chainhint-mcp 1.3.4 → 1.4.0

package/README.md

@@ -104,11 +104,13 @@ npm run dev
 
 ## Environment Variables
 
+> **Upgrade to 1.4.0.** Versions before 1.4.0 send ChainHint's legacy Supabase anon key, which is being retired: `get_trace_status` on those versions will return 401. `check_wallet_risk` and `lookup_address` are unaffected. `npx chainhint-mcp@latest` picks up 1.4.0.
+
 | Variable | Required | Description |
 |----------|----------|-------------|
 | `CHAINHINT_API_KEY` | — | Agency plan key from chainhint.com. Lifts the free limits (3 checks + 10 lookups per day) to 10,000 / day |
 | `CHAINHINT_API_URL` | — | Override API base URL (default: production) |
-| `CHAINHINT_SUPABASE_ANON_KEY` | — | Override anon key for get_trace_status (public incidents) |
+| `CHAINHINT_SUPABASE_PUBLISHABLE_KEY` | — | Override the Supabase publishable key used by get_trace_status (public incidents). Sent only in `apikey`. The pre-1.4.0 name `CHAINHINT_SUPABASE_ANON_KEY` is still read |
 
 ## Example prompts
 

package/dist/index.js

@@ -22,12 +22,14 @@ import { evidenceLines } from "./evidence.js";
 import { entityLine } from "./entity.js";
 import { ADDRESS_FORMS, normalizeAddr } from "./address.js";
 import { DATABASE_CANON } from "./canon.js";
+import { DEFAULT_SUPABASE_KEY, isSupabaseKeyConfigured, resolveSupabaseKey, supabaseRestHeaders } from "./supabase-rest.js";
 // ── Config ────────────────────────────────────────────────────────────────────
 const API_KEY = process.env.CHAINHINT_API_KEY;
 const BASE_URL = process.env.CHAINHINT_API_URL ?? "https://kjiwfwymnuzxriokhcjk.supabase.co/functions/v1";
 const SUPABASE_URL = process.env.CHAINHINT_SUPABASE_URL ?? "https://kjiwfwymnuzxriokhcjk.supabase.co";
-const SUPABASE_ANON_KEY = process.env.CHAINHINT_SUPABASE_ANON_KEY ?? "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImtqaXdmd3ltbnV6eHJpb2toY2prIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzI3MzkxODgsImV4cCI6MjA4ODMxNTE4OH0.VqzzF_jI8zF072cbjWEDbYo3PnMDlIPy621iWkXEqyo";
-const VERSION = "1.3.4";
+// Publishable key, sent only in `apikey` (never as a Bearer token) — see supabase-rest.ts.
+const SUPABASE_KEY = resolveSupabaseKey(process.env, DEFAULT_SUPABASE_KEY);
+const VERSION = "1.4.0";
 const USER_AGENT = `chainhint-mcp/${VERSION}`;
 const FREE_CHECKS_PER_DAY = 3;
 const UPGRADE_HINT = "set CHAINHINT_API_KEY (Agency plan, https://chainhint.com/pricing) for 10,000/day";
@@ -78,12 +80,11 @@ async function supabaseGet(table, params) {
     for (const [k, v] of Object.entries(params)) {
         url.searchParams.set(k, v);
     }
+    if (!isSupabaseKeyConfigured(SUPABASE_KEY)) {
+        throw new Error("get_trace_status is not configured: no Supabase publishable key (set CHAINHINT_SUPABASE_PUBLISHABLE_KEY or upgrade chainhint-mcp)");
+    }
     const res = await fetch(url.toString(), {
-        headers: {
-            "apikey": SUPABASE_ANON_KEY,
-            "Authorization": `Bearer ${SUPABASE_ANON_KEY}`,
-            "Accept": "application/json",
-        },
+        headers: supabaseRestHeaders(SUPABASE_KEY),
     });
     if (!res.ok) {
         const err = await res.text();

