coinopai-mcp 2.2.1 → 2.2.2

package/README.md

@@ -62,9 +62,9 @@ Trust the process less. Verify the record more.
 
 The agent calls a tool → the MCP server receives an `HTTP 402` → automatically signs a USDC micropayment → retries with the payment header → data returned. Configure once, pay automatically from the configured low-balance wallet.
 
-Current package: `coinopai-mcp@1.2.10`.
+Current package: `coinopai-mcp@2.2.2`.
 
-Settlement note: the MCP pins `@x402/core` and `@x402/evm` to `2.11.0` and signs EIP-3009 authorizations with a chain-aware timestamp. This avoids the Base RPC/facilitator clock-skew failure mode where a payment can be rejected as "authorization is not yet valid" or "valid before expired". Successful object responses include x402 settlement metadata under `_payment`, including the on-chain transaction hash when available.
+Settlement note: the MCP pins `@x402/core` and `@x402/evm` to `2.11.0`. Successful object responses include x402 settlement metadata under `_payment`, including the on-chain transaction hash when available.
 
 ---
 
@@ -160,22 +160,22 @@ Fresh audits can return `pending_window` until the evaluation window matures.
 
 ## Tools
 
-| Tool | What it does | Cost | Affiliate |
-|------|-------------|------|-----------|
-| `check_trade_preflight` | Gate check: market allowed, cooldown, regime, model context | $0.05 | ✓ |
-| `get_crypto_decision` | Probabilistic decision journal + `decision_id` | $0.15 | ✓ |
-| `audit_trade_decision` | Verify against real prices: verdict + PnL% | $0.07 | ✓ |
-| `get_crypto_signals` | Model context for BTC, ETH, SOL, XRP, ADA | $0.05 | ✓ |
-| `get_crypto_signal_history` | Up to 168h of context history for analysis | $0.05 | ✓ |
-| `get_crypto_forecast` | Conformally-calibrated 80% price range (~0.80 empirical coverage) for BTC, ETH, SOL, XRP, ADA | $0.05 | ✓ |
-| `get_perp_funding` | **Futures.** Live perp funding, mark/index, open interest, crowding (Kraken Futures + Hyperliquid) | $0.02 | — |
-| `check_futures_risk` | **Futures.** Will this side / leverage / entry survive the calibrated range? Liquidation distance + verdict | $0.05 | — |
-| `get_futures_decision` | **Futures.** LONG / SHORT / FLAT with stop and target on the calibrated range, leverage cap, liquidation, sizing, funding cost | $0.15 | — |
-| `review_signal_anomaly` | Score signal features for unusual conditions; returns review labels, drivers, and component scores | $0.07 | — |
-| `get_crypto_risk` | Market risk state and cooldown context | $0.02 | — |
-| `search_agent_automations` | Search 819 agent automation prompts | $0.01 | — |
-| `get_agent_automation` | Full prompt + workflow steps by slug | $0.01 | — |
-| `list_automation_categories` | All 35 automation categories with counts | $0.005 | — |
+| Tool | What it does | Cost |
+|------|-------------|------|
+| `check_trade_preflight` | Gate check: market allowed, cooldown, regime, model context | $0.05 |
+| `get_crypto_decision` | Probabilistic decision journal + `decision_id` | $0.15 |
+| `audit_trade_decision` | Verify against real prices: verdict + PnL% | $0.07 |
+| `get_crypto_signals` | Model context for BTC, ETH, SOL, XRP, ADA | $0.05 |
+| `get_crypto_signal_history` | Up to 168h of context history for analysis | $0.05 |
+| `get_crypto_forecast` | Conformally-calibrated 80% price range (~0.80 empirical coverage) for BTC, ETH, SOL, XRP, ADA | $0.05 |
+| `get_perp_funding` | **Futures.** Live perp funding, mark/index, open interest, crowding (Kraken Futures + Hyperliquid) | $0.02 |
+| `check_futures_risk` | **Futures.** Will this side / leverage / entry survive the calibrated range? Liquidation distance + verdict | $0.05 |
+| `get_futures_decision` | **Futures.** LONG / SHORT / FLAT with stop and target on the calibrated range, leverage cap, liquidation, sizing, funding cost | $0.15 |
+| `review_signal_anomaly` | Score signal features for unusual conditions; returns review labels, drivers, and component scores | $0.07 |
+| `get_crypto_risk` | Market risk state and cooldown context | $0.02 |
+| `search_agent_automations` | Search 819 agent automation prompts | $0.01 |
+| `get_agent_automation` | Full prompt + workflow steps by slug | $0.01 |
+| `list_automation_categories` | All 35 automation categories with counts | $0.005 |
 
 No API keys. No subscriptions. Pay per call in USDC.
 
@@ -242,6 +242,8 @@ Prepared MCP Registry identity: `io.github.forgemeshlabs/coinopai-mcp`. Refresh
 3. Buy or bridge USDC ($1 = ~3 full verified cycles)
 4. Use a dedicated low-balance Base wallet for agent payments and provide its private key locally via environment variable.
 
