bsv-mcp 0.2.15 → 0.3.0

package/CHANGELOG.md

@@ -1,5 +1,78 @@
 # BSV MCP Server Changelog
 
+## [0.3.0] - 2026-07-30
+
+### Breaking Changes
+
+- **Spending now requires approval.** `WalletPermissionsManager` was constructed
+  with `seekSpendingPermissions: false`, so no spend was ever gated. It is armed,
+  and a handler is bound to `onSpendingAuthorizationRequested`. Clients that
+  support elicitation prompt the user with the exact satoshi amount and itemised
+  line items; approval grants that amount ephemerally. **On a client without
+  elicitation support, spends are denied.** The refusal names the amount and the
+  reason. This is deliberate — a confirmation gate that silently passes when the
+  client cannot be asked is not a gate.
+- `wallet_setupDroplit` is replaced by three tools —
+  `wallet_registerDroplitKey`, `wallet_createDroplitFaucet`, and
+  `wallet_checkDroplitFaucetStatus`. It had put three unrelated operations behind
+  an `action` enum, which made every argument conditional.
+- `wallet_purchaseListing` no longer accepts `description`. The underlying
+  purchase actions have no parameter for it, so it was advertised and discarded.
+
+### Security
+
+- **`DISABLE_BROADCASTING` did nothing for the tools that move money.** The
+  startup banner printed `Broadcasting: Disabled` while the flag reached only the
+  BAP tools; `wallet_sendBsv`, `sendAllBsv`, the three sweeps, `purchaseListing`
+  and `sendMnee` never received it. Setting the variable, reading "Disabled", and
+  calling `wallet_sendBsv` moved real money. Sixteen transaction-submitting tools
+  now assert through one guard that reads the same environment variable the
+  banner reads.
+- **WIF redaction covered one of three exit paths.** The sweep tools each defined
+  a sanitizer commented "sanitize WIF from any error output" and applied it only
+  in the `catch`. The `result.error` branch and the serialised success payload
+  both returned raw, on tools that take a raw WIF as an argument. One shared
+  redactor now covers all three exits in all three tools, and additionally
+  catches testnet WIFs and xprvs.
+- The admin originator was the package name, `bsv-mcp` — the exact string a
+  caller reaches for when a parameter named `originator` wants a value. Passing
+  it would have bypassed the spending gate while the configuration reported it
+  armed.
+- Two identity-key paths caught an invalid WIF, logged a warning, and continued
+  unsigned. Both now fail.
+
+### Added
+
+- Audit log at `~/.bsv-mcp/audit.log` (JSON Lines, directory `0700`, file
+  `0600`), routed through the key redactor. A failed write reports to stderr and
+  does not break a payment the user already approved.
+- Amount validation on the money-moving tools. `sendBsv`, `sendMnee`, `lockBsv`
+  and `listOrdinal` took a bare `z.number()`, so negative, zero and NaN amounts
+  reached the SDK; a negative USD amount converted to a negative satoshi count.
+
+### Fixed
+
+- `wallet_createOrdinals` accepted `destinationAddress` and never forwarded it,
+  so an ordinal minted to a named address silently locked to a wallet-derived
+  self key.
+- Droplit authentication was hand-rolled and could never have succeeded. It is
+  now BRC-103/104 via `AuthFetch`, verified against the live service.
+- Five packages the code imports were never declared, `zod` among them, so a
+  clean install of the published package could not resolve them.
+- The stdio guard was dead code. Its replacement is a first-position side-effect
+  import, since ES imports evaluate before any top-level statement.
+- `purchaseListing`'s marketplace-rate arithmetic is a pure function, so a fee
+  bug can be told apart from an execution bug.
+
+### Changed
+
+- Core SDKs to current: `@modelcontextprotocol/sdk` 1.27.1 → 1.29.0,
+  `@modelcontextprotocol/ext-apps` 1.2.0 → 1.7.5, `@1sat/actions` 0.0.41 →
+  0.0.192, `@bsv/sdk` 2.0.6 → 2.2.0, `bsv-bap` 0.1.23 → 0.3.4.
+- `Droplet` is spelled `Droplit` throughout, matching droplit.dev. Environment
+  variables are now `DROPLIT_API_URL` and `DROPLIT_FAUCET_NAME`.
+- Test coverage 15 → 45.
+
 ## [0.2.15] - 2026-03-10
 
 ### Fixed
@@ -129,29 +202,29 @@
 - Improved error handling with standardized error types
 - Better code organization with new utility modules
 
-## v0.1.0 - Droplet API Integration & Claude Code CLI Support
+## v0.1.0 - Droplit API Integration & Claude Code CLI Support
 
