.", {
         name: z.string().describe("Letters, digits, space . _ - (max 100)."),
         slug: z.string().describe("Lowercase a-z0-9 and hyphens, 2-40 chars; becomes your mount path prefix /{slug}."),

package/dist/toolMeta.js

@@ -108,6 +108,7 @@ const USAGE = {
     memory_delete: { u: "you must permanently erase a memory (right to be forgotten).", n: "correcting it (use memory_update, which keeps history)." },
     memory_deletions: { u: "you want your audit log of deletions (ids, times, reasons, never content).", n: "recovering content, which is gone." },
     // --- Paywall ---
+    paywall_demo_weather: { u: "you want to see a real x402 payment challenge from a paywalled route (price, network, payTo) without creating anything.", n: "setting up your own paywall (use paywall_signup then paywall_create_route)." },
     paywall_signup: { u: "you want a paywall tenant account and its API key (shown once).", n: "managing routes of an existing tenant." },
     paywall_get_tenant: { u: "you want your tenant record (name, slug, key hint).", n: "route management." },
     paywall_list_routes: { u: "you want your paywalled routes and their prices.", n: "earnings (use paywall_list_settlements)." },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wickedlabs/wicked-mcp",
-  "version": "0.7.2",
+  "version": "0.7.3",
   "description": "MCP server for the whole Wicked suite — trading data, DeFi protocol health, token safety, SEC filings alerts, wallet and sanctions checks, brokerage sync, agent identity, reputation, tool registry, hallucination checks, persistent memory, and x402 paywalls. 100+ tools, 6 resources, 3 prompts. No signup required: pay per call in USDC via x402, or use a partner API key.",
   "type": "module",
   "bin": {