baconservices-mcp 0.2.0 → 0.4.0

package/README.md

@@ -18,19 +18,22 @@ spending limits.
 
 | Tool | Does | Price (2026-10-17) |
 |---|---|---|
-| `remove_background` | Removes the background from one photo; returns a transparent PNG at the photo's size | 0.20 USDC |
+| `remove_background` | Removes the background from one photo; returns a transparent PNG at the photo's size | 0.05 USDC |
 | `optimize_image` | Resizes so the longest side ≤ `max_width` (64–4096, default 1600) and encodes WebP at `quality` (40–95, default 80) | 0.01 USDC |
 | `image_palette` | The colours one image is mostly made of, as JSON: up to `count` (1–12, default 6) hex colours with their share, `include_neutrals` (default true) | 0.01 USDC |
 | `brand_from_url` | Reads one public web page (`url`) and returns its brand as JSON: name, description, logo URLs, colours, fonts, social profiles. No JavaScript runs; robots.txt is respected | 0.03 USDC |
-| `vectorize_image` | Traces one image into an SVG of flat-colour paths: `colors` (2–32, default 16), `detail` (`smooth`, `balanced` or `detailed`, default `balanced`). Best for logos and icons | 0.05 USDC |
+| `page_metadata` | Reads one public web page (`url`) and returns its SEO and link-preview metadata as JSON: title and description with lengths, canonical, redirects, robots rules, Open Graph and Twitter cards, headings, JSON-LD types, and a list of issues. Nothing it links to is fetched; robots.txt is respected | 0.01 USDC |
+| `accessibility_check` | An automated WCAG check of one public web page (`url`) with axe-core: `standard` (`wcag22aa` default, or `wcag21aa`), `viewport` (`desktop` default, or `mobile`). JSON: failing rules with WCAG criteria, element counts and examples, what needs review, and the criteria a person must test. The page's own scripts don't run. Not a certification of WCAG or ADA conformance | 0.05 USDC |
+| `vectorize_image` | Traces one image into an SVG of flat-colour paths: `colors` (2–32, default 16), `detail` (`smooth`, `balanced` or `detailed`, default `balanced`). Best for logos and icons; a photo's SVG is larger than the photo, and `colors` sets the size | 0.05 USDC |
+| `clean_svg` | Cleans and simplifies one SVG (`svg` markup, `svg_url` or `svg_path`, up to 1 MB) and returns it as JSON with a report. Rebuilt from an allowlist: scripts, event handlers, animation, links and outside references are removed; editor data, unused definitions and hidden or empty elements go; numbers are rounded to `precision` (1–6, default 3) and paths rewritten short. `simplify` (`none` default, `light`, `strong`) moves points on straight runs; `keep_ids` (default false) keeps ids and classes | 0.01 USDC |
 
 Image tools take PNG, JPEG or WebP up to 8 MB, as `image_url` (public https) or `image_path` (a
 local file). `remove_background`, `optimize_image` and `vectorize_image` return a signed download
-link (valid 24 hours); `image_palette` and `brand_from_url` return their JSON result in the tool result. Add
-`save_to` to write either kind to disk. Prices come from Bacon's live catalog, and each paid tool
+link (valid 24 hours); `image_palette`, `brand_from_url`, `page_metadata`, `accessibility_check` and `clean_svg` return their JSON result in the tool result. Add
+`save_to` to write either kind to disk. A JSON result over 256 KB (a large cleaned SVG, say) is not shown, so pass `save_to` for one. Prices come from Bacon's live catalog, and each paid tool
 states its current price in its description.
 
-`image_palette`, `brand_from_url` and `vectorize_image` appear once Bacon's catalog publishes
+`image_palette`, `brand_from_url`, `page_metadata`, `accessibility_check`, `vectorize_image` and `clean_svg` appear once Bacon's catalog publishes
 them with contract versions. A service the installed package doesn't understand is listed by `list_services` but
 can't be called until you update the package.
 
