agent402-mcp 0.13.2 → 0.13.4

package/README.md

@@ -2,7 +2,7 @@
 
 MCP server for [Agent402](https://agent402.tools), the applied layer of [Agentic Finance](https://agent402.tools/agentic-finance) - a catalog of **500+: 400+ pay-per-call web tools + 80+ curated multi-tool skill packs** for AI agents (every one tested, priced, and settled on-chain; every one earns its place), paid per call in USDC via the [x402 protocol](https://www.x402.org), **with compute (proof-of-work)** when no wallet is configured, or **by card** through a prepaid credits key. (The hosted API is dual-stack: it also accepts [MPP](https://agent402.tools/what-is-mpp) clients on the same 402, settling on Base/Celo or natively on Tempo; this package pays via x402 or credits.) Built by [Havok Holdings LLC](https://github.com/MikeyPetrillo/Agent402).
 
-Your agent gets browser rendering, screenshots, PDF text extraction, URL→markdown, live web search **+ web answers with citations**, live **financial/crypto/macro data** (Yahoo stock quotes, CoinGecko, FRED, ECB FX, World Bank, yield curve), **SEC EDGAR filings** (10-K/10-Q text, XBRL, insider, 13F, IPO calendar), **deterministic stats & forecasting** (Pearson correlation, OLS, Holt-Winters), **compression** (gzip/brotli), DNS/TLS/WHOIS + email-deliverability checks, wallet-keyed shared memory, and 200+ deterministic pure-CPU utilities - plus 100+ **skill packs** like `security-audit`, `trend-analysis`, `structured-scrape`, `decode-blob`, and `forecasting-bake-off` callable as MCP prompts, and the **report products** (deep research, company dossier, 13F fund report, domain audit, token risk, FDA recall, insider flow, market brief) as ordinary catalog slugs. Payment handled invisibly underneath the MCP calls. No signup, no API key.
+Your agent gets browser rendering, screenshots, PDF text extraction, URL→markdown, live web search **+ web answers with citations**, live **financial/crypto/macro data** (US equity quotes and daily bars from Databento, CoinGecko, FRED, ECB FX, World Bank, yield curve), **SEC EDGAR filings** (10-K/10-Q text, XBRL, insider, 13F, IPO calendar), **deterministic stats & forecasting** (Pearson correlation, OLS, Holt-Winters), **compression** (gzip/brotli), DNS/TLS/WHOIS + email-deliverability checks, wallet-keyed shared memory, and 200+ deterministic pure-CPU utilities - plus 100+ **skill packs** like `security-audit`, `trend-analysis`, `structured-scrape`, `decode-blob`, and `forecasting-bake-off` callable as MCP prompts, and the **report products** (deep research, company dossier, 13F fund report, domain audit, token risk, FDA recall, insider flow, market brief) as ordinary catalog slugs. Payment handled invisibly underneath the MCP calls. No signup, no API key.
 
 ## Quick start
 
@@ -15,7 +15,7 @@ wrapped with `mppx`'s `McpClient.wrap()` (USDC on Base/Celo, or native Tempo)
 pays and retries on its own, receipt in `_meta`. For no rate limit, or to pay
 over x402 or by card instead, run this package locally:
 
