chain-insights 0.19.0 → 0.22.3

package/README.md

@@ -7,9 +7,12 @@
 
 [Website](https://chain-insights.ai) | [npm](https://www.npmjs.com/package/chain-insights)
 
-Chain Insights is an open-source AML investigation toolkit for AI agents and
-analysts. It screens blockchain addresses, explores fund flows through graph
-queries, manages local evidence workspaces, and generates graph reports.
+Chain Insights is open-source AML and forensics infrastructure for AI agents
+and analysts: a hosted Chain Insights Graph you reach over MCP, screened
+through one CLI. It screens blockchain addresses for risk, explores fund flows
+through read-only graph queries, and renders graph reports from your own
+investigation folders. Every new account gets a free tier — a daily allowance
+of graph queries, no payment setup — so you can run a first screen in minutes.
 
 ## Quickstart
 
@@ -19,7 +22,8 @@ as-is on macOS; on Windows use WSL.
 ```bash
 npx chain-insights@latest --help   # run without installing
 npm install -g chain-insights      # or install the cia CLI globally
-cia init ~/cases                   # scaffold an investigation workspace
+cia init ~/cases                   # optional local investigation folder
+cia mcp call aml_address_risk network=robinhood address=0xYourAddressHere
 cia networks                       # supported networks + public tool surface
 ```
 
@@ -46,11 +50,8 @@ Owns:
   / `wallet_*` tools.
 - Local wallet and payment on Base mainnet (payment chain only).
 - Investigation workspaces, graph reports, and visualization.
-- `cia monitor`: per-case tracking with rendered dossiers on an external
-  schedule.
 - Shipped product skills under `skills/` (`chain-insights-*`), packaged
   into the npm tarball.
-- The local Bittensor graph devkit under `devkit/`.
 
 Never touches:
 
@@ -64,65 +65,30 @@ Never touches:
 
 ### What You Can Do Today
 
-| Tool | Use it for |
-| --- | --- |
-| `aml_address_risk` | Screen one address for risk, behavior, neighborhood context, and exchange exposure |
-| `graph_query` | Run one read-only GQL/Cypher query against a Chain Insights Graph layer |
-| `graph_query_batch` | Run related read-only graph queries as one MCP call |
-| `meta_network_capabilities` | Check supported Chain Insights networks and graph tools |
-| `meta_usage_status` | Check the caller's daily free-tier graph query allowance |
-| `meta_help` | Show Chain Insights tool and workflow guidance |
-| `wallet_balance` | Show the local payment wallet amount |
-
-### Continuous Monitoring
-
-`cia monitor` re-renders each open case's dossier on a schedule. It turns one
-investigation into a standing view: seeds, scope changes, and render state
-stay as plain files in the workspace.
-
-| Command | What it does |
-| --- | --- |
-| `cia monitor run` | One pass: render the dossier of every open case |
-| `cia monitor status` | Open cases and the last run |
-| `cia monitor render` | Re-render all open cases (or one case) from the case document |
-| `cia monitor init victim` | Bootstrap a stolen-funds case-tracking config in one command |
-| `cia monitor case add` | Register a monitor case with one or more seed addresses |
-| `cia monitor case list` | List monitor cases (open by default, `--all` for closed) |
-| `cia monitor case add-seed` | Widen an open case's seed set, timestamped |
-| `cia monitor case remove-seed` | Narrow an open case's seed set |
-| `cia monitor case close` | Close a case; passes skip it |
-
-Three things to know before scheduling it:
-
-- **`cia monitor run` is a one-shot.** One pass, then exit. Schedule it with
-  cron, pm2 (`cron_restart` plus `autorestart: false`), or your agent
-  harness's scheduled tasks.
-- **Exit `2` means an isolated case failed** while every other case
-  completed. Partial success, not a crash. Only exit `1` means nothing ran.
-- **An unchanged case is skipped, not re-rendered.** The run document
-  records `skipped_reason: 'unchanged'`, so a quiet watch reads as healthy
-  by design.
-
-See [Continuous monitoring](docs/monitoring.md) for the full surface.
+| Tool                        | Use it for                                                                         |
+| --------------------------- | ---------------------------------------------------------------------------------- |
+| `aml_address_risk`          | Screen one address for risk, behavior, neighborhood context, and exchange exposure |
+| `graph_query`               | Run one read-only GQL/Cypher query against a Chain Insights Graph layer            |
+| `graph_query_batch`         | Run related read-only graph queries as one MCP call                                |
+| `meta_network_capabilities` | Check supported Chain Insights networks and graph tools                            |
+| `meta_usage_status`         | Check the caller's daily free-tier graph query allowance                           |
+| `meta_help`                 | Show Chain Insights tool and workflow guidance                                     |
+| `wallet_balance`            | Show the local payment wallet amount                                               |
 