package/dist/supabase-rest.d.ts

@@ -0,0 +1,21 @@
+/** Env var for the project key (1.4.0+). */
+export declare const PUBLISHABLE_KEY_ENV = "CHAINHINT_SUPABASE_PUBLISHABLE_KEY";
+/** Pre-1.4.0 name, still honoured so existing configs keep their override. */
+export declare const LEGACY_ANON_KEY_ENV = "CHAINHINT_SUPABASE_ANON_KEY";
+/** Env override first (new name, then the legacy name), else the built-in default. */
+export declare function resolveSupabaseKey(env: Record<string, string | undefined>, fallback: string): string;
+/** Headers for an anonymous REST read of a public view: key in apikey only. */
+export declare function supabaseRestHeaders(key: string): Record<string, string>;
+/** Marker the default carries until the owner pastes the real publishable key. */
+export declare const PUBLISHABLE_KEY_PLACEHOLDER = "sb_publishable_PASTE_BEFORE_PUBLISH";
+/**
+ * ChainHint's Supabase publishable key (sb_publishable_…) — public by design, the
+ * same value the chainhint.com bundle ships. Paste it here before `npm publish`;
+ * `prepublishOnly` (scripts/check-publish.mjs) refuses to publish while this is the
+ * placeholder, a JWT or anything that is not a publishable key.
+ */
+export declare const DEFAULT_SUPABASE_KEY: string;
+/** Why `key` must not be the published default, or null when it is a real publishable key. */
+export declare function publishKeyProblem(key: string): string | null;
+/** true when REST reads can run: an override or a real default. */
+export declare function isSupabaseKeyConfigured(key: string): boolean;

package/dist/supabase-rest.js

@@ -0,0 +1,44 @@
+// KIR-81 (1.4.0): the Supabase project key is a publishable key
+// (`sb_publishable_…`), not a JWT. It is sent ONLY in the `apikey` header —
+// never as `Authorization: Bearer`, which PostgREST would try to verify as a
+// JWT. Versions < 1.4.0 sent the legacy anon JWT in both headers and stop
+// working when the project disables its legacy API keys.
+/** Env var for the project key (1.4.0+). */
+export const PUBLISHABLE_KEY_ENV = "CHAINHINT_SUPABASE_PUBLISHABLE_KEY";
+/** Pre-1.4.0 name, still honoured so existing configs keep their override. */
+export const LEGACY_ANON_KEY_ENV = "CHAINHINT_SUPABASE_ANON_KEY";
+/** Env override first (new name, then the legacy name), else the built-in default. */
+export function resolveSupabaseKey(env, fallback) {
+    const fromEnv = env[PUBLISHABLE_KEY_ENV] || env[LEGACY_ANON_KEY_ENV];
+    return fromEnv && fromEnv.trim() ? fromEnv.trim() : fallback;
+}
+/** Headers for an anonymous REST read of a public view: key in apikey only. */
+export function supabaseRestHeaders(key) {
+    return { apikey: key, Accept: "application/json" };
+}
+/** Marker the default carries until the owner pastes the real publishable key. */
+export const PUBLISHABLE_KEY_PLACEHOLDER = "sb_publishable_PASTE_BEFORE_PUBLISH";
+/**
+ * ChainHint's Supabase publishable key (sb_publishable_…) — public by design, the
+ * same value the chainhint.com bundle ships. Paste it here before `npm publish`;
+ * `prepublishOnly` (scripts/check-publish.mjs) refuses to publish while this is the
+ * placeholder, a JWT or anything that is not a publishable key.
+ */
+export const DEFAULT_SUPABASE_KEY = "sb_publishable_BpalXiQKLHEpDqyNpt2Tkw_JYkuIGBK";
+/** Why `key` must not be the published default, or null when it is a real publishable key. */
+export function publishKeyProblem(key) {
+    const k = (key ?? "").trim();
+    if (k === PUBLISHABLE_KEY_PLACEHOLDER)
+        return "the default key is still the placeholder";
+    if (k.startsWith("eyJ"))
+        return "the default key is a JWT (legacy anon key) — use the sb_publishable_ key";
+    if (k.startsWith("sb_secret_"))
+        return "the default key is a SECRET key — never ship it";
+    if (!/^sb_publishable_[A-Za-z0-9_-]{16,}$/.test(k))
+        return "the default key does not look like an sb_publishable_ key";
+    return null;
+}
+/** true when REST reads can run: an override or a real default. */
+export function isSupabaseKeyConfigured(key) {
+    return publishKeyProblem(key) === null || ((key ?? "").trim() !== "" && (key ?? "").trim() !== PUBLISHABLE_KEY_PLACEHOLDER && !(key ?? "").trim().startsWith("eyJ"));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chainhint-mcp",
-  "version": "1.3.4",
+  "version": "1.4.0",
   "description": "ChainHint MCP server — crypto risk intelligence tools for Claude Desktop and Cursor",
   "license": "MIT",
   "repository": {
@@ -35,8 +35,9 @@
     "build": "tsc",
     "dev": "tsx src/index.ts",
     "start": "node dist/index.js",
-    "prepublishOnly": "npm run build",
-    "test": "npm run build && node --test test/*.test.mjs"
+    "prepublishOnly": "npm run build && node scripts/check-publish.mjs",
+    "test": "npm run build && node --test test/*.test.mjs",
+    "check:publish": "npm run build && node scripts/check-publish.mjs"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",