+**Payment safeguards.** The server only signs for the CoinOpAI payee wallet on Base mainnet, in USDC, at or below $0.15 per call and $10 per session. It refuses any other payee, network, asset, or amount before signing. Env `X402_MAX_PRICE_USD` and `X402_SESSION_BUDGET_USD` can only lower these caps. The server talks only to `https://x402.coinopai.com` (no redirects, 60s timeout, 2 MB response cap). Use a dedicated, low-balance wallet.
+
 > Your wallet key stays local. It never leaves your machine. Each payment is a signed micropayment — not a blanket approval.
 
 ---
@@ -331,63 +333,6 @@ Free-tier tool responses may carry a single disclosed sponsored card from [Lulu
 
 ---
 
-## Affiliate Attribution (via Pyrimid)
-
-High-value tools accept an optional `affiliate_id` parameter. When provided, payment routes through the [Pyrimid](https://pyrimid.xyz) affiliate network — the affiliate earns a commission split from within the listed price. **No extra cost to the caller.**
-
-### How the split works
-
-```
-Direct call (no affiliate_id):
-  Caller pays $0.15  →  CoinOpAI receives $0.15
-
-Affiliate call (affiliate_id present):
-  Caller pays $0.15  →  CoinOpAI: 79.2% ($0.1188)
-                      →  Affiliate: 19.8% ($0.0297)
-                      →  Protocol:   1.0% ($0.0015)
-```
-
-The buyer always pays the listed price. The split comes out of the vendor's portion.
-
-### Usage
-
-Pass `affiliate_id` in any supporting tool call:
-
-```js
-// As an agent or user
-await mcp.call("get_crypto_decision", {
-  symbol: "BTC",
-  affiliate_id: "af_youraffiliateID"
-})
-```
-
-### Building a wrapper? Set it once via env
-
-If you're building an agent framework, MCP wrapper, or automation that embeds CoinOpAI tools, set your affiliate ID as an environment variable. Every call through your wrapper earns you a commission automatically.
-
-```json
-{
-  "mcpServers": {
-    "coinopai": {
-      "command": "npx",
-      "args": ["-y", "coinopai-mcp"],
-      "env": {
-        "WALLET_PRIVATE_KEY": "0x<agent-wallet-key>",
-        "PYRIMID_AFFILIATE_ID": "af_<your-affiliate-id>"
-      }
-    }
-  }
-}
-```
-
-The tool-level `affiliate_id` argument takes precedence over the env var. Callers can always override.
-
-### Without an affiliate_id
-
-Normal x402 flow — CoinOpAI receives 100% of the listed price. Nothing changes for the caller.
-
----
-
 ## Disclaimer
 
 Decision outputs are probabilistic context and journal entries for experimental automated workflows only. Not financial advice. Directional bias alone has not been validated as a standalone trading strategy. Results will vary. Never risk capital you can't afford to lose.

package/index.js

@@ -8,36 +8,17 @@ const { x402Client, x402HTTPClient } = require("@x402/core/client");
 const { ExactEvmScheme } = require("@x402/evm/exact/client");
 const { toClientEvmSigner } = require("@x402/evm");
 const { privateKeyToAccount } = require("viem/accounts");
-const { createPublicClient, createWalletClient, http, parseAbi } = require("viem");
-const { base } = require("viem/chains");
 const { attachSponsored, FREE_TIER_TOOLS } = require("./ads.js");
+const { createGuard } = require("./x402-guard");
 
 const BASE_URL = "https://x402.coinopai.com";
-
-// Pyrimid constants — on-chain addresses for affiliate payment routing
-const PYRIMID_ROUTER = "0xc949AEa380D7b7984806143ddbfE519B03ABd68B";
-const PYRIMID_VENDOR_ID = "0x034604e25078e293d7b181fa23b3f2f6";
-const USDC_ADDRESS = "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913";
-const ROUTER_ABI = parseAbi([
-  "function routePayment(bytes16 vendorId, uint256 productId, bytes16 affiliateId, address buyer, uint256 maxPrice) external",
-]);
-const USDC_ABI = parseAbi([
-  "function approve(address spender, uint256 amount) external returns (bool)",
-]);
-// Paths with registered Pyrimid product IDs — other paths fall back to standard x402
-const PYRIMID_PRODUCTS = {
-  "/api/kronos/signals":   { productId: 1n, priceUsdc:  50000n },
-  "/api/kronos/decision":  { productId: 2n, priceUsdc: 150000n },
-  "/api/kronos/preflight": { productId: 4n, priceUsdc:  50000n },
-  "/api/kronos/audit":     { productId: 5n, priceUsdc:  70000n },
-  "/api/kronos/risk":      { productId: 6n, priceUsdc:  20000n },
-  "/api/kronos/history":   { productId: 7n, priceUsdc:  50000n },
-};
-const IMAGEGEN_URL = "https://imagegen.coinopai.com";
-const PYRIMID_PRODUCTS_IMAGEGEN = {
-  "/generate": { productId: 3n, priceUsdc: 100000n },
-};
-const BASE_RPC_URL = process.env.BASE_RPC_URL || "https://mainnet.base.org";
+// Highest listed price on this backend is $0.15; the guard refuses anything above it.
+const guard = createGuard({
+  baseUrl: BASE_URL,
+  payTo: ["0x1304EC1A8945365e43A5c18a734065f107B417cA"],
+  maxPriceUsd: 0.15,
+  sessionBudgetUsd: 10,
+});
 