 ## Dependencies
 
 Upstream:
 
 - **Chain Insights Graph MCP endpoint** — all graph queries and AML
-  primitives. Configured via `graphMcpEndpoint`; defaults to a local
-  endpoint.
+  primitives. Configured via `graphMcpEndpoint`; defaults to the public
+  production endpoint `https://mcp.chain-insights.ai/`.
 - **Base mainnet RPC** — wallet balance and payment only
   (`BASE_RPC_URL` override). Not a graph-support claim.
-- **Devkit fixture data** — pre-generated from the upstream export path
-  and committed under `devkit/data/`.
 
 Downstream:
 
 - Analysts and AI agents install the npm package and call the CLI or the
   MCP tools.
-- Monitor case dossiers render as Markdown under the workspace
-  (`published/cases/<case_id>/`), ready for review and handoff.
 
 ## Architecture
 
@@ -140,16 +106,15 @@ Agent or CLI user
 
 Source modules (hand-maintained):
 
-| Module | Entrypoint | Component doc |
-|---|---|---|
-| `config` | `src/config` | [components/config.md](docs/architecture/components/config.md) |
-| `federation` | `src/federation` | [components/federation.md](docs/architecture/components/federation.md) |
+| Module          | Entrypoint          | Component doc                                                                |
+| --------------- | ------------------- | ---------------------------------------------------------------------------- |
+| `config`        | `src/config`        | [components/config.md](docs/architecture/components/config.md)               |
+| `federation`    | `src/federation`    | [components/federation.md](docs/architecture/components/federation.md)       |
 | `investigation` | `src/investigation` | [components/investigation.md](docs/architecture/components/investigation.md) |
-| `mcp` | `src/mcp` | [components/mcp.md](docs/architecture/components/mcp.md) |
-| `monitor` | `src/monitor` | [components/monitor.md](docs/architecture/components/monitor.md) |
-| `server` | `src/server` | [components/server.md](docs/architecture/components/server.md) |
-| `viz` | `src/viz` | [components/viz.md](docs/architecture/components/viz.md) |
-| `wallet` | `src/wallet` | [components/wallet.md](docs/architecture/components/wallet.md) |
+| `mcp`           | `src/mcp`           | [components/mcp.md](docs/architecture/components/mcp.md)                     |
+| `server`        | `src/server`        | [components/server.md](docs/architecture/components/server.md)               |
+| `viz`           | `src/viz`           | [components/viz.md](docs/architecture/components/viz.md)                     |
+| `wallet`        | `src/wallet`        | [components/wallet.md](docs/architecture/components/wallet.md)               |
 
 Entry points:
 
@@ -166,10 +131,10 @@ and [operating rules](docs/architecture/operating-rules.md).
 
 Graph queries choose the read graph explicitly:
 
-| Graph | Use it for |
-| --- | --- |
+| Graph      | Use it for                                                                                                                                      |
+| ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
 | `topology` | The unified address / FLOWS_TO / LINKED graph — recent and full historical fund-flow traversal, plus the node `risk_score`/`risk_level` verdict |
-| `facts` | Labels, features, assets, and enrichment |
+| `facts`    | Labels, features, assets, and enrichment                                                                                                        |
 
 One rule is worth reading before writing a query by hand: the `network`
 argument selects the graph, not the addresses inside it. The address-space
@@ -221,14 +186,12 @@ Use `usage` to see the real cost of a workflow call, not just of one
 - **Linux** is the reference platform; shell snippets use bash (macOS works
   the same; on Windows use WSL).
 - **Node.js 22 or newer** (`package.json` engines) and npm.
-- Optional: Docker with the Compose plugin, for the local devkit backend.
-- Optional: pm2 or cron, for standing-watch monitoring.
 
