chainhint-mcp 1.0.0 → 1.0.1

package/README.md

@@ -6,14 +6,14 @@ Crypto risk intelligence for Claude Desktop, Cursor, and any MCP-compatible AI.
 
 | Tool | Description |
 |------|-------------|
-| `check_wallet_risk` | Risk score, entity label, sanctions check for any wallet |
-| `lookup_address` | Full address details — entity, category, tx history |
-| `get_trace_status` | Fund trace status for hack incidents — where did the money go? |
+| `check_wallet_risk` | Fast risk score, entity, labels, sanctions hit (54M+ labeled addresses). **Needs API key** |
+| `lookup_address` | Deep address report — entity, risk factors, GoPlus flags, counterparty exposure, balance. No key needed |
+| `get_trace_status` | Fund-trace summary for a public hack incident — hops, endpoints by type (exchange/mixer/bridge/defi), exposure. No key needed |
 
 ## Requirements
 
 - Node.js 18+
-- ChainHint Agency plan API key (`ch_live_...`) from [chainhint.com/settings](https://chainhint.com/settings)
+- Optional: ChainHint Agency plan API key (`ch_live_...`) from [chainhint.com/settings](https://chainhint.com/settings) — only `check_wallet_risk` needs it
 
 ## Install
 
@@ -75,9 +75,9 @@ npm run dev
 
 | Variable | Required | Description |
 |----------|----------|-------------|
-| `CHAINHINT_API_KEY` | ✅ | API key from chainhint.com (Agency plan) |
+| `CHAINHINT_API_KEY` | — | API key from chainhint.com (Agency plan). Required only for `check_wallet_risk` |
 | `CHAINHINT_API_URL` | — | Override API base URL (default: production) |
-| `CHAINHINT_SUPABASE_ANON_KEY` | — | For get_trace_status (public incidents) |
+| `CHAINHINT_SUPABASE_ANON_KEY` | — | Override anon key for get_trace_status (public incidents) |
 
 ## Example prompts
 

package/dist/index.d.ts

@@ -6,10 +6,11 @@
  * and any MCP-compatible AI client.
  *
  * Tools:
- *   - check_wallet_risk   → wallet-reputation API (risk score, labels, sanctions)
- *   - lookup_address      → address-lookup API (entity, category, transaction history)
- *   - get_trace_status    → incident fund trace status (flow graph summary)
+ *   - check_wallet_risk   → wallet-reputation API (risk score, labels, sanctions) — needs API key
+ *   - lookup_address      → address-lookup API (entity, risk factors, exposure, balance) — public
+ *   - get_trace_status    → public incident fund-trace summary (endpoints, hops, exposure) — public
  *
- * Auth: set CHAINHINT_API_KEY env var (Agency plan API key: ch_live_...)
+ * Auth: CHAINHINT_API_KEY env var (Agency plan API key: ch_live_...) is only
+ * required for check_wallet_risk. The other two tools hit public endpoints.
  */
 export {};