 const TOOLS = [
   {
@@ -52,7 +33,7 @@ const TOOLS = [
     inputSchema: {
       type: "object",
       properties: {
-        query: { type: "string", description: "Search keyword (e.g. 'slack', 'notion', 'github')" },
+        query: { type: "string", maxLength: 200, description: "Search keyword (e.g. 'slack', 'notion', 'github')" },
         limit: { type: "number", description: "Max results to return (default 20, max 50)" }
       },
       required: ["query"]
@@ -70,7 +51,7 @@ const TOOLS = [
     inputSchema: {
       type: "object",
       properties: {
-        slug: { type: "string", description: "Automation slug (e.g. 'slack-to-notion')" }
+        slug: { type: "string", maxLength: 200, pattern: "^[A-Za-z0-9._-]+$", description: "Automation slug (e.g. 'slack-to-notion')" }
       },
       required: ["slug"]
     }
@@ -98,7 +79,6 @@ const TOOLS = [
     inputSchema: {
       type: "object",
       properties: {
-        affiliate_id: { type: "string", description: "Optional Pyrimid affiliate ID (af_xxxxx). Affiliate earns a commission from within the listed price — no extra cost to you." }
       }
     }
   },
@@ -125,8 +105,7 @@ const TOOLS = [
     inputSchema: {
       type: "object",
       properties: {
-        hours: { type: "number", description: "Hours of history to fetch (default 24, max 168)" },
-        affiliate_id: { type: "string", description: "Optional Pyrimid affiliate ID (af_xxxxx). Affiliate earns a commission from within the listed price — no extra cost to you." }
+        hours: { type: "number", description: "Hours of history to fetch (default 24, max 168)" }
       }
     }
   },
@@ -142,8 +121,7 @@ const TOOLS = [
     inputSchema: {
       type: "object",
       properties: {
-        symbol: { type: "string", description: "Symbol to evaluate: BTC, ETH, SOL, XRP, or ADA" },
-        affiliate_id: { type: "string", description: "Optional Pyrimid affiliate ID (af_xxxxx). Affiliate earns a commission from within the listed price — no extra cost to you." }
+        symbol: { type: "string", description: "Symbol to evaluate: BTC, ETH, SOL, XRP, or ADA" }
       },
       required: ["symbol"]
     }
@@ -160,8 +138,7 @@ const TOOLS = [
     inputSchema: {
       type: "object",
       properties: {
-        symbol: { type: "string", description: "Symbol to check: BTC, ETH, SOL, XRP, or ADA" },
-        affiliate_id: { type: "string", description: "Optional Pyrimid affiliate ID (af_xxxxx). Affiliate earns a commission from within the listed price — no extra cost to you." }
+        symbol: { type: "string", description: "Symbol to check: BTC, ETH, SOL, XRP, or ADA" }
       },
       required: ["symbol"]
     }
@@ -179,8 +156,7 @@ const TOOLS = [
       type: "object",
       properties: {
         decision_id: { type: "string", description: "UUID from a previous get_crypto_decision call" },
-        window: { type: "string", description: "Evaluation window: 1h, 4h, or 24h (default: 4h)" },
-        affiliate_id: { type: "string", description: "Optional Pyrimid affiliate ID (af_xxxxx). Affiliate earns a commission from within the listed price — no extra cost to you." }
+        window: { type: "string", description: "Evaluation window: 1h, 4h, or 24h (default: 4h)" }
       },
       required: ["decision_id"]
     }
@@ -254,8 +230,7 @@ const TOOLS = [
     inputSchema: {
       type: "object",
       properties: {
-        symbol: { type: "string", description: "Symbol: BTC, ETH, SOL, XRP, ADA (default: BTC)" },
-        affiliate_id: { type: "string", description: "Optional Pyrimid affiliate ID (af_xxxxx). Affiliate earns a commission from within the listed price — no extra cost to you." }
+        symbol: { type: "string", description: "Symbol: BTC, ETH, SOL, XRP, ADA (default: BTC)" }
       }
     }
   },
@@ -299,213 +274,129 @@ function buildHttpClient() {
   if (!key) throw new Error("WALLET_PRIVATE_KEY required — set a Base wallet private key with USDC funded");
   const pk = key.startsWith("0x") ? key : "0x" + key;
   const account = privateKeyToAccount(pk);
-  const coreClient = new x402Client().register("eip155:*", new ExactEvmScheme(toClientEvmSigner(account)));
-  return { httpClient: new x402HTTPClient(coreClient), account };
-}
-
-const sleep = (ms) => new Promise(r => setTimeout(r, ms));
-
-async function createChainTimedPaymentPayload(httpClient, paymentRequired) {
-  try {
-    const publicClient = createPublicClient({ chain: base, transport: http(BASE_RPC_URL) });
-    const block = await publicClient.getBlock();
-    const chainNow = Number(block.timestamp);
-    const originalNow = Date.now;
-    const localNow = Math.floor(originalNow() / 1000);
-    const timeout = Number(paymentRequired.accepts?.[0]?.maxTimeoutSeconds || 300);
-    const lowerBound = localNow + 30 - timeout;
-    const upperBound = chainNow + 600;
-    const signingNow = Math.min(Math.max(chainNow, lowerBound), upperBound);
-    // x402 derives EIP-3009 validity windows from Date.now; choose a timestamp valid for both Base block time and facilitator wall-clock checks.
-    Date.now = () => signingNow * 1000;
-    try {
-      return await httpClient.createPaymentPayload(paymentRequired);
-    } finally {
-      Date.now = originalNow;
-    }
-  } catch (_) {
-    return httpClient.createPaymentPayload(paymentRequired);
-  }
+  const coreClient = new x402Client().register("eip155:*", new ExactEvmScheme(toClientEvmSigner(account))).registerPolicy(guard.policy);
+  return new x402HTTPClient(coreClient);
 }
 
