chainhint-mcp 1.3.0 → 1.3.1

package/README.md

@@ -86,6 +86,8 @@ Add an Agency key to the server entry (any client):
 Free tier: 2 of 3 checks left today — set CHAINHINT_API_KEY (Agency plan, https://chainhint.com/pricing) for 10,000/day.
 ```
 
+When the address is in ChainHint's agent-infrastructure registry (agent-token launchpads, deployer factories, routers, payment facilitators, known agent wallets), the report adds an `🤖` line, e.g. *Known agent infrastructure: Virtuals launchpad* — a registry fact you can verify at its source, not a behavioural classification and not part of the risk score.
+
 ## Development (no build step)
 
 ```bash

package/dist/index.js

@@ -22,7 +22,7 @@ const API_KEY = process.env.CHAINHINT_API_KEY;
 const BASE_URL = process.env.CHAINHINT_API_URL ?? "https://kjiwfwymnuzxriokhcjk.supabase.co/functions/v1";
 const SUPABASE_URL = process.env.CHAINHINT_SUPABASE_URL ?? "https://kjiwfwymnuzxriokhcjk.supabase.co";
 const SUPABASE_ANON_KEY = process.env.CHAINHINT_SUPABASE_ANON_KEY ?? "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImtqaXdmd3ltbnV6eHJpb2toY2prIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzI3MzkxODgsImV4cCI6MjA4ODMxNTE4OH0.VqzzF_jI8zF072cbjWEDbYo3PnMDlIPy621iWkXEqyo";
-const VERSION = "1.1.0";
+const VERSION = "1.3.1";
 const USER_AGENT = `chainhint-mcp/${VERSION}`;
 const FREE_CHECKS_PER_DAY = 3;
 const UPGRADE_HINT = "set CHAINHINT_API_KEY (Agency plan, https://chainhint.com/pricing) for 10,000/day";
@@ -196,11 +196,29 @@ function formatExposure(label, buckets) {
         }),
     ];
 }
+/**
+ * Same rule as chainhint.com (src/lib/attackerAttribution.ts): an address is
+ * "the attacker" only when the attribution was checked against the exploit
+ * transaction (attacker_address_source = analyst_verified). Everything else is
+ * a report — shown as one, and never as a HIGH-risk verdict.
+ */
+function attackerAttribution(inc) {
+    if (!inc.attacker_address)
+        return { verified: false, label: "Attacker not identified" };
+    if (inc.attacker_address_source === "analyst_verified")
+        return { verified: true, label: "Attacker" };
+    return {
+        verified: false,
+        label: inc.source === "defillama"
+            ? "Reported attacker (DeFiLlama), unverified"
+            : "Reported attacker (user-provided), unverified",
+    };
+}
 /** Public incident whose attacker_address matches, or null (errors swallowed — best effort). */
 async function findPublicIncidentByAttacker(address) {
     try {
         const rows = await supabaseGet("public_incidents_view", {
-            select: "id,title,chain,amount_usd,estimated_loss_usd,risk_score",
+            select: "id,title,chain,amount_usd,estimated_loss_usd,risk_score,source,attacker_address_source",
             attacker_address: `eq.${normalizeAddr(address)}`,
             limit: "1",
         });
@@ -241,7 +259,11 @@ server.tool("check_wallet_risk", "Fast risk check for a crypto wallet address ag
             lines.push(`**Risk:** ⚪ NO DATA — address is not in ChainHint's labeled database. This is not evidence it is clean.`);
             const inc = await findPublicIncidentByAttacker(d.address);
             if (inc) {
-                lines.push(`⚠️ **Known attacker in a public hack incident:** ${inc.title ?? "Unnamed incident"} (${inc.chain}, loss ${usd(inc.amount_usd ?? inc.estimated_loss_usd)}${inc.risk_score != null ? `, incident risk ${inc.risk_score}/100` : ""}). Treat as HIGH risk.`, `🔗 https://chainhint.com/incident/${inc.id}`);
+                const attribution = attackerAttribution({ attacker_address: d.address, ...inc });
+                const where = `${inc.title ?? "Unnamed incident"} (${inc.chain}, loss ${usd(inc.amount_usd ?? inc.estimated_loss_usd)}${inc.risk_score != null ? `, incident risk ${inc.risk_score}/100` : ""})`;
+                lines.push(attribution.verified
+                    ? `⚠️ **Verified attacker in a public hack incident:** ${where}. The attribution was checked against the exploit transaction. Treat as HIGH risk.`
+                    : `ℹ️ **${attribution.label}, in a public hack incident:** ${where}. This attribution has not been verified against the exploit transaction — treat it as a lead to check, not as a risk verdict.`, `🔗 https://chainhint.com/incident/${inc.id}`);
             }
             lines.push(`Use lookup_address for an on-chain assessment (risk factors, GoPlus flags, counterparty exposure).`);
         }
@@ -375,7 +397,7 @@ server.tool("get_trace_status", "Fund-trace summary for a publicly tracked crypt
         // public_incidents_view is the canonical anonymous read path (SECURITY DEFINER,
         // exposes only is_public rows and only public-safe columns).
         const queryParams = {
-            select: "id,title,status,chain,attacker_address,amount_usd,estimated_loss_usd,risk_score,incident_type,hack_date,display_date,created_at,updated_at,source,endpoints,flow_graph,counterparty_exposure",
+            select: "id,title,status,chain,attacker_address,attacker_address_source,amount_usd,estimated_loss_usd,risk_score,incident_type,hack_date,display_date,created_at,updated_at,source,endpoints,flow_graph,counterparty_exposure",
             limit: "1",
             order: "created_at.desc",
         };
@@ -406,7 +428,7 @@ server.tool("get_trace_status", "Fund-trace summary for a publicly tracked crypt
             `**Incident ID:** ${inc.id}`,
             `**Chain:** ${inc.chain}`,
             `**Status:** ${status.toUpperCase()}`,
-            `**Attacker:** ${inc.attacker_address}`,
+            `**${attackerAttribution(inc).label}:** ${inc.attacker_address ?? "—"}`,
             `**Loss:** ${usd(lossUsd)}`,
             `**Date:** ${date.slice(0, 10)}`,
         ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chainhint-mcp",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "ChainHint MCP server — crypto risk intelligence tools for Claude Desktop and Cursor",
   "license": "MIT",
   "repository": {