package/dist/index.js

@@ -6,11 +6,12 @@
  * and any MCP-compatible AI client.
  *
  * Tools:
- *   - check_wallet_risk   → wallet-reputation API (risk score, labels, sanctions)
- *   - lookup_address      → address-lookup API (entity, category, transaction history)
- *   - get_trace_status    → incident fund trace status (flow graph summary)
+ *   - check_wallet_risk   → wallet-reputation API (risk score, labels, sanctions) — needs API key
+ *   - lookup_address      → address-lookup API (entity, risk factors, exposure, balance) — public
+ *   - get_trace_status    → public incident fund-trace summary (endpoints, hops, exposure) — public
  *
- * Auth: set CHAINHINT_API_KEY env var (Agency plan API key: ch_live_...)
+ * Auth: CHAINHINT_API_KEY env var (Agency plan API key: ch_live_...) is only
+ * required for check_wallet_risk. The other two tools hit public endpoints.
  */
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -20,26 +21,26 @@ const API_KEY = process.env.CHAINHINT_API_KEY;
 const BASE_URL = process.env.CHAINHINT_API_URL ?? "https://kjiwfwymnuzxriokhcjk.supabase.co/functions/v1";
 const SUPABASE_URL = process.env.CHAINHINT_SUPABASE_URL ?? "https://kjiwfwymnuzxriokhcjk.supabase.co";
 const SUPABASE_ANON_KEY = process.env.CHAINHINT_SUPABASE_ANON_KEY ?? "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImtqaXdmd3ltbnV6eHJpb2toY2prIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzI3MzkxODgsImV4cCI6MjA4ODMxNTE4OH0.VqzzF_jI8zF072cbjWEDbYo3PnMDlIPy621iWkXEqyo";
+const NO_KEY_MESSAGE = "check_wallet_risk requires CHAINHINT_API_KEY (Agency plan, ch_live_...). " +
+    "Get one at chainhint.com → Settings → API Keys, or use lookup_address which needs no key.";
 if (!API_KEY) {
-    console.error("[chainhint-mcp] ERROR: CHAINHINT_API_KEY is not set.");
-    console.error("  Get your API key from chainhint.com → Settings → API Keys (Agency plan required)");
-    process.exit(1);
+    console.error("[chainhint-mcp] WARN: CHAINHINT_API_KEY is not set — check_wallet_risk will be unavailable.");
+    console.error("  lookup_address and get_trace_status work without a key.");
 }
 // ── HTTP helpers ──────────────────────────────────────────────────────────────
-async function apiGet(path, params = {}) {
+async function apiGet(path, params, opts) {
     const url = new URL(`${BASE_URL}${path}`);
     for (const [k, v] of Object.entries(params)) {
         if (v)
             url.searchParams.set(k, v);
     }
-    const res = await fetch(url.toString(), {
-        headers: {
-            "X-Api-Key": API_KEY,
-            "Authorization": `Bearer ${API_KEY}`,
-            "Content-Type": "application/json",
-        },
-    });
-    const body = await res.json().catch(() => ({ error: `HTTP ${res.status}` }));
+    const headers = { "Content-Type": "application/json" };
+    if (opts.auth && API_KEY) {
+        headers["X-Api-Key"] = API_KEY;
+        headers["Authorization"] = `Bearer ${API_KEY}`;
+    }
+    const res = await fetch(url.toString(), { headers });
+    const body = (await res.json().catch(() => ({ error: `HTTP ${res.status}` })));
     if (!res.ok) {
         throw new Error(body?.error ?? `HTTP ${res.status}: ${url.toString()}`);
     }
@@ -54,7 +55,6 @@ async function supabaseGet(table, params) {
         headers: {
             "apikey": SUPABASE_ANON_KEY,
             "Authorization": `Bearer ${SUPABASE_ANON_KEY}`,
-            "X-Api-Key": API_KEY,
             "Accept": "application/json",
         },
     });
@@ -79,55 +79,78 @@ function formatRiskLevel(score) {
 function truncateAddr(addr) {
     return addr.length > 12 ? `${addr.slice(0, 8)}...${addr.slice(-6)}` : addr;
 }
+function usd(n) {
+    if (n == null || !Number.isFinite(n))
+        return "Unknown";
+    if (Math.abs(n) >= 1_000_000)
+        return `$${(n / 1_000_000).toFixed(2)}M`;
+    if (Math.abs(n) >= 1_000)
+        return `$${(n / 1_000).toFixed(1)}K`;
