coinopai-mcp 1.2.9 → 2.0.0

package/README.md

@@ -59,6 +59,10 @@ Trust the process less. Verify the record more.
 
 The agent calls a tool → the MCP server receives an `HTTP 402` → automatically signs a USDC micropayment → retries with the payment header → data returned. Configure once, pay automatically from the configured low-balance wallet.
 
+Current package: `coinopai-mcp@1.2.10`.
+
+Settlement note: the MCP pins `@x402/core` and `@x402/evm` to `2.11.0` and signs EIP-3009 authorizations with a chain-aware timestamp. This avoids the Base RPC/facilitator clock-skew failure mode where a payment can be rejected as "authorization is not yet valid" or "valid before expired". Successful object responses include x402 settlement metadata under `_payment`, including the on-chain transaction hash when available.
+
 ---
 
 ## The Auditable Loop ($0.27/cycle)
@@ -147,6 +151,8 @@ Directional values are supporting context, not guarantees, human recommendations
 
 Audit verdicts include `GOOD_DECISION`, `BAD_DIRECTION`, `NOISE`, `NO_ACTION_TAKEN`, and `PENDING`. Kronos gets some right, gets some wrong, and exposes both through the same record.
 
+Fresh audits can return `pending_window` until the evaluation window matures.
+
 ---
 
 ## Tools
@@ -213,6 +219,10 @@ Add to your Claude Desktop config (`claude_desktop_config.json`):
 
 Not currently listed on Smithery. Use the `npx` install flow shown above until a verified public listing is live.
 
+### Developer smoke-test note
+
+When testing the published package with an MCP stdio harness, do not launch `npx coinopai-mcp@...` from inside the `coinopai-mcp` source checkout. npm can prefer the local package context and fail before the temporary bin is available. Test from another directory, or install into a temp project and launch `./node_modules/.bin/coinopai-mcp`.
+
 ### Registry status
 
 Prepared MCP Registry identity: `io.github.forgemeshlabs/coinopai-mcp`. Refresh the public directory submission after publishing this package so old `clawdbotworker` entries stop being canonical.
@@ -289,6 +299,8 @@ Route to an available symbol or wait 15 minutes for the next cycle.
 | Network | Base mainnet (`eip155:8453`) |
 | Token | USDC (`0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913`) |
 | Facilitator | Coinbase |
+| Client SDK pins | `@x402/core@2.11.0`, `@x402/evm@2.11.0` |
+| Receipt metadata | Successful object responses include `_payment` |
 
 ---
 

package/index.js

@@ -5,7 +5,7 @@ const { Server } = require("@modelcontextprotocol/sdk/server/index.js");
 const { StdioServerTransport } = require("@modelcontextprotocol/sdk/server/stdio.js");
 const { CallToolRequestSchema, ListToolsRequestSchema } = require("@modelcontextprotocol/sdk/types.js");
 const { x402Client, x402HTTPClient } = require("@x402/core/client");
-const { registerExactEvmScheme } = require("@x402/evm/exact/client");
+const { ExactEvmScheme } = require("@x402/evm/exact/client");
 const { toClientEvmSigner } = require("@x402/evm");
 const { privateKeyToAccount } = require("viem/accounts");
 const { createPublicClient, createWalletClient, http, parseAbi } = require("viem");
@@ -36,6 +36,7 @@ const IMAGEGEN_URL = "https://imagegen.coinopai.com";
 const PYRIMID_PRODUCTS_IMAGEGEN = {
   "/generate": { productId: 3n, priceUsdc: 100000n },
 };
+const BASE_RPC_URL = process.env.BASE_RPC_URL || "https://mainnet.base.org";
 
 const TOOLS = [
   {
@@ -163,20 +164,42 @@ function buildHttpClient() {
   if (!key) throw new Error("WALLET_PRIVATE_KEY required — set a Base wallet private key with USDC funded");
   const pk = key.startsWith("0x") ? key : "0x" + key;
   const account = privateKeyToAccount(pk);
-  const signer = toClientEvmSigner(account);
-  const coreClient = registerExactEvmScheme(new x402Client(), { signer });
+  const coreClient = new x402Client().register("eip155:*", new ExactEvmScheme(toClientEvmSigner(account)));
   return { httpClient: new x402HTTPClient(coreClient), account };
 }
 
 const sleep = (ms) => new Promise(r => setTimeout(r, ms));
 