 `.env.example` documents the two supported overrides:
 
-| Variable | Purpose |
-| --- | --- |
-| `BASE_RPC_URL` | Base RPC override for wallet balance and the local top-up page |
+| Variable                            | Purpose                                                                                               |
+| ----------------------------------- | ----------------------------------------------------------------------------------------------------- |
+| `BASE_RPC_URL`                      | Base RPC override for wallet balance and the local top-up page                                        |
 | `CHAIN_INSIGHTS_GRAPH_MCP_ENDPOINT` | Chain Insights Graph endpoint override; local HTTP loopback allowed, remote hosts must use `https://` |
 
 ## Run
@@ -287,45 +250,20 @@ cia mcp call graph_query_batch \
 More query examples (manual fund-flow reads, pagination):
 [Graph tools](docs/graph-tools.md).
 
-### Dev Compose (local devkit backend)
-
-The devkit runs a deterministic local Bittensor Chain Insights Graph
-backend. Compose file: `devkit/docker-compose.yml` (default compose
-project network). Services: `starrocks`, `memgraph`,
-`starrocks-import`, `memgraph-import` (one-shot), and
-`chain-insights-graph-devkit`. Images build locally with
-`docker compose build` — never pulled from a registry.
-
-Start from a clean state:
-
-```bash
-docker compose -f devkit/docker-compose.yml down -v --remove-orphans
-docker compose -f devkit/docker-compose.yml up -d --build
-```
-
-One-shot import services must exit 0. `starrocks`, `memgraph`, and
-`chain-insights-graph-devkit` must stay running. The MCP endpoint is
-`http://127.0.0.1:18012/mcp`, unmetered:
-
-```bash
-export CHAIN_INSIGHTS_GRAPH_MCP_ENDPOINT=http://127.0.0.1:18012/mcp
-```
-
-Full contract and procedures live in the devkit directory's own README.
-
 ## Configure
 
 `cia` uses `graphMcpEndpoint` for all Chain Insights Graph calls. The npm
-package does not hardcode a hosted endpoint.
+package uses the public production endpoint by default, so a fresh install can
+run `cia networks` immediately.
 
-Local development endpoint (default):
+For local development, override the default explicitly:
 
 ```bash
 cia config set graphMcpEndpoint http://127.0.0.1:8012/mcp
 ```
 
-Public production Graph (operator configuration, never a package default).
-Use the host root. Do not add `/mcp`.
+The public production Graph is already the default. Use the host root. Do not
+add `/mcp`.
 
 ```bash
 cia config set graphMcpEndpoint https://mcp.chain-insights.ai/
@@ -342,7 +280,7 @@ Configuration precedence:
 1. `CHAIN_INSIGHTS_GRAPH_MCP_ENDPOINT` env var (`GRAPH_MCP_ENDPOINT`
    legacy alias also supported).
 2. `cia config set graphMcpEndpoint ...` saved value.
-3. Local default `http://127.0.0.1:8012/mcp`.
+3. Public production default `https://mcp.chain-insights.ai/`.
 
 Validation rules:
 
@@ -375,14 +313,6 @@ npm test
 npm run release:check   # PR-only step in verify.yml
 ```
 
-Devkit-backed tiers (need the dev compose lane running):
-
-```bash
-npm run devkit:smoke
-npm run devkit:smoke:parity
-npm run test:devkit
-```
-
 CI install step, when reproducing CI:
 
 ```bash
@@ -396,8 +326,6 @@ release:check, tests, npm pack contents), `security.yml`, `scorecard.yml`,
 ## Debug
 
 - Diagnostics and debug workflows: [docs/debugging.md](docs/debugging.md).
-- Skip payment negotiation against the unmetered devkit:
-  `cia debug on --token <any-string> --endpoint http://127.0.0.1:18012/mcp`.
 - MCP proxy structured logs: `~/.chain-insights/runtime/logs/mcp-proxy.jsonl`.
 
 Health checks (each is runnable):
@@ -418,8 +346,6 @@ cia mcp tools --refresh
 # Installed CLI sanity
 cia --version && cia update --check
 
-# Devkit service state (all imports exited 0, backends running)
-docker compose -f devkit/docker-compose.yml ps -a
 ```
 
 If network or tool discovery fails, check the endpoint and access mode
@@ -430,27 +356,25 @@ investigation workflow without a reachable endpoint.
 