+    return `$${n.toFixed(2)}`;
+}
+// EVM addresses are case-insensitive and stored lowercase; base58 chains
+// (BTC/TRON/SOL/TON) are case-sensitive — never lowercase those.
+function normalizeAddr(addr) {
+    const a = addr.trim();
+    return a.startsWith("0x") ? a.toLowerCase() : a;
+}
+function formatExposure(label, buckets) {
+    if (!buckets?.length)
+        return [];
+    const sorted = [...buckets].sort((a, b) => (b.usd ?? 0) - (a.usd ?? 0)).slice(0, 5);
+    return [
+        `**${label}:**`,
+        ...sorted.map((b) => {
+            const who = b.top_entities?.length ? ` — ${b.top_entities.slice(0, 3).join(", ")}` : "";
+            return `- ${b.category}: ${usd(b.usd)} (${b.pct}%, ${b.counterparties} counterpart${b.counterparties === 1 ? "y" : "ies"})${who}`;
+        }),
+    ];
+}
 // ── MCP Server ────────────────────────────────────────────────────────────────
 const server = new McpServer({
     name: "chainhint",
-    version: "1.0.0",
+    version: "1.0.1",
 });
 // ── Tool 1: check_wallet_risk ─────────────────────────────────────────────────
-server.tool("check_wallet_risk", "Check the risk score and labels for a crypto wallet address. Returns risk level (CLEAN/LOW/MEDIUM/HIGH/CRITICAL), entity label, category, sanctions status, and transaction statistics. Use this to assess whether a wallet is associated with hacks, scams, mixers, or sanctioned entities.", {
+server.tool("check_wallet_risk", "Fast risk check for a crypto wallet address against ChainHint's 54M+ labeled address database (12 chains). Returns risk score 0-100, risk level (clean/low/medium/high/critical/sanctioned), entity name and category, labels, and sanctions hit. Requires CHAINHINT_API_KEY (Agency plan). For a keyless, deeper look (risk factors, exposure, balance) use lookup_address.", {
     address: z.string().describe("Wallet address to check (EVM 0x..., Bitcoin, or Solana)"),
     chain: z.string().optional().describe("Blockchain: ethereum, bsc, polygon, arbitrum, optimism, base, avalanche, solana, bitcoin (default: auto-detect from address format)"),
 }, async ({ address, chain }) => {
+    if (!API_KEY) {
+        return { content: [{ type: "text", text: NO_KEY_MESSAGE }] };
+    }
     try {
         const params = { address };
         if (chain)
             params.chain = chain;
-        const data = await apiGet("/wallet-reputation", params);
-        if (!data.success || !data.data) {
-            return { content: [{ type: "text", text: `Error: ${data.error ?? "Unknown error"}` }] };
-        }
-        const d = data.data;
-        const risk = d.risk;
-        const entity = d.entity;
-        const sanctions = d.sanctions;
-        const stats = d.stats;
+        // wallet-reputation returns a flat object (no {success,data} wrapper).
+        const d = await apiGet("/wallet-reputation", params, { auth: true });
         const lines = [
             `## Wallet Risk Report: ${truncateAddr(d.address)}`,
+            `**Address:** ${d.address}`,
             `**Chain:** ${d.chain}`,
-            `**Risk Score:** ${risk?.score ?? "N/A"}/100 — **${risk?.level ?? formatRiskLevel(risk?.score ?? 0)}**`,
+            `**Risk Score:** ${d.risk_score}/100 — **${(d.risk_level ?? formatRiskLevel(d.risk_score)).toUpperCase()}**`,
         ];
-        if (entity?.name) {
-            lines.push(`**Entity:** ${entity.name} (${entity.category})`);
-            if (entity.label)
-                lines.push(`**Label:** ${entity.label}`);
+        if (d.sanctions?.hit) {
+            lines.push(`⛔ **SANCTIONED / OFAC-linked**`);
         }
-        else {
-            lines.push(`**Entity:** Unknown / unlabeled`);
+        if (d.entity?.name) {
+            const sub = d.entity.subcategory ? ` / ${d.entity.subcategory}` : "";
+            const ver = d.entity.verified ? ", verified" : "";
+            lines.push(`**Entity:** ${d.entity.name} (${d.entity.category}${sub}${ver})`);