@@ -152,7 +155,7 @@ All of these checks happen before anything is signed:
   cap is set to your per-call limit as a second lock.
 - **Funds.** It reads your USDC balance first. If it's too low, or the balance can't be read,
   you get a plain message and nothing is signed.
-- **Your approval, where possible.** If the MCP host supports it, you're asked *"Pay 0.2 USDC on
+- **Your approval, where possible.** If the MCP host supports it, you're asked *"Pay 0.05 USDC on
   Base to Bacon Services to run remove_background?"* Not every host can ask, so the limits are
   the real boundary.
 - **No double payments.** Each purchase signs one payment for one request. If the connection drops,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "baconservices-mcp",
-  "version": "0.2.0",
-  "description": "MCP server that lets an AI agent buy Bacon Services tools per call in USDC over x402: remove a background, optimize an image for the web, read an image's colour palette, read a brand from a URL, trace an image into an SVG. With local spending limits.",
+  "version": "0.4.0",
+  "description": "MCP server that lets an AI agent buy Bacon Services tools per call in USDC over x402: remove a background, optimize an image for the web, read an image's colour palette, read a brand from a URL, read a page's SEO metadata, run an automated WCAG accessibility check, trace an image into an SVG, clean up an SVG. With local spending limits.",
   "mcpName": "io.github.afmontoya/baconservices-mcp",
   "type": "module",
   "bin": {

package/src/contracts.js

@@ -3,7 +3,7 @@
 // The live catalog decides what is FOR SALE (and at what price); this table decides what this
 // package will EXECUTE. A capability becomes a paid tool only when its catalog entry matches one
 // of these contracts exactly. A contract is the capability id, its behaviour `version`, its
-// `input_version` and `output_version`, an input type (one image, or one web page URL) with the
+// `input_version` and `output_version`, an input type (one image, one web page URL, or one SVG) with the
 // same option names, types, bounds and allowed values, an output (an artifact file of one MIME type, or a JSON
 // result), synchronous execution, and declared limits. Anything else — a new capability, a new
 // version, a changed schema, a catalog contract_version this package does not know — is still
@@ -14,9 +14,13 @@ export const SUPPORTED_CATALOG_VERSIONS = [1];
 
 export const IMAGE_FORMATS = ['image/png', 'image/jpeg', 'image/webp'];
 
+/** The input formats each input type may declare. A URL input declares the page's, unchecked here. */
+const FORMATS = { image: { allowed: IMAGE_FORMATS, label: 'PNG/JPEG/WebP' }, svg: { allowed: ['image/svg+xml'], label: 'SVG' } };
+
 const INPUTS = {
     image: { image_url: { type: 'string' }, image_base64: { type: 'string' } },
     url: { url: { type: 'string' } },
+    svg: { svg: { type: 'string' }, svg_url: { type: 'string' } },
 };
 