 Product docs:
 
-| Doc | Use it for |
-| --- | --- |
-| [Graph tools](docs/graph-tools.md) | Graph layers, `graph_query`, `graph_query_batch`, AML tool contracts, graph reports |
-| [Graph query compatibility](docs/graph-query-compatibility.md) | GQL/Cypher support per layer, rewrite recipes, traversal guidance |
-| [Search limits](docs/search-limits.md) | Tunable search/row/frontier/hop bounds, precedence, ceilings |
-| [Investigation workspaces](docs/investigation-workspaces.md) | `cia init`, workspace layout, artifacts, templates, reports, visualization |
-| [Continuous monitoring](docs/monitoring.md) | `cia monitor` commands, case tracking, dossier rendering, scheduling, exit codes |
-| [MCP proxy](docs/mcp-proxy.md) | Stdio proxy behavior, endpoint configuration, agent installers, auth modes |
-| [Architecture overview](docs/architecture.md) | Product layers, data flow, local storage, security model, config keys |
-| [Development](docs/development.md) | Build, test, and local install commands |
-| [Contributing](docs/contributing.md) | Development workflow, pull requests, release expectations |
-| [Stability policy](docs/stability.md) | Guaranteed surfaces (exit codes, MCP tool names, workspace layout), deprecation rules |
-| [Debugging](docs/debugging.md) | Local troubleshooting, diagnostics, debug workflows |
-| Bittensor devkit (in this repo under `devkit/`) | Local Bittensor graph backend contract, fixture, smoke procedures |
+| Doc                                                            | Use it for                                                                            |
+| -------------------------------------------------------------- | ------------------------------------------------------------------------------------- |
+| [Graph tools](docs/graph-tools.md)                             | Graph layers, `graph_query`, `graph_query_batch`, AML tool contracts, graph reports   |
+| [Graph query compatibility](docs/graph-query-compatibility.md) | GQL/Cypher support per layer, rewrite recipes, traversal guidance                     |
+| [Search limits](docs/search-limits.md)                         | Tunable search/row/frontier/hop bounds, precedence, ceilings                          |
+| [Investigation workspaces](docs/investigation-workspaces.md)   | `cia init`, workspace layout, artifacts, templates, reports, visualization            |
+| [MCP proxy](docs/mcp-proxy.md)                                 | Stdio proxy behavior, endpoint configuration, agent installers, auth modes            |
+| [Architecture overview](docs/architecture.md)                  | Product layers, data flow, local storage, security model, config keys                 |
+| [Development](docs/development.md)                             | Build, test, and local install commands                                               |
+| [Contributing](docs/contributing.md)                           | Development workflow, pull requests, release expectations                             |
+| [Stability policy](docs/stability.md)                          | Guaranteed surfaces (exit codes, MCP tool names, workspace layout), deprecation rules |
+| [Debugging](docs/debugging.md)                                 | Local troubleshooting, diagnostics, debug workflows                                   |
 
 Architecture depth:
 
 - [docs/architecture/](docs/architecture/ARCHITECTURE.md) — index, C4
   diagrams, context, containers, components.
 - [Data contracts](docs/architecture/data-contracts.md) — tool surface,
-  search limits, endpoint rules, shared-graph model, devkit contract.
+  search limits, endpoint rules, shared-graph model.
 - [Operating rules](docs/architecture/operating-rules.md) — repo
   invariants, findings rules, CI gotchas.
 - [docs/acceptance/](docs/acceptance/) — per-component acceptance evidence.

package/bin/cli.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-'use strict';
+'use strict'
 
 // CJS shim: bridges the npm bin entry to the ESM dist built by tsdown.
 // Dynamic import() is the correct bridge pattern from CommonJS to ESM.
 import('../dist/cli.mjs').catch((err) => {
-  console.error('Failed to load chain-insights:', err.message);
-  process.exit(1);
-});
+  console.error('Failed to load chain-insights:', err.message)
+  process.exit(1)
+})