-With a funded wallet (USDC on Base, Polygon, Arbitrum, Monad, or Solana, or USDG on Robinhood Chain - the underlying service accepts 12 chains in total, but this package currently signs only EVM and Solana payments) - every tool available:
+With a funded wallet (USDC on any EVM rail the server offers - Base, Polygon, Arbitrum, Monad, Celo, Avalanche, Sei, Optimism - or USDG on Robinhood Chain, or USDC on Solana via `SOLANA_AGENT_KEY`; the service also settles on Stellar and Algorand, which this package does not sign) - every tool available:
 
 ```json
 {
@@ -98,7 +98,7 @@ so set `AGENT402_MAX_PER_CALL` if you want a hard per-call ceiling.
   | ≤ $0.50 | $0.55 | `POST /api/route/execute-max` |
 
   A tool priced above the tier's ceiling returns a self-correcting 409 naming its direct route.
-- **Report products** are catalog slugs like any other, so `catalog.call` runs them with a wallet or a credits key: `research` ($0.35), `research-pro` ($0.65), `research-max` ($1.10), `market-brief` ($0.35), `dossier` ($0.55), `dossier-max` ($0.95), `fund-report` ($0.25), `fund-report-max` ($0.50), `domain-audit` ($0.20), `domain-audit-pro` ($0.30), `token-risk` ($0.30), `token-risk-pro` ($0.60), `token-brief` ($0.35), `recall-report` ($0.20), `insider-report` ($0.25), `filing-report` ($0.25), `ticker-pack` ($0.75). The same reports are sold to people by card at https://agent402.tools/reports for $1, or $2 for the deepest three: the card price includes payment processing, and an agent paying per call pays the lower tool price for the same report. The recurring monitors (domain, SEC filing, token, fund, recall, insider, IPO - $3/month) are at https://agent402.tools/monitors.
+- **Report products** are catalog slugs like any other, so `catalog.call` runs them with a wallet or a credits key: `research` ($0.60), `research-pro` ($0.85), `research-max` ($1.10), `market-brief` ($0.85), `dossier` ($0.85), `dossier-max` ($1.10), `fund-report` ($0.60), `fund-report-max` ($0.85), `domain-audit` ($0.60), `domain-audit-pro` ($0.85), `token-risk` ($0.60), `token-risk-pro` ($0.85), `token-brief` ($0.60), `recall-report` ($0.60), `insider-report` ($0.60), `filing-report` ($0.85), `ticker-pack` ($2.00); the live figures are always at https://agent402.tools/api/pricing. The same reports are sold to people by card at https://agent402.tools/reports for $2 to $5 depending on depth: the card price includes payment processing, and an agent paying per call pays the lower tool price for the same report. The recurring monitors (domain, SEC filing, token, fund, recall, insider, IPO, research - $5/month) are at https://agent402.tools/monitors.
 
 ## Workflows (skill packs)
 

package/index.js

@@ -72,7 +72,7 @@ let spentUsd = 0;
 
 const DEFAULT_CURATED = [
   // Flagship demand set — keep aligned with src/mcp-flagship.js FLAGSHIP_SLUGS.
-  // Search/answer is the front door; long tail stays behind search_tools/call_tool.
+  // Search/answer is the front door; long tail stays behind catalog.search/catalog.call.
   "search", "answer", "search-news", "render",
   "stock-quote", "transcribe", "memory-read", "memory-write",
 ];
@@ -201,6 +201,76 @@ function walletRequiredText(tool) {
   ].join(" ");
 }
 
+// ---------------------------------------------------------------------------
+// What THIS call will actually be asked to pay.
+//
+// The catalog price is the ROUTE's list price, and it is not always the amount
+// in the challenge: a route may quote per request from the body (a token-
+// metered route, or a chat route priced by the model named in it). A cap
+// enforced against the list price is therefore not a cap at all, so both paid
+// paths read the amount out of the 402 before spending anything.
+//
+// The preflight carries no payment header and no credits key, so it can only
+// ever draw an unpaid 402 - it never signs and never debits. Only run when a
+// ceiling is configured: with none, the number changes nothing and the round
+// trip is pure cost.
+const CAPS_CONFIGURED = Number.isFinite(MAX_PER_CALL) || Number.isFinite(BUDGET);
+