-// Pyrimid affiliate flow — approve + routePayment on-chain, then retry with tx hash
-async function callPyrimid(account, path, affiliateId, baseUrl, products) {
-  const pathname = new URL(path, baseUrl).pathname;
-  const product = products[pathname];
-  if (!product) throw new Error(`No Pyrimid product registered for ${pathname}`);
-  const url = baseUrl + path;
-  const transport = http(BASE_RPC_URL);
-  const publicClient = createPublicClient({ chain: base, transport });
-  const walletClient = createWalletClient({ account, chain: base, transport });
-
-  const approveHash = await walletClient.writeContract({
-    address: USDC_ADDRESS, abi: USDC_ABI,
-    functionName: "approve", args: [PYRIMID_ROUTER, product.priceUsdc],
-  });
-  await publicClient.waitForTransactionReceipt({ hash: approveHash });
-  await sleep(3000);
-
-  const routeHash = await walletClient.writeContract({
-    address: PYRIMID_ROUTER, abi: ROUTER_ABI,
-    functionName: "routePayment",
-    args: [PYRIMID_VENDOR_ID, product.productId, "0x00000000000000000000000000000000", account.address, product.priceUsdc],
-  });
-  await publicClient.waitForTransactionReceipt({ hash: routeHash });
-  await sleep(3000);
-
-  const paidRes = await fetch(url, { headers: { "X-Affiliate-ID": affiliateId, "X-Payment": routeHash } });
-  if (!paidRes.ok) {
-    const err = await paidRes.text().catch(() => paidRes.statusText);
-    throw new Error(`Pyrimid retry failed: ${paidRes.status} ${err.slice(0, 200)}`);
-  }
-  return paidRes.json();
+// Argument validation — runs before any network call or wallet access.
+const SYMBOLS = ["BTC", "ETH", "SOL", "XRP", "ADA"];
+function str(v, name, { max = 200, pattern } = {}) {
+  if (typeof v !== "string" || v.length === 0 || v.length > max) throw new Error(`${name} must be a non-empty string of at most ${max} characters`);
+  if (pattern && !pattern.test(v)) throw new Error(`${name} has an invalid format`);
+  return v;
 }
-
-function queryString(params) {
-  const parts = Object.entries(params)
-    .filter(([, v]) => v !== undefined && v !== null && v !== "")
-    .map(([k, v]) => `${k}=${encodeURIComponent(String(v))}`);
-  return parts.length ? `?${parts.join("&")}` : "";
+function num(v, name, min, max) {
+  if (typeof v !== "number" || !Number.isFinite(v) || v < min || v > max) throw new Error(`${name} must be a number between ${min} and ${max}`);
+  return v;
 }
-
-async function callPaid(ctx, path, affiliateId, opts = {}) {
-  const { httpClient, account } = ctx;
-  const baseUrl = opts.baseUrl || BASE_URL;
-  const pyrimidProducts = opts.pyrimidProducts || PYRIMID_PRODUCTS;
-  const pathname = new URL(path, baseUrl).pathname;
-  const method = opts.method || "GET";
-  const body = opts.body;
-  const bodyHeaders = body ? { "Content-Type": "application/json" } : {};
-  const bodyInit = body ? { body: JSON.stringify(body) } : {};
-
-  // Use Pyrimid affiliate flow when affiliate_id present and product is registered.
-  // Fall back to direct x402 if the affiliate route is unavailable or not yet cataloged.
-  if (method === "GET" && affiliateId && pyrimidProducts[pathname]) {
-    try {
-      return await callPyrimid(account, path, affiliateId, baseUrl, pyrimidProducts);
-    } catch (_) {
-      affiliateId = null;
-    }
-  }
-
-  // Standard x402 EIP-3009 flow
-  const url = baseUrl + path;
-  const extraHeaders = affiliateId ? { "X-Affiliate-ID": affiliateId } : {};
-  const res = await fetch(url, { method, headers: { ...bodyHeaders, ...extraHeaders }, ...bodyInit });
-
-  if (res.status === 402) {
-    let body;
-    try { body = await res.clone().json(); } catch (_) {}
-    const paymentRequired = httpClient.getPaymentRequiredResponse(
-      (name) => res.headers.get(name), body
-    );
-    const paymentPayload = await createChainTimedPaymentPayload(httpClient, paymentRequired);
-    const paidRes = await fetch(url, {
-      method,
-      headers: { ...bodyHeaders, ...httpClient.encodePaymentSignatureHeader(paymentPayload), ...extraHeaders },
-      ...bodyInit,
-    });
-    if (!paidRes.ok) {
-      const errBody = await paidRes.text().catch(() => paidRes.statusText);
-      throw new Error(`HTTP ${paidRes.status}: ${errBody.slice(0, 200)}`);
-    }
-    const data = await paidRes.json();
-    try {
-      const settleResponse = httpClient.getPaymentSettleResponse((name) => paidRes.headers.get(name));
-      if (settleResponse && data && typeof data === "object" && !Array.isArray(data)) {
-        return { ...data, _payment: settleResponse };
-      }
-    } catch (_) {}
-    return data;
-  }
-
-  if (!res.ok) {
-    const errBody = await res.text().catch(() => res.statusText);
-    throw new Error(`HTTP ${res.status}: ${errBody.slice(0, 200)}`);
-  }
-  return res.json();
+function optNum(v, name, min, max) { return v === undefined || v === null ? undefined : num(v, name, min, max); }
+function symbol(v, dflt) {
+  if (v === undefined || v === null) return dflt;
+  const up = str(v, "symbol", { max: 10 }).toUpperCase();
+  if (!SYMBOLS.includes(up)) throw new Error(`symbol must be one of ${SYMBOLS.join(", ")}`);
+  return up;
 }
 