         }
-        if (sanctions?.is_sanctioned) {
-            lines.push(`⛔ **SANCTIONED** — Programs: ${sanctions.programs.join(", ")}`);
-        }
-        if (risk?.flags?.length) {
-            lines.push(`**Risk Flags:** ${risk.flags.join(", ")}`);
+        else if (d.category) {
+            lines.push(`**Category:** ${d.category}`);
         }
-        if (stats) {
-            lines.push(`**Transactions:** ${stats.tx_count?.toLocaleString() ?? "N/A"}`);
-            if (stats.first_seen)
-                lines.push(`**First seen:** ${stats.first_seen.slice(0, 10)}`);
-            if (stats.last_seen)
-                lines.push(`**Last seen:** ${stats.last_seen.slice(0, 10)}`);
+        else {
+            lines.push(`**Entity:** Unknown / unlabeled`);
         }
+        if (d.labels?.length)
+            lines.push(`**Labels:** ${[...new Set(d.labels)].join(", ")}`);
+        if (d.is_contract != null)
+            lines.push(`**Type:** ${d.is_contract ? "Smart Contract" : "EOA (wallet)"}`);
+        lines.push(`**In ChainHint DB:** ${d.found_in_db ? "yes" : "no"}${d.sources?.length ? ` (sources: ${d.sources.join(", ")})` : ""}`);
+        lines.push(`**Checked at:** ${d.checked_at}`);
         lines.push(`\n*Powered by ChainHint — chainhint.com*`);
         return { content: [{ type: "text", text: lines.join("\n") }] };
     }
@@ -136,57 +159,79 @@ server.tool("check_wallet_risk", "Check the risk score and labels for a crypto w
     }
 });
 // ── Tool 2: lookup_address ────────────────────────────────────────────────────
-server.tool("lookup_address", "Look up detailed information about a blockchain address including entity label, risk assessment, transaction history, and known associations. More detailed than check_wallet_risk — includes transaction counts, token holdings summary, and entity metadata.", {
+server.tool("lookup_address", "Detailed lookup of a blockchain address: entity attribution, risk score with the factors behind it, sanctions and GoPlus security flags, counterparty exposure (where funds came from / went to, by category with named entities), balance, token count and transaction count. Works without an API key. Supports EVM chains, Bitcoin, Solana, TRON, TON.", {
     address: z.string().describe("Blockchain address to look up"),
-    chain: z.string().optional().describe("Blockchain (ethereum, bsc, polygon, arbitrum, optimism, base, avalanche, solana, bitcoin)"),
+    chain: z.string().optional().describe("Blockchain (ethereum, bsc, polygon, arbitrum, optimism, base, avalanche, solana, bitcoin, tron, ton)"),
 }, async ({ address, chain }) => {
     try {
         const params = { address };
         if (chain)
             params.chain = chain;
-        const data = await apiGet("/address-lookup", params);
+        const data = await apiGet("/address-lookup", params, { auth: false });
         if (!data.success || !data.data) {
             return { content: [{ type: "text", text: `Error: ${data.error ?? "Unknown error"}` }] };
         }
         const d = data.data;
         const lines = [
             `## Address Lookup: ${truncateAddr(d.address)}`,
+            `**Address:** ${d.address}`,
             `**Chain:** ${d.chain}`,
             `**Type:** ${d.is_contract ? "Smart Contract" : "EOA (wallet)"}`,
         ];
-        if (d.entity)
-            lines.push(`**Entity:** ${d.entity}`);
-        if (d.label)
-            lines.push(`**Label:** ${d.label}`);
-        if (d.category)
-            lines.push(`**Category:** ${d.category}`);
-        if (d.balance)
-            lines.push(`**Balance:** ${d.balance}`);
-        const score = d.risk?.score;
-        if (score !== undefined) {
-            lines.push(`**Risk Score:** ${score}/100 — ${formatRiskLevel(score)}`);
+        if (d.entity?.name) {
+            const sub = d.entity.subcategory ? ` / ${d.entity.subcategory}` : "";