 export const CONTRACTS = [
@@ -81,6 +85,35 @@ export const CONTRACTS = [
         output: { kind: 'json', mime: 'application/json' },
         execution: 'sync',
     },
+    {
+        tool: 'page_metadata',
+        id: 'page-metadata',
+        version: 1,
+        inputVersion: 1,
+        outputVersion: 1,
+        title: 'Page metadata',
+        summary: 'Reads one public web page and returns what it tells search engines and link previews, as JSON: title and description with lengths, canonical, redirects, robots rules, Open Graph and Twitter cards, headings, JSON-LD types and a list of SEO issues. No JavaScript runs; robots.txt is respected.',
+        input: 'url',
+        options: {},
+        output: { kind: 'json', mime: 'application/json' },
+        execution: 'sync',
+    },
+    {
+        tool: 'accessibility_check',
+        id: 'accessibility-check',
+        version: 1,
+        inputVersion: 1,
+        outputVersion: 1,
+        title: 'Accessibility check',
+        summary: 'An automated WCAG check of one public web page (axe-core), as JSON: each failing rule with its impact, WCAG criteria, element count and examples; what needs review; and the criteria a person must test. Not a certification of WCAG or ADA conformance. Scripts on the page do not run; robots.txt is respected.',
+        input: 'url',
+        options: {
+            standard: { type: 'string', enum: ['wcag22aa', 'wcag21aa'], default: 'wcag22aa', description: 'wcag22aa: WCAG 2.2 A and AA. wcag21aa: WCAG 2.1 A and AA.' },
+            viewport: { type: 'string', enum: ['desktop', 'mobile'], default: 'desktop', description: 'desktop: 1280 x 800. mobile: 390 x 844, touch.' },
+        },
+        output: { kind: 'json', mime: 'application/json' },
+        execution: 'sync',
+    },
     {
         tool: 'vectorize_image',
         id: 'vectorize',
@@ -88,15 +121,32 @@ export const CONTRACTS = [
         inputVersion: 1,
         outputVersion: 1,
         title: 'Vectorize image',
-        summary: 'Traces one PNG, JPEG or WebP image into an SVG of filled paths with up to colors flat colours. Best for logos, icons and flat artwork; a photo comes back as a stylised poster. The SVG keeps the image\'s width and height (capped at 4096).',
+        summary: 'Traces one PNG, JPEG or WebP image into an SVG of filled paths with up to colors flat colours. Best for logos, icons and flat artwork; a photo comes back as a stylised poster, and its SVG is larger than the photo (often two to three times a PNG of it at 16 colours; colors sets the size). The SVG keeps the image\'s width and height (capped at 4096).',
         input: 'image',
         options: {
-            colors: { type: 'integer', minimum: 2, maximum: 32, default: 16, description: 'How many flat colours to trace with. 2 is black and white.' },
+            colors: { type: 'integer', minimum: 2, maximum: 32, default: 16, description: 'How many flat colours to trace with. 2 is black and white. Fewer colours make a much smaller file; on a photo, 8 is about 40% of 16.' },
             detail: { type: 'string', enum: ['smooth', 'balanced', 'detailed'], default: 'balanced', description: 'smooth: fewer, simpler shapes. detailed: closer to the source, larger file.' },
         },
         output: { kind: 'artifact', mime: 'image/svg+xml' },
         execution: 'sync',
     },
+    {
+        tool: 'clean_svg',
+        id: 'svg-cleanup',
+        version: 1,
+        inputVersion: 1,
+        outputVersion: 1,
+        title: 'Clean SVG',
+        summary: 'Cleans and simplifies one SVG and returns it as JSON, with a report (bytes saved, what was removed, warnings). The SVG is rebuilt from an allowlist: scripts, event handlers, animation, links and references outside the file are removed; editor data, unused definitions, hidden and empty elements go; numbers are rounded and path data rewritten short. It looks the same unless simplify is light or strong. The cleaned SVG is result.svg.',
+        input: 'svg',
+        options: {
+            precision: { type: 'integer', minimum: 1, maximum: 6, default: 3, description: 'Decimals kept on coordinates. A drawing under 100 units across keeps one more per factor of ten.' },
+            simplify: { type: 'string', enum: ['none', 'light', 'strong'], default: 'none', description: 'none: looks the same. light or strong: points on straight runs move within 0.05% or 0.2% of the drawing\'s diagonal.' },
+            keep_ids: { type: 'boolean', default: false, description: 'Keep every id and class, for an SVG a page\'s own CSS or script uses.' },
+        },
+        output: { kind: 'json', mime: 'application/json' },
+        execution: 'sync',
+    },
 ];
 
 export function contractId(id, version) {
@@ -194,9 +244,10 @@ export function checkEntry(entry, contract, expected) {
     if (!positive(limits.max_bytes)) {
         reasons.push('no maximum input size is declared');
     }
+    const formats = FORMATS[contract.input];
     if (!Array.isArray(limits.formats) || limits.formats.length === 0
-        || (contract.input === 'image' && limits.formats.some((f) => !IMAGE_FORMATS.includes(f)))) {
-        reasons.push(`input formats are missing${contract.input === 'image' ? ' or not PNG/JPEG/WebP' : ''}`);
+        || (formats && limits.formats.some((f) => !formats.allowed.includes(f)))) {
+        reasons.push(`input formats are missing${formats ? ` or not ${formats.label}` : ''}`);
     }
     if (!legacyCatalog && !positive(limits.max_request_bytes)) {
         reasons.push('no maximum request size is declared');

package/src/ledger.js

@@ -24,11 +24,14 @@ const COUNTS = new Set(['reserved', 'spent', 'uncertain']);
 export class LedgerError extends Error {}
 
 export class Ledger {
-    constructor(dir, { now = () => Date.now() } = {}) {
+    constructor(dir, { now = () => Date.now(), openLock = openSync, platform = process.platform, lockWaitMs = LOCK_WAIT_MS } = {}) {
         this.dir = dir;
         this.file = join(dir, 'spend-ledger.json');
         this.lockFile = join(dir, 'spend-ledger.lock');
         this.now = now;
+        this.openLock = openLock;
+        this.platform = platform;
+        this.lockWaitMs = lockWaitMs;
     }
 