 async function main() {
-  let ctx;
-  function getPaymentContext() {
-    if (!ctx) ctx = buildHttpClient();
-    return ctx;
+  let httpClient;
+  function getHttpClient() {
+    if (!httpClient) httpClient = buildHttpClient();
+    return httpClient;
   }
 
   const server = new Server(
-    { name: "coinopai-mcp", version: "2.2.1" },
+    { name: "coinopai-mcp", version: require("./package.json").version },
     { capabilities: { tools: {} } }
   );
 
   server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: TOOLS }));
 
   server.setRequestHandler(CallToolRequestSchema, async (req) => {
-    const { name, arguments: args } = req.params;
+    const { name } = req.params;
+    const args = req.params.arguments || {};
     try {
-      // Affiliate ID: tool arg takes precedence, then env fallback, then none
-      const affiliateId = args.affiliate_id || process.env.PYRIMID_AFFILIATE_ID || null;
-      // list_tools is free: plain fetch, no wallet, never touches callPaid
-      const paymentContext = name === "list_tools" ? null : getPaymentContext();
       let data;
       switch (name) {
         case "list_tools": {
-          const r = await fetch(`${BASE_URL}/menu`);
+          // Free: plain bounded fetch, no wallet
+          const r = await guard.fetchBounded("/menu");
           if (!r.ok) throw new Error(`/menu returned ${r.status}`);
-          data = await r.json();
+          try { data = JSON.parse(r.text); } catch (e) { throw new Error("/menu returned non-JSON: " + e.message); }
           break;
         }
-        // Low-value utility endpoints — no affiliate routing
-        case "search_agent_automations":
-          data = await callPaid(paymentContext, `/api/search?q=${encodeURIComponent(args.query || "")}&limit=${args.limit || 20}`, null);
+        case "search_agent_automations": {
+          const query = { q: str(args.query, "query", { max: 200 }), limit: args.limit === undefined ? 20 : num(args.limit, "limit", 1, 50) };
+          data = await guard.callPaid(getHttpClient(), "/api/search", { query });
           break;
+        }
         case "get_agent_automation":
-          data = await callPaid(paymentContext, `/api/automation/${encodeURIComponent(args.slug)}`, null);
+          data = await guard.callPaid(getHttpClient(), `/api/automation/${encodeURIComponent(str(args.slug, "slug", { max: 200, pattern: /^[A-Za-z0-9._-]+$/ }))}`);
           break;
         case "list_automation_categories":
-          data = await callPaid(paymentContext, "/api/categories", null);
+          data = await guard.callPaid(getHttpClient(), "/api/categories");
           break;
         case "get_crypto_risk":
-          data = await callPaid(paymentContext, "/api/kronos/risk", affiliateId);
+          data = await guard.callPaid(getHttpClient(), "/api/kronos/risk");
           break;
-        // High-value endpoints — affiliate routing enabled
         case "get_crypto_signals":
-          data = await callPaid(paymentContext, "/api/kronos/signals", affiliateId);
+          data = await guard.callPaid(getHttpClient(), "/api/kronos/signals");
           break;
         case "get_crypto_signal_history":
-          data = await callPaid(paymentContext, `/api/kronos/history?hours=${args.hours || 24}`, affiliateId);
+          data = await guard.callPaid(getHttpClient(), "/api/kronos/history", { query: { hours: args.hours === undefined ? 24 : num(args.hours, "hours", 1, 168) } });
           break;
         case "get_crypto_decision":
-          data = await callPaid(paymentContext, `/api/kronos/decision?symbol=${encodeURIComponent(args.symbol || "BTC")}`, affiliateId);
+          data = await guard.callPaid(getHttpClient(), "/api/kronos/decision", { query: { symbol: symbol(args.symbol, "BTC") } });
           break;
         case "check_trade_preflight":
-          data = await callPaid(paymentContext, `/api/kronos/preflight?symbol=${encodeURIComponent(args.symbol || "BTC")}`, affiliateId);
+          data = await guard.callPaid(getHttpClient(), "/api/kronos/preflight", { query: { symbol: symbol(args.symbol, "BTC") } });
           break;
-        case "audit_trade_decision":
-          data = await callPaid(paymentContext, `/api/kronos/audit?decision_id=${encodeURIComponent(args.decision_id)}&window=${encodeURIComponent(args.window || "4h")}`, affiliateId);
+        case "audit_trade_decision": {
+          const decisionId = str(args.decision_id, "decision_id", { max: 64, pattern: /^[A-Za-z0-9-]+$/ });
+          const windowArg = args.window === undefined ? "4h" : args.window;
+          if (!["1h", "4h", "24h"].includes(windowArg)) throw new Error("window must be one of 1h, 4h, 24h");