+            const conf = d.entity.confidence != null ? `, confidence ${Math.round(d.entity.confidence * 100)}%` : "";
+            lines.push(`**Entity:** ${d.entity.name} (${d.entity.category}${sub}${conf})`);
+        }
+        else {
+            lines.push(`**Entity:** Unknown / unlabeled`);
         }
-        if (d.risk?.flags?.length) {
-            lines.push(`**Flags:** ${d.risk.flags.join(", ")}`);
+        if (d.labels?.length)
+            lines.push(`**Labels:** ${[...new Set(d.labels)].join(", ")}`);
+        if (d.risk) {
+            const level = (d.risk.level ?? formatRiskLevel(d.risk.score)).toUpperCase();
+            lines.push(`**Risk Score:** ${d.risk.score}/100 — **${level}**`);
+            const factors = Object.entries(d.risk.factors ?? {}).filter(([, v]) => v).map(([k]) => k);
+            if (factors.length)
+                lines.push(`**Risk Factors:** ${factors.join(", ")}`);
+            if (d.risk.details?.length)
+                lines.push(`**Risk Details:** ${d.risk.details.join("; ")}`);
         }
-        if (d.sanctions?.is_sanctioned) {
-            lines.push(`⛔ **SANCTIONED**`);
+        const sanctionIds = d.sanctions?.identifications ?? [];
+        if (sanctionIds.length) {
+            const names = sanctionIds.map((s) => [s.name, s.program].filter(Boolean).join(" / ")).filter(Boolean);
+            lines.push(`⛔ **SANCTIONED** — ${names.join("; ") || `${sanctionIds.length} identification(s)`}`);
         }
-        if (d.tx_count)
+        const goplusFlags = Object.entries(d.goplus ?? {})
+            .filter(([k, v]) => v === "1" && k !== "contract_address")
+            .map(([k]) => k);
+        if (goplusFlags.length)
+            lines.push(`**GoPlus Security Flags:** ${goplusFlags.join(", ")}`);
+        if (d.balance_usd != null)
+            lines.push(`**Balance:** ${usd(d.balance_usd)}${d.tokens?.length ? ` across ${d.tokens.length} asset(s)` : ""}`);
+        if (d.tx_count != null)
             lines.push(`**Transactions:** ${d.tx_count.toLocaleString()}`);
-        if (d.first_seen)
-            lines.push(`**First seen:** ${d.first_seen.slice(0, 10)}`);
-        if (d.last_seen)
-            lines.push(`**Last seen:** ${d.last_seen.slice(0, 10)}`);
-        lines.push(`\n*Powered by ChainHint — chainhint.com*`);
+        const ex = d.exposure;
+        if (ex && (ex.inflow?.length || ex.outflow?.length)) {
+            lines.push(``, `### Counterparty Exposure (${ex.window ?? "recent transfers"})`);
+            if (ex.risk?.level) {
+                lines.push(`**Exposure Risk:** ${ex.risk.level.toUpperCase()} (${ex.risk.pct}% of volume to/from risky counterparties)`);
+                if (ex.risk.details?.length)
+                    lines.push(...ex.risk.details.map((s) => `- ${s}`));
+            }
+            lines.push(`**Volume:** in ${usd(ex.total_in_usd)}, out ${usd(ex.total_out_usd)}; ${ex.counterparties_identified ?? 0}/${ex.counterparties_total ?? 0} counterparties identified`);
+            lines.push(...formatExposure("Inflow by category", ex.inflow));
+            lines.push(...formatExposure("Outflow by category", ex.outflow));
+        }
+        lines.push(``, `🔗 https://chainhint.com/address/${d.address}?chain=${d.chain}`);
+        lines.push(`*Powered by ChainHint — chainhint.com*`);
         return { content: [{ type: "text", text: lines.join("\n") }] };
     }
     catch (err) {
         return { content: [{ type: "text", text: `Error looking up address: ${err.message}` }] };
     }
 });
-// ── Tool 3: get_trace_status ──────────────────────────────────────────────────
-server.tool("get_trace_status", "Get the fund trace status for a crypto hack incident. Returns how stolen funds moved — number of hops, total amount traced, known endpoints (exchanges, mixers, bridges), and current movement status (in_transit, mixing, reached_exchange, dormant). Useful for incident response and understanding where stolen funds went.", {