+/** The accepts array, at the top level or under the envelope keys sellers wrap it in. */
+function acceptsOf(obj) {
+  if (!obj || typeof obj !== "object") return null;
+  if (Array.isArray(obj.accepts) && obj.accepts.length) return obj.accepts;
+  for (const k of ["payment", "x402", "paymentRequired", "payment_required"]) {
+    const nested = obj[k];
+    if (nested && typeof nested === "object" && Array.isArray(nested.accepts) && nested.accepts.length) return nested.accepts;
+  }
+  return null;
+}
+
+/** The MAXIMUM across accepts: the wallet picks which chain to settle on and
+ *  this server cannot know which, so the only sound ceiling is the dearest
+ *  offer. An entry we cannot price makes the whole quote unreadable (null),
+ *  never a guess. */
+function usdFromAccepts(accepts) {
+  if (!Array.isArray(accepts) || !accepts.length) return null;
+  let maxUsd = null;
+  for (const a of accepts) {
+    // v2 names the base-unit amount `amount`; x402 v1 called it `maxAmountRequired`.
+    const atomic = Number(a && (a.amount ?? a.maxAmountRequired));
+    if (!Number.isFinite(atomic) || atomic < 0) return null;
+    // USDC is 6 decimals on every chain these rails settle; a wrong exponent is
+    // a 1000x pricing error, so an out-of-range hint reads as unreadable.
+    const declared = (a && a.extra && a.extra.decimals) ?? (a && a.decimals);
+    const decimals = declared == null ? 6 : Number(declared);
+    if (!Number.isInteger(decimals) || decimals < 0 || decimals > 30) return null;
+    const usd = atomic / 10 ** decimals;
+    if (maxUsd == null || usd > maxUsd) maxUsd = usd;
+  }
+  return maxUsd;
+}
+
+/** The quoted price for this request, or `listUsd` when the 402 cannot be read.
+ *  x402 v2 carries the challenge base64 in the PAYMENT-REQUIRED header and
+ *  leaves the body `{}`; v1 sellers put it in the body. Header first. */
+async function quotedUsd(url, init, listUsd) {
+  if (!CAPS_CONFIGURED) return listUsd;
+  try {
+    const pre = await fetch(url, init);
+    if (pre.status !== 402) return listUsd;
+    let quoted = null;
+    const header = pre.headers.get("payment-required");
+    if (header) {
+      try { quoted = usdFromAccepts(acceptsOf(JSON.parse(Buffer.from(header.trim(), "base64").toString("utf8")))); } catch { quoted = null; }
+    }
+    if (quoted == null) {
+      let body = null; try { body = await pre.json(); } catch { body = null; }
+      quoted = usdFromAccepts(acceptsOf(body));
+    }
+    // Larger of the two: an understated catalog must not lower the ceiling.
+    return quoted == null ? listUsd : Math.max(listUsd, quoted);
+  } catch { return listUsd; /* fail-open to the advertised price */ }
+}
+
 async function callEndpoint(tool, args = {}) {
   const url = new URL(`${BASE}${tool.path}`);
   const init = { method: tool.method, headers: { Accept: "application/json" } };
@@ -216,14 +286,16 @@ async function callEndpoint(tool, args = {}) {
 
   let res;
   if (!HAS_WALLET && HAS_CREDITS) {
-    // Card credits: same budget guards as the wallet path (the server enforces
-    // the balance; these keep a runaway session from draining a pack).
-    const price = parseFloat(String(tool.price).replace(/[^0-9.]/g, "")) || 0;
+    // Card credits: same budget guards as the wallet path, against the same
+    // number - the credits gate holds and debits what the 402 quotes for THIS
+    // body, not the route's list price.
+    const listUsd = parseFloat(String(tool.price).replace(/[^0-9.]/g, "")) || 0;
+    const price = await quotedUsd(url, init, listUsd);
     if (price > MAX_PER_CALL) {
-      return { content: [{ type: "text", text: `Refused: "${tool.slug}" costs ${tool.price}/call, above the AGENT402_MAX_PER_CALL cap of $${MAX_PER_CALL}.` }], isError: true };
+      return { content: [{ type: "text", text: `Refused: "${tool.slug}" is quoted $${price} for this request${price !== listUsd ? ` (list price ${tool.price})` : ""}, above the AGENT402_MAX_PER_CALL cap of $${MAX_PER_CALL}.` }], isError: true };
     }
     if (spentUsd + price > BUDGET) {