+          data = await guard.callPaid(getHttpClient(), "/api/kronos/audit", { query: { decision_id: decisionId, window: windowArg } });
           break;
+        }
         case "get_crypto_forecast":
-          data = await callPaid(paymentContext, `/api/kronos/forecast?symbol=${encodeURIComponent(args.symbol || "BTC")}`, affiliateId);
+          data = await guard.callPaid(getHttpClient(), "/api/kronos/forecast", { query: { symbol: symbol(args.symbol, "BTC") } });
           break;
         case "get_futures_decision":
-          data = await callPaid(paymentContext, `/api/kronos/futures/decision${queryString({ symbol: args.symbol || "BTC", equity: args.equity, max_loss_pct: args.max_loss_pct, max_leverage: args.max_leverage })}`, null);
+          data = await guard.callPaid(getHttpClient(), "/api/kronos/futures/decision", { query: {
+            symbol: symbol(args.symbol, "BTC"),
+            equity: optNum(args.equity, "equity", 0, 1e12),
+            max_loss_pct: optNum(args.max_loss_pct, "max_loss_pct", 0, 1),
+            max_leverage: optNum(args.max_leverage, "max_leverage", 1, 5),
+          } });
           break;
         case "get_perp_funding":
-          data = await callPaid(paymentContext, `/api/kronos/futures/funding${queryString({ symbol: args.symbol })}`, null);
+          data = await guard.callPaid(getHttpClient(), "/api/kronos/futures/funding", { query: { symbol: args.symbol === undefined ? undefined : symbol(args.symbol) } });
           break;
-        case "check_futures_risk":
-          data = await callPaid(paymentContext, `/api/kronos/futures/risk${queryString({ symbol: args.symbol || "BTC", side: args.side, leverage: args.leverage, entry: args.entry, notional: args.notional, horizon_hours: args.horizon_hours })}`, null);
+        case "check_futures_risk": {
+          const side = typeof args.side === "string" ? args.side.toUpperCase() : "";
+          if (side !== "LONG" && side !== "SHORT") throw new Error("side must be LONG or SHORT");
+          data = await guard.callPaid(getHttpClient(), "/api/kronos/futures/risk", { query: {
+            symbol: symbol(args.symbol, "BTC"),
+            side,
+            leverage: num(args.leverage, "leverage", 1, 125),
+            entry: optNum(args.entry, "entry", 0, 1e12),
+            notional: optNum(args.notional, "notional", 0, 1e12),
+            horizon_hours: optNum(args.horizon_hours, "horizon_hours", 0, 1e5),
+          } });
           break;
-        case "review_signal_anomaly":
-          data = await callPaid(paymentContext, "/api/anomaly", null, {
+        }
+        case "review_signal_anomaly": {
+          if (!args.features || typeof args.features !== "object" || Array.isArray(args.features)) throw new Error("features must be an object of numeric feature values");
+          if (JSON.stringify(args.features).length > 4000) throw new Error("features is too large");
+          data = await guard.callPaid(getHttpClient(), "/api/anomaly", {
             method: "POST",
             body: {
-              symbol: args.symbol || "BTC",
-              window: args.window || "24h",
-              features: args.features || {},
+              symbol: str(args.symbol, "symbol", { max: 20, pattern: /^[A-Za-z0-9._-]+$/ }),
+              window: args.window === undefined ? "24h" : str(args.window, "window", { max: 20, pattern: /^[A-Za-z0-9]+$/ }),
+              features: args.features,
             },
           });
           break;
+        }
         default:
           throw new Error("Unknown tool: " + name);
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coinopai-mcp",
-  "version": "2.2.1",
+  "version": "2.2.2",
   "mcpName": "io.github.forgemeshlabs/coinopai-mcp",
   "description": "Auditable market intelligence MCP with x402 payments, calibrated forecast ranges, anomaly review, risk context, and outcome audits",
   "main": "index.js",
@@ -10,6 +10,7 @@
   "files": [
     "index.js",
     "ads.js",
+    "x402-guard.js",
     "README.md",
     "server.json"
   ],
@@ -24,7 +25,6 @@
     "model-context-protocol",
     "x402",
     "agent-commerce",
-    "affiliate-routing",
     "monetization",
     "forgemesh",
     "crypto",
@@ -48,7 +48,7 @@
     "url": "https://github.com/forgemeshlabs/coinopai-mcp/issues"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@modelcontextprotocol/sdk": "^1.32.1",
     "@x402/core": "2.11.0",
     "@x402/evm": "2.11.0",
     "lulu-ads": "^0.9.19",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/forgemeshlabs/coinopai-mcp",
     "source": "github"
   },
-  "version": "2.2.1",
+  "version": "2.2.2",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "coinopai-mcp",
-      "version": "2.2.1",
+      "version": "2.2.2",
       "transport": {
         "type": "stdio"
       },