     /** Total that counts against the daily ceiling on this network, in atomic units. */
@@ -132,11 +135,18 @@ export class Ledger {
         const started = Date.now();
         for (;;) {
             try {
-                closeSync(openSync(this.lockFile, 'wx'));
+                closeSync(this.openLock(this.lockFile, 'wx'));
                 break;
             } catch (error) {
-                if (error.code !== 'EEXIST') {
-                    throw new LedgerError(`The spend ledger lock ${this.lockFile} cannot be created (${error.code}).`);
+                // On Windows, opening a lock file that another process is still deleting fails with
+                // EPERM, not EEXIST. Only a successful open takes the lock, so waiting is safe; an
+                // EPERM that outlasts the wait is a real permission problem and refuses like any other.
+                const held = error.code === 'EEXIST';
+                const contended = held || (error.code === 'EPERM' && this.platform === 'win32');
+                if (!contended || Date.now() - started > this.lockWaitMs) {
+                    throw new LedgerError(held
+                        ? `The spend ledger is locked by another process (${this.lockFile}).`
+                        : `The spend ledger lock ${this.lockFile} cannot be created (${error.code}).`);
                 }
                 try {
                     if (Date.now() - statSync(this.lockFile).mtimeMs > LOCK_STALE_MS) {
@@ -144,10 +154,7 @@ export class Ledger {
                         continue;
                     }
                 } catch {
-                    continue;
-                }
-                if (Date.now() - started > LOCK_WAIT_MS) {
-                    throw new LedgerError(`The spend ledger is locked by another process (${this.lockFile}).`);
+                    // Gone already, or it cannot be removed: wait, so the deadline still applies.
                 }
                 await new Promise((resolve) => setTimeout(resolve, 20));
             }

package/src/payment.js

@@ -160,7 +160,9 @@ export class Purchaser {
         const endpoint = endpointFor(apiUrl, service.id);
 
         // 1. Input, options, destination and the caller's price ceiling: all before any request.
-        const image = contract.input === 'url' ? prepareUrl(args, service.entry.input) : prepareImage(args, service.entry.limits);
+        const image = contract.input === 'url' ? prepareUrl(args, service.entry.input)
+            : contract.input === 'svg' ? prepareSvg(args, service.entry)
+                : prepareImage(args, service.entry.limits);
         const options = prepareOptions(args, contract);
         const saveTo = prepareSaveTo(args);
         let maxPrice = null;
@@ -536,6 +538,64 @@ export function prepareImage(args, limits) {
     return { body: { image_base64: bytes.toString('base64') }, identity: `sha256:${sha256(bytes)}` };
 }
 