+server.tool("get_trace_status", "Fund-trace summary for a publicly tracked crypto hack incident on ChainHint. Returns incident status, estimated loss, trace depth (hops) and graph size, where the stolen funds ended up (endpoints grouped by type: exchange, mixer, bridge, defi, unknown — with named entities and USD amounts), and the attacker's counterparty exposure. Look up by attacker address or ChainHint incident UUID. Works without an API key.", {
     attacker_address: z.string().optional().describe("Attacker wallet address to look up incident by"),
     incident_id: z.string().optional().describe("Incident UUID (from chainhint.com) — alternative to attacker_address"),
 }, async ({ attacker_address, incident_id }) => {
@@ -194,21 +239,20 @@ server.tool("get_trace_status", "Get the fund trace status for a crypto hack inc
         if (!attacker_address && !incident_id) {
             return { content: [{ type: "text", text: "Error: provide either attacker_address or incident_id" }] };
         }
-        // Query public incidents via Supabase REST
-        let queryParams = {
-            select: "id,title,status,chain,attacker_address,amount_usd,estimated_loss_usd,created_at,source",
-            is_public: "eq.true",
+        // public_incidents_view is the canonical anonymous read path (SECURITY DEFINER,
+        // exposes only is_public rows and only public-safe columns).
+        const queryParams = {
+            select: "id,title,status,chain,attacker_address,amount_usd,estimated_loss_usd,risk_score,incident_type,hack_date,display_date,created_at,updated_at,source,endpoints,flow_graph,counterparty_exposure",
             limit: "1",
             order: "created_at.desc",
         };
         if (incident_id) {
             queryParams["id"] = `eq.${incident_id}`;
-            delete queryParams["is_public"];
         }
         else if (attacker_address) {
-            queryParams["attacker_address"] = `eq.${attacker_address.toLowerCase()}`;
+            queryParams["attacker_address"] = `eq.${normalizeAddr(attacker_address)}`;
         }
-        const rows = await supabaseGet("incidents", queryParams);
+        const rows = await supabaseGet("public_incidents_view", queryParams);
         if (!rows?.length) {
             return {
                 content: [{
@@ -221,25 +265,86 @@ server.tool("get_trace_status", "Get the fund trace status for a crypto hack inc
         }
         const inc = rows[0];
         const lossUsd = inc.amount_usd ?? inc.estimated_loss_usd;
+        const date = inc.display_date ?? inc.hack_date ?? inc.created_at;
+        const status = (inc.status ?? "unknown").toLowerCase();
         const lines = [
             `## Fund Trace: ${inc.title ?? "Unnamed Incident"}`,
             `**Incident ID:** ${inc.id}`,
             `**Chain:** ${inc.chain}`,
-            `**Status:** ${inc.status.toUpperCase()}`,
-            `**Attacker:** ${truncateAddr(inc.attacker_address)}`,
-            `**Loss:** ${lossUsd ? `$${(lossUsd / 1_000_000).toFixed(2)}M` : "Unknown"}`,
-            `**Date:** ${inc.created_at.slice(0, 10)}`,
+            `**Status:** ${status.toUpperCase()}`,
+            `**Attacker:** ${inc.attacker_address}`,
+            `**Loss:** ${usd(lossUsd)}`,
+            `**Date:** ${date.slice(0, 10)}`,
         ];
-        if (inc.status.toLowerCase() === "traced") {
-            lines.push(`\n✅ Trace complete — view full flow graph and counterparty exposure on ChainHint.`);
+        if (inc.incident_type)
+            lines.push(`**Type:** ${inc.incident_type}`);
+        if (inc.risk_score != null)
+            lines.push(`**Risk Score:** ${inc.risk_score}/100`);
+        if (inc.source)
+            lines.push(`**Source:** ${inc.source}`);
+        if (inc.updated_at)
+            lines.push(`**Last traced:** ${inc.updated_at.slice(0, 10)}`);
+        const edges = inc.flow_graph?.edges ?? [];