package/x402-guard.js

@@ -0,0 +1,141 @@
+"use strict";
+/**
+ * x402-guard — client-side payment and HTTP guard for ForgeMesh MCP servers (vendored copy per repo).
+ *
+ *   const { createGuard } = require("./x402-guard");
+ *   const guard = createGuard({
+ *     baseUrl: "https://x402.coinopai.com",          // the ONLY origin this server talks to
+ *     payTo: ["0x1304EC1A8945365e43A5c18a734065f107B417cA"], // wallets a 402 may name
+ *     maxPriceUsd: 1.00,                               // per-call ceiling (env X402_MAX_PRICE_USD overrides, lower only)
+ *     sessionBudgetUsd: 10.00,                         // cumulative ceiling per process (env X402_SESSION_BUDGET_USD)
+ *   });
+ *   const client = new x402Client().register("eip155:*", new ExactEvmScheme(signer)).registerPolicy(guard.policy);
+ *   const data = await guard.callPaid(httpClient, "/api/route", { method: "POST", body: {...} });
+ *
+ * What it enforces, before any signature is produced:
+ *   network  = eip155:8453 (Base mainnet), asset = USDC on Base, payTo in the allowlist,
+ *   amount  <= maxPriceUsd, running total <= sessionBudgetUsd.
+ * What it enforces on every HTTP call: same origin as baseUrl, https, no redirects,
+ *   REQUEST_TIMEOUT_MS, MAX_RESPONSE_BYTES. No global monkeypatching anywhere.
+ */
+
+const BASE_MAINNET = "eip155:8453";
+const USDC_BASE = "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913";
+const REQUEST_TIMEOUT_MS = 60_000;
+const MAX_RESPONSE_BYTES = 2_000_000;
+
+function usdFromRequirement(r) {
+  const raw = r.amount ?? r.maxAmountRequired ?? r.value;
+  if (raw === undefined || raw === null) return NaN;
+  const s = String(raw);
+  if (s.startsWith("$")) return Number(s.slice(1));
+  return Number(BigInt(s)) / 1e6; // USDC atomic units
+}
+
+function lowerCap(defaultUsd, envName) {
+  const env = Number(process.env[envName]);
+  return Number.isFinite(env) && env > 0 ? Math.min(env, defaultUsd) : defaultUsd;
+}
+
+function createGuard(opts) {
+  if (!opts || !opts.baseUrl) throw new Error("x402-guard: baseUrl is required");
+  const base = new URL(opts.baseUrl);
+  if (base.protocol !== "https:") throw new Error("x402-guard: baseUrl must be https");
+  const origin = base.origin;
+  // An empty allowlist means "this server never signs payments": the policy refuses every 402 and
+  // only fetchBounded is useful. Pass payTo: [] explicitly for free-only servers.
+  if (!Array.isArray(opts.payTo)) throw new Error("x402-guard: payTo allowlist is required (use [] for a server that never signs)");
+  const payTo = new Set(opts.payTo.map((a) => String(a).toLowerCase()));
+  const maxPriceUsd = lowerCap(opts.maxPriceUsd ?? 1.0, "X402_MAX_PRICE_USD");
+  const sessionBudgetUsd = lowerCap(opts.sessionBudgetUsd ?? 10.0, "X402_SESSION_BUDGET_USD");
+  let spentUsd = 0; // reserved at signing time, never released: a signed authorization can be settled even if our retry fails
+
+  function policy(_version, requirements) {
+    if (payTo.size === 0) throw new Error("x402-guard refused to sign: this server has no payee allowlist and never signs payments");
+    const kept = requirements.filter((r) => {
+      if (r.network !== BASE_MAINNET) return false;
+      if (String(r.asset || "").toLowerCase() !== USDC_BASE) return false;
+      if (!payTo.has(String(r.payTo || "").toLowerCase())) return false;
+      const usd = usdFromRequirement(r);
+      if (!Number.isFinite(usd) || usd <= 0 || usd > maxPriceUsd) return false;
+      if (spentUsd + usd > sessionBudgetUsd) return false;
+      return true;
+    });
+    if (kept.length === 0) {
+      const seen = requirements.map((r) => `${r.network} ${r.payTo} $${usdFromRequirement(r)}`).join("; ");
+      throw new Error(`x402-guard refused to sign: no payment option passed the guard (network must be ${BASE_MAINNET}, asset USDC, payTo in allowlist, price <= $${maxPriceUsd}, session total <= $${sessionBudgetUsd}). Offered: ${seen}`);