-      return { content: [{ type: "text", text: `Refused: session budget exhausted ($${spentUsd.toFixed(4)} of $${BUDGET} spent; "${tool.slug}" costs ${tool.price}).` }], isError: true };
+      return { content: [{ type: "text", text: `Refused: session budget exhausted ($${spentUsd.toFixed(4)} of $${BUDGET} spent; "${tool.slug}" is quoted $${price} for this request).` }], isError: true };
     }
     res = await fetch(url, { ...init, headers: { ...init.headers, Authorization: `Bearer ${CREDITS_KEY}` } });
     if (res.ok) spentUsd += price;
@@ -232,16 +304,20 @@ async function callEndpoint(tool, args = {}) {
       return { content: [{ type: "text", text: `Credits refused for "${tool.slug}": ${body.error || "payment required"}${body.balanceUsd != null ? ` (balance $${body.balanceUsd})` : ""}. Top up at ${body.topup || `${BASE}/credits`}.` }], isError: true };
     }
   } else if (HAS_WALLET) {
-    const price = parseFloat(String(tool.price).replace(/[^0-9.]/g, "")) || 0;
+    // The wallet signs whatever the challenge asks for (vendor spend controls
+    // are off - this package bounds spend itself), so the cap is checked
+    // against that amount, read from the 402 before anything is signed.
+    const listUsd = parseFloat(String(tool.price).replace(/[^0-9.]/g, "")) || 0;
+    const price = await quotedUsd(url, init, listUsd);
     if (price > MAX_PER_CALL) {
       return {
-        content: [{ type: "text", text: `Refused without paying: "${tool.slug}" costs ${tool.price}/call, above the AGENT402_MAX_PER_CALL cap of $${MAX_PER_CALL}. Raise the cap on this MCP server to allow it.` }],
+        content: [{ type: "text", text: `Refused without paying: "${tool.slug}" is quoted $${price} for this request${price !== listUsd ? ` (list price ${tool.price})` : ""}, above the AGENT402_MAX_PER_CALL cap of $${MAX_PER_CALL}. Raise the cap on this MCP server to allow it.` }],
         isError: true,
       };
     }
     if (spentUsd + price > BUDGET) {
       return {
-        content: [{ type: "text", text: `Refused without paying: session budget exhausted ($${spentUsd.toFixed(4)} of $${BUDGET} spent; "${tool.slug}" costs ${tool.price}). Restart the MCP server or raise AGENT402_BUDGET.` }],
+        content: [{ type: "text", text: `Refused without paying: session budget exhausted ($${spentUsd.toFixed(4)} of $${BUDGET} spent; "${tool.slug}" is quoted $${price} for this request). Restart the MCP server or raise AGENT402_BUDGET.` }],
         isError: true,
       };
     }
@@ -812,14 +888,14 @@ try {
   // Don't hard-exit: starting with an empty catalog still lets the server
   // connect and answer introspection (tools/list) — required to pass directory
   // health checks (e.g. Glama) and more resilient if the catalog endpoint is
-  // briefly unreachable. search_tools/call_tool just return nothing until the
+  // briefly unreachable. catalog.search/catalog.call just return nothing until the
   // catalog is reachable again.
   log(`Could not load the catalog from ${BASE}: ${err.message} — starting with an empty catalog`);
 }
 const requested = (process.env.AGENT402_TOOLS || DEFAULT_CURATED.join(","))
   .split(",").map((s) => s.trim()).filter(Boolean);
 curated = requested.map((slug) => catalog.get(slug)).filter(Boolean);
-log(`catalog: ${catalog.size} tools from ${BASE}; ${curated.length} first-class, rest via search_tools/call_tool`);
+log(`catalog: ${catalog.size} tools from ${BASE}; ${curated.length} first-class, rest via catalog.search/catalog.call`);
 log(
   HAS_WALLET
     ? `payment: USDC via x402 (${[AGENT_KEY && "EVM", SOLANA_AGENT_KEY && "Solana"].filter(Boolean).join(" + ")} wallet configured; max/call ${MAX_PER_CALL === Infinity ? "unlimited" : `$${MAX_PER_CALL}`}, budget ${BUDGET === Infinity ? "unlimited" : `$${BUDGET}`})`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent402-mcp",
-  "version": "0.13.2",
+  "version": "0.13.4",
   "mcpName": "io.github.MikeyPetrillo/agent402",
   "author": "Havok Holdings LLC <mike@agent402.tools> (https://agent402.tools)",
   "homepage": "https://agent402.tools",