+        const nodes = inc.flow_graph?.nodes ?? [];
+        if (edges.length) {
+            const maxDepth = edges.reduce((m, e) => Math.max(m, e.depth ?? 0), 0);
+            lines.push(``, `### Trace Graph`);
+            lines.push(`**Hops traced:** ${maxDepth} · **Addresses:** ${nodes.length} · **Transfers:** ${edges.length}`);
+        }
+        const endpoints = inc.endpoints ?? [];
+        if (endpoints.length) {
+            const byType = new Map();
+            for (const e of endpoints) {
+                const t = e.type ?? "unknown";
+                const b = byType.get(t) ?? { usd: 0, n: 0, entities: new Map() };
+                b.usd += e.amount_usd ?? 0;
+                b.n += 1;
+                const name = e.entity_name ?? e.entity;
+                if (name)
+                    b.entities.set(name, (b.entities.get(name) ?? 0) + (e.amount_usd ?? 0));
+                byType.set(t, b);
+            }
+            const totalUsd = [...byType.values()].reduce((s, b) => s + b.usd, 0);
+            lines.push(``, `### Where the funds went (${endpoints.length} endpoints, ${usd(totalUsd)} tracked)`);
+            for (const [t, b] of [...byType.entries()].sort((a, b) => b[1].usd - a[1].usd)) {
+                const top = [...b.entities.entries()].sort((a, b) => b[1] - a[1]).slice(0, 3).map(([n]) => n);
+                const pct = totalUsd > 0 ? ` (${((b.usd / totalUsd) * 100).toFixed(1)}%)` : "";
+                lines.push(`- **${t}**: ${usd(b.usd)}${pct} across ${b.n} address(es)${top.length ? ` — ${top.join(", ")}` : ""}`);
+            }
+            const topEndpoints = [...endpoints]
+                .filter((e) => (e.amount_usd ?? 0) > 0)
+                .sort((a, b) => (b.amount_usd ?? 0) - (a.amount_usd ?? 0))
+                .slice(0, 5);
+            if (topEndpoints.length) {
+                lines.push(`**Largest endpoints:**`);
+                for (const e of topEndpoints) {
+                    const name = e.entity_name ?? e.entity ?? "unattributed";
+                    lines.push(`- ${truncateAddr(e.address)} — ${name} (${e.type ?? "unknown"}): ${usd(e.amount_usd)}`);
+                }
+            }
+        }
+        const cx = inc.counterparty_exposure;
+        if (cx?.risk?.level || cx?.outflow?.length || cx?.inflow?.length) {
+            lines.push(``, `### Attacker Counterparty Exposure`);
+            if (cx.risk?.level) {
+                lines.push(`**Exposure Risk:** ${cx.risk.level.toUpperCase()} (${cx.risk.pct}%)`);
+                if (cx.risk.details?.length)
+                    lines.push(...cx.risk.details.slice(0, 5).map((s) => `- ${s}`));
+            }
+            lines.push(...formatExposure("Outflow by category", cx.outflow));
+            lines.push(...formatExposure("Inflow by category", cx.inflow));
+        }
+        lines.push(``);
+        if (status === "traced") {
+            lines.push(`✅ Trace complete — full flow graph and counterparty exposure on ChainHint.`);
         }
-        else if (inc.status.toLowerCase() === "analyzing") {
-            lines.push(`\n⏳ Trace in progress...`);
+        else if (status === "analyzing") {
+            lines.push(`⏳ Trace in progress...`);
         }
         else {
-            lines.push(`\n⚠️ Status: ${inc.status}`);
+            lines.push(`⚠️ Status: ${status}`);
         }
-        lines.push(`\n🔗 View full trace: https://chainhint.com/incident/${inc.id}`);
+        lines.push(`🔗 View full trace: https://chainhint.com/incident/${inc.id}`);
         lines.push(`*Powered by ChainHint — chainhint.com*`);
         return { content: [{ type: "text", text: lines.join("\n") }] };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chainhint-mcp",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "ChainHint MCP server — crypto risk intelligence tools for Claude Desktop and Cursor",
   "license": "MIT",
   "repository": {