+    }
+    // Hand the selector exactly one option so the amount we reserve is the amount that gets signed.
+    const chosen = kept.reduce((a, b) => (usdFromRequirement(b) < usdFromRequirement(a) ? b : a));
+    spentUsd += usdFromRequirement(chosen);
+    return [chosen];
+  }
+
+  async function fetchBounded(url, init = {}) {
+    const target = new URL(String(url), origin);
+    if (target.origin !== origin) throw new Error(`x402-guard: refusing request to ${target.origin}; this server only talks to ${origin}`);
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), REQUEST_TIMEOUT_MS);
+    try {
+      const res = await fetch(target.toString(), { ...init, signal: ctrl.signal, redirect: "error" });
+      const declared = Number(res.headers.get("content-length") || 0);
+      if (declared > MAX_RESPONSE_BYTES) { ctrl.abort(); throw new Error(`x402-guard: response too large (${declared} bytes)`); }
+      const chunks = [];
+      let received = 0;
+      if (res.body) {
+        const reader = res.body.getReader();
+        for (;;) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          received += value.byteLength;
+          if (received > MAX_RESPONSE_BYTES) { ctrl.abort(); throw new Error("x402-guard: response too large"); }
+          chunks.push(value);
+        }
+      }
+      const bytes = Buffer.concat(chunks);
+      return { status: res.status, ok: res.ok, headers: res.headers, bytes, text: bytes.toString("utf8") };
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+
+  function parseJson(res) {
+    try { return JSON.parse(res.text); } catch { throw new Error(`HTTP ${res.status}: non-JSON response`); }
+  }
+
+  // GET or POST a paid route: unpaid request → 402 → guarded signature → retry. Returns parsed JSON;
+  // on a paid response attaches the settlement receipt as `_payment` when the body is an object.
+  async function callPaid(httpClient, path, { method = "GET", body, query, headers = {} } = {}) {
+    const url = new URL(path, origin);
+    if (query) for (const [k, v] of Object.entries(query)) if (v !== undefined && v !== null) url.searchParams.set(k, String(v));
+    const init = { method, headers: { ...headers, ...(body ? { "content-type": "application/json" } : {}) }, ...(body ? { body: JSON.stringify(body) } : {}) };
+    const res = await fetchBounded(url, init);
+    if (res.status !== 402) {
+      if (!res.ok) throw new Error(`HTTP ${res.status}: ${res.text.slice(0, 200)}`);
+      return parseJson(res);
+    }
+    let challenge;
+    try { challenge = JSON.parse(res.text); } catch { challenge = undefined; }
+    const paymentRequired = httpClient.getPaymentRequiredResponse((n) => res.headers.get(n), challenge);
+    const payload = await httpClient.createPaymentPayload(paymentRequired); // policy runs (and reserves budget) inside
+    const paid = await fetchBounded(url, { ...init, headers: { ...init.headers, ...httpClient.encodePaymentSignatureHeader(payload) } });
+    if (!paid.ok) throw new Error(`Payment failed — HTTP ${paid.status}: ${paid.text.slice(0, 200)}`);
+    let settle = null;
+    try { settle = httpClient.getPaymentSettleResponse((n) => paid.headers.get(n)) || null; } catch { settle = null; }
+    const contentType = paid.headers.get("content-type") || "";
+    // Non-JSON paid responses (audio, images) come back as raw bytes, never decoded as text.
+    if (!contentType.includes("json")) return { _binary: true, content_type: contentType, bytes: paid.bytes, _payment: settle };
+    const data = parseJson(paid);
+    if (settle && data && typeof data === "object" && !Array.isArray(data)) return { ...data, _payment: settle };
+    return data;
+  }
+
+  return {
+    policy,
+    fetchBounded,
+    callPaid,
+    limits: () => ({ maxPriceUsd, sessionBudgetUsd, spentUsd, origin, payTo: [...payTo] }),
+  };
+}
+
+module.exports = { createGuard, REQUEST_TIMEOUT_MS, MAX_RESPONSE_BYTES, BASE_MAINNET, USDC_BASE };