 ### Major Features
-- **Droplet API Integration**: Added support for running without local keys using Droplet faucet API
+- **Droplit API Integration**: Added support for running without local keys using Droplit faucet API
   - New `IntegratedWallet` class supports both local and remote wallet modes
-  - BSM (Bitcoin Signed Message) authentication for Droplet API communication
-  - Environment variable configuration: `USE_DROPLET_API`, `DROPLET_API_URL`, `DROPLET_FAUCET_NAME`
-  - Automatic faucet funding and transaction broadcasting through Droplet service
+  - BSM (Bitcoin Signed Message) authentication for Droplit API communication
+  - Environment variable configuration: `USE_DROPLIT_API`, `DROPLIT_API_URL`, `DROPLIT_FAUCET_NAME`
+  - Automatic faucet funding and transaction broadcasting through Droplit service
 - **Claude Code CLI Compatibility**: Fixed stdio transport configuration for seamless Claude Code integration
   - Updated smithery.yaml configuration for proper MCP CLI operation
   - Enhanced testing and debugging workflows with Claude CLI
 
 ### Technical Improvements
-- Created `DropletClient` class for robust API communication with go-faucet-api
-- Added comprehensive error handling and validation for Droplet operations
+- Created `DroplitClient` class for robust API communication with go-faucet-api
+- Added comprehensive error handling and validation for Droplit operations
 - Enhanced documentation with testing instructions and troubleshooting guides
 - Improved dual-mode wallet architecture maintaining backward compatibility
 - Updated development documentation with detailed testing workflows
 
 ### Environment Variables
-- `USE_DROPLET_API`: Enable Droplet API mode (default: false)
-- `DROPLET_API_URL`: Droplet service endpoint (default: http://localhost:4000)
-- `DROPLET_FAUCET_NAME`: Faucet name for API operations (required in Droplet mode)
+- `USE_DROPLIT_API`: Enable Droplit API mode (default: false)
+- `DROPLIT_API_URL`: Droplit service endpoint (default: http://localhost:4000)
+- `DROPLIT_FAUCET_NAME`: Faucet name for API operations (required in Droplit mode)
 - `TRANSPORT`: MCP transport mode (stdio/http) for Claude Code compatibility
 
 ## v0.0.37 - Resource Updates

package/README.md

@@ -576,34 +576,34 @@ The BSV MCP server can be customized using environment variables to enable or di
 | `IDENTITY_KEY_WIF`    | `not set` | Optional WIF for identity key; if set, ordinals inscriptions will be signed with sigma-protocol for authentication, curation, and web-of-trust. |
 | `DISABLE_BROADCASTING` | `false` | Set to `true` to disable transaction broadcasting; returns raw transaction hex instead - useful for testing and transaction review before broadcasting |
 
-### Droplet API Configuration
+### Droplit API Configuration
 
-The BSV MCP server supports running in Droplet API mode, which allows operation without local private keys by using a remote faucet service:
+The BSV MCP server supports running in Droplit API mode, which allows operation without local private keys by using a remote faucet service:
 
 | Environment Variable | Default | Description |
 | -------------------- | ------- | ----------- |
-| `USE_DROPLET_API` | `false` | Set to `true` to enable Droplet API mode for remote wallet operations |
-| `DROPLET_API_URL` | `http://localhost:4000` | Base URL for the Droplet faucet API service |
-| `DROPLET_FAUCET_NAME` | `not set` | Name of the faucet to use (required when `USE_DROPLET_API` is true) |
+| `USE_DROPLIT_API` | `false` | Set to `true` to enable Droplit API mode for remote wallet operations |
+| `DROPLIT_API_URL` | `http://localhost:4000` | Base URL for the Droplit faucet API service |
+| `DROPLIT_FAUCET_NAME` | `not set` | Name of the faucet to use (required when `USE_DROPLIT_API` is true) |
 | `TRANSPORT` | `stdio` | MCP transport mode (stdio/http) - automatically set to stdio for Claude Code compatibility |
 
-#### Droplet API Mode
+#### Droplit API Mode
 
-When `USE_DROPLET_API=true` is set, the server operates in remote mode:
+When `USE_DROPLIT_API=true` is set, the server operates in remote mode:
 
 - **No Local Keys Required**: The server doesn't need `PRIVATE_KEY_WIF` or local key files
-- **Remote Wallet Operations**: Transactions are funded and broadcast through the Droplet API
+- **Remote Wallet Operations**: Transactions are funded and broadcast through the Droplit API
 - **BSM Authentication**: Uses Bitcoin Signed Message (BSM) authentication for secure API communication
 - **Automatic Funding**: The faucet automatically provides UTXOs for transactions
 - **Seamless Integration**: All existing wallet tools work transparently with the remote service
 
-#### Example Droplet Configuration
+#### Example Droplit Configuration
 
 ```bash
-# Enable Droplet API mode
-USE_DROPLET_API=true
-DROPLET_API_URL=https://your-droplet-service.com
-DROPLET_FAUCET_NAME=your-faucet-name
+# Enable Droplit API mode
+USE_DROPLIT_API=true
+DROPLIT_API_URL=https://your-droplit-service.com
+DROPLIT_FAUCET_NAME=your-faucet-name
 TRANSPORT=stdio
 ```