+async function createChainTimedPaymentPayload(httpClient, paymentRequired) {
+  try {
+    const publicClient = createPublicClient({ chain: base, transport: http(BASE_RPC_URL) });
+    const block = await publicClient.getBlock();
+    const chainNow = Number(block.timestamp);
+    const originalNow = Date.now;
+    const localNow = Math.floor(originalNow() / 1000);
+    const timeout = Number(paymentRequired.accepts?.[0]?.maxTimeoutSeconds || 300);
+    const lowerBound = localNow + 30 - timeout;
+    const upperBound = chainNow + 600;
+    const signingNow = Math.min(Math.max(chainNow, lowerBound), upperBound);
+    // x402 derives EIP-3009 validity windows from Date.now; choose a timestamp valid for both Base block time and facilitator wall-clock checks.
+    Date.now = () => signingNow * 1000;
+    try {
+      return await httpClient.createPaymentPayload(paymentRequired);
+    } finally {
+      Date.now = originalNow;
+    }
+  } catch (_) {
+    return httpClient.createPaymentPayload(paymentRequired);
+  }
+}
+
 // Pyrimid affiliate flow — approve + routePayment on-chain, then retry with tx hash
 async function callPyrimid(account, path, affiliateId, baseUrl, products) {
   const pathname = new URL(path, baseUrl).pathname;
   const product = products[pathname];
   if (!product) throw new Error(`No Pyrimid product registered for ${pathname}`);
   const url = baseUrl + path;
-  const transport = http();
+  const transport = http(BASE_RPC_URL);
   const publicClient = createPublicClient({ chain: base, transport });
   const walletClient = createWalletClient({ account, chain: base, transport });
 
@@ -234,7 +257,7 @@ async function callPaid(ctx, path, affiliateId, opts = {}) {
     const paymentRequired = httpClient.getPaymentRequiredResponse(
       (name) => res.headers.get(name), body
     );
-    const paymentPayload = await httpClient.createPaymentPayload(paymentRequired);
+    const paymentPayload = await createChainTimedPaymentPayload(httpClient, paymentRequired);
     const paidRes = await fetch(url, {
       method,
       headers: { ...bodyHeaders, ...httpClient.encodePaymentSignatureHeader(paymentPayload), ...extraHeaders },
@@ -244,7 +267,14 @@ async function callPaid(ctx, path, affiliateId, opts = {}) {
       const errBody = await paidRes.text().catch(() => paidRes.statusText);
       throw new Error(`HTTP ${paidRes.status}: ${errBody.slice(0, 200)}`);
     }
-    return paidRes.json();
+    const data = await paidRes.json();
+    try {
+      const settleResponse = httpClient.getPaymentSettleResponse((name) => paidRes.headers.get(name));
+      if (settleResponse && data && typeof data === "object" && !Array.isArray(data)) {
+        return { ...data, _payment: settleResponse };
+      }
+    } catch (_) {}
+    return data;
   }
 
   if (!res.ok) {
@@ -262,7 +292,7 @@ async function main() {
   }
 
   const server = new Server(
-    { name: "coinopai-mcp", version: "1.2.9" },
+    { name: "coinopai-mcp", version: "1.2.10" },
     { capabilities: { tools: {} } }
   );
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coinopai-mcp",
-  "version": "1.2.9",
+  "version": "2.0.0",
   "mcpName": "io.github.forgemeshlabs/coinopai-mcp",
   "description": "Auditable market intelligence MCP with x402 payments, calibrated forecast ranges, anomaly review, risk context, and outcome audits",
   "main": "index.js",
@@ -16,7 +16,7 @@
     "start": "node index.js"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=20"
   },
   "keywords": [
     "mcp",
@@ -47,9 +47,9 @@
     "url": "https://github.com/forgemeshlabs/coinopai-mcp/issues"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.10.1",
-    "@x402/core": "^2.12.0",
-    "@x402/evm": "^2.12.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@x402/core": "2.11.0",
+    "@x402/evm": "2.11.0",
     "viem": "^2.0.0"
   }
 }

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/forgemeshlabs/coinopai-mcp",
     "source": "github"
   },
-  "version": "1.2.9",
+  "version": "1.2.10",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "coinopai-mcp",
-      "version": "1.2.9",
+      "version": "1.2.10",
       "transport": {
         "type": "stdio"
       },