+/**
+ * Exactly one of svg (the markup), svg_url (https) or svg_path (a local file, sent as svg), within
+ * Bacon's size limit. The file must be UTF-8 and hold an <svg>; Bacon checks the markup fully
+ * (well-formed, no entities, an <svg> root) before it quotes a price.
+ */
+export function prepareSvg(args, entry) {
+    const given = ['svg', 'svg_url', 'svg_path'].filter((name) => typeof args[name] === 'string' && args[name].trim() !== '');
+    if (given.length !== 1) {
+        throw new Refusal('Give exactly one of svg, svg_url or svg_path.');
+    }
+    const { max_bytes: maxBytes } = entry.limits;
+    if (given[0] === 'svg_url') {
+        const raw = args.svg_url.trim();
+        const maxLength = entry.input?.properties?.svg_url?.maxLength ?? 2048;
+        if (raw.length > maxLength) {
+            throw new Refusal(`svg_url is ${raw.length} characters; Bacon takes at most ${maxLength}.`);
+        }
+        let url;
+        try {
+            url = new URL(raw);
+        } catch {
+            throw new Refusal('svg_url is not a URL.');
+        }
+        if (url.protocol !== 'https:') {
+            throw new Refusal('svg_url must be a public https URL.');
+        }
+        return { body: { svg_url: url.href }, identity: `url:${url.href}` };
+    }
+    let markup;
+    if (given[0] === 'svg') {
+        markup = args.svg;
+    } else {
+        const path = resolve(args.svg_path.trim());
+        let size;
+        try {
+            size = statSync(path).size;
+        } catch {
+            throw new Refusal(`svg_path ${path} cannot be read.`);
+        }
+        if (size > maxBytes) {
+            throw new Refusal(`svg_path is ${size} bytes; Bacon takes at most ${maxBytes}.`);
+        }
+        try {
+            markup = new TextDecoder('utf-8', { fatal: true }).decode(readFileSync(path));
+        } catch {
+            throw new Refusal('svg_path must be a UTF-8 text file.');
+        }
+    }
+    const bytes = Buffer.byteLength(markup);
+    if (bytes > maxBytes) {
+        throw new Refusal(`The SVG is ${bytes} bytes; Bacon takes at most ${maxBytes}.`);
+    }
+    if (!markup.includes('<svg')) {
+        throw new Refusal(`${given[0]} does not hold an <svg> element.`);
+    }
+    return { body: { svg: markup }, identity: `sha256:${sha256(markup)}` };
+}
+
 /**
  * One public web page for a URL capability: http(s), no user:pass@, ports 80/443 only, within
  * the catalog's maxLength. Bacon checks it again (and that it is public) before quoting.

package/src/server.js

@@ -11,10 +11,10 @@ import { CONTRACTS } from './contracts.js';
 import { loadConfig } from './config.js';
 import { Ledger } from './ledger.js';
 import { formatUsdc } from './money.js';
-import { Purchaser, Refusal } from './payment.js';
+import { HARD_MAX_RESULT_BYTES, Purchaser, Refusal } from './payment.js';
 import { balanceReader, loadWallet, redact } from './wallet.js';
 
-export const VERSION = '0.2.0';
+export const VERSION = '0.4.0';
 const CATALOG_TTL_MS = 5 * 60 * 1000;
 
 const FREE_TOOLS = [
@@ -133,14 +133,24 @@ export function createBaconServer({ env = process.env, fetch = globalThis.fetch,
         const network = config.network;
         const options = Object.fromEntries(Object.entries(contract.options).map(([name, spec]) => [name, { ...spec }]));
         const price = `Costs ${service.price.usdc} USDC per call${network.testnet ? ' (test USDC)' : ' (real money)'} on ${network.label}, paid from the buyer's wallet over x402 after the buyer's spending limits are checked.`;
+        // A service may declare a larger JSON result than this package shows: say so before anyone pays.
+        const unshown = limits.max_response_bytes > HARD_MAX_RESULT_BYTES
+            ? ` A result over ${HARD_MAX_RESULT_BYTES / 1024} KB is not shown; pass save_to to keep it.` : '';
         const output = contract.output.kind === 'json'
-            ? 'Output: JSON, returned in the tool result.'
+            ? `Output: JSON, returned in the tool result.${unshown}`
             : `Output: ${contract.output.mime}, as a download link (and a file with save_to).`;
         let input;
         let source;
         if (contract.input === 'url') {
             input = 'Give url: one public web page (http or https, standard ports).';
             source = { url: { type: 'string', description: 'A public web page, usually the homepage.', maxLength: service.entry.input.properties.url.maxLength ?? 2048 } };
+        } else if (contract.input === 'svg') {
+            input = `Input: one SVG, up to ${Math.floor(limits.max_bytes / 1048576)} MB. Give exactly one of svg, svg_url or svg_path.`;
+            source = {
+                svg: { type: 'string', description: 'The SVG markup itself.' },
+                svg_url: { type: 'string', description: 'A public https URL of an SVG file.', maxLength: service.entry.input.properties.svg_url.maxLength ?? 2048 },
+                svg_path: { type: 'string', description: 'A local SVG file to send (read by this server as UTF-8 text).' },
+            };
         } else {
             const formats = limits.formats.map((f) => f.replace('image/', '').toUpperCase()).join(', ');
             input = `Input: ${formats}, up to ${Math.floor(limits.max_bytes / 1048576)} MB${limits.max_dimension ? `, at most ${limits.max_dimension} px` : ''}. Give exactly one of image_url or image_path.`;