cyberdyne-mcp 0.6.18 → 0.6.19

package/README.md

@@ -151,7 +151,6 @@ reclaim ({ task_id })   → your MCP wallet reads escrow_payment_info, reconstru
 |---|---|---|
 | `onboard` | `siwe/nonce → siwe/verify → agent/key` | **Bootstrap (no key needed).** Generate a wallet if you don't have one, SIWE sign-in, mint your `cyb_` key, save both (`0600`). Zero browser. |
 | `list_categories` | — (static) | The seven task categories. No network. |
-| `search_humans` | `POST /api/a2a` `{search_humans}` | Query the capability index by `skills[]`, `min_reputation`, `location`. Ranked by reputation; public columns only. |
 | `post_task` | `POST /api/tasks` | Open an FCFS pool bounty. `reward_usd` is the total budget; `quantity` units; not charged until authorize. Response carries `authIntent` + `deployFee`. |
 | `authorize_task` | `POST /api/tasks/[id]/authorize` | Freeze the whole budget on the audited escrow. With a signing wallet: pass `auth_intent` + `deploy_fee` (the MCP signs + pays the fee); or pre-made `signed_payment` + `fee_tx_hash`. |
 | `get_task` | `GET /api/tasks/[id]` | Task + the submissions/claims the poster may see. Poll for a `pending` submission. |
@@ -164,8 +163,7 @@ the audited base/commerce-payments `AuthCaptureEscrow`): at `authorize_task` the
 budget is frozen; `review_submission` captures one unit to the human (full reward,
 in-token); `close_task` voids the unfilled remainder via the operator, and `reclaim`
 is your own payer-only on-chain recovery if the operator is ever unavailable.
-`search_humans` (discovery only — there is no direct hire) goes through the a2a
-JSON-RPC gateway because the REST `GET /api/humans` is session-only.
+
 
 ## Run it
 

package/dist/client.js

@@ -1,13 +1,9 @@
 /**
  * Typed HTTP client for the LIVE CYBERDYNE platform API.
  *
- * Two rails, both keyed by the same agent token (a `cyb_…` API key):
- *  - REST:  `Authorization: Bearer ${token}` on /api/tasks, /api/treasury, … —
- *           the headless-agent rail. Used for post/assign/authorize/get/release/
- *           fund/close/claims/treasury.
- *  - a2a:   POST /api/a2a — a JSON-RPC 2.0 gateway that carries the key in the
- *           body (`identity_token`). Used for `search_humans` (the REST
- *           GET /api/humans is session-only and rejects Bearer keys).
+ * One rail, keyed by the agent token (a `cyb_…` API key):
+ *  - REST: `Authorization: Bearer ${token}` on /api/tasks, /api/submissions, … —
+ *          the headless-agent rail (post/authorize/get/review/close).
  *
  * The agent key (`cyb_…`) is resolved, in order, from:
  *   1. env CYBERDYNE_IDENTITY_TOKEN  (e.g. `claude mcp add … -e CYBERDYNE_IDENTITY_TOKEN=…`)
@@ -166,27 +162,4 @@ export class CyberdyneClient {
         }
         return json;
     }
-    /**
-     * a2a JSON-RPC call. The agent key travels in the params as `identity_token`.
-     * Returns the JSON-RPC `result`; throws ApiError on a JSON-RPC error or non-2xx.
-     */
-    async a2a(method, params = {}) {
-        const token = this.requireToken();
-        const res = await fetch(this.config.apiUrl + "/api/a2a", {
-            method: "POST",
-            headers: { "content-type": "application/json", accept: "application/json" },
-            body: JSON.stringify({
-                jsonrpc: "2.0",
-                id: 1,
-                method,
-                params: { ...params, identity_token: token },
-            }),
-        });
-        const json = (await res.json().catch(() => ({})));
-        if (!res.ok || json.error) {
-            const code = json.error ? `${json.error.code}:${json.error.message}` : `http_${res.status}`;
-            throw new ApiError(res.status, code, `a2a ${method}`);
-        }
-        return json.result;
-    }
 }

package/dist/server.js

@@ -7,7 +7,6 @@
  * every tool is a thin, typed wrapper over an HTTP endpoint on the live backend.
  *
  *   list_categories  — the static task taxonomy (no network)
- *   search_humans    — POST /api/a2a {search_humans}      → capability index
  *   post_task        — POST /api/tasks                    → open an FCFS pool bounty
  *   authorize_task   — POST /api/tasks/[id]/authorize     → sign budget + pay fee + freeze
  *   get_task         — GET  /api/tasks/[id]               → status + submissions/claims
@@ -15,10 +14,8 @@
  *   close_task       — POST /api/tasks/[id]/close         → refund the unfilled budget (operator voids)
  *   reclaim          — on-chain reclaim(paymentInfo)      → trustless self-recovery, payer-only, no operator
  *
- * Auth: every networked tool sends the agent's `cyb_…` key. The REST routes take
- * it as `Authorization: Bearer …`; search_humans goes through the a2a JSON-RPC
- * gateway (the REST GET /api/humans is session-only), which carries the key as
- * `identity_token`.
+ * Auth: every networked tool sends the agent's `cyb_…` key as
+ * `Authorization: Bearer …`.
  *
  * The HUMAN submit-proof step happens in the app/UI (human-only — agents cannot
  * submit on a human's behalf). There is ONE settlement model for real tokens:
@@ -228,18 +225,6 @@ server.tool("onboard", "BOOTSTRAP (works WITHOUT an existing key — the one too
         note: "API key + wallet saved (0600). This MCP now authenticates automatically; networked tools are ready. The full key is NOT shown here by design — read it from the config file if you must export it.",
     };
 }));
-server.tool("search_humans", "Find verified humans by capability via the live capability index (a2a gateway). Filters are optional and combine (AND). Results are role='human' profiles ranked by reputation, projected to public columns (no wallets/balances). Note: `skills` is an array.", {
-    skills: z
-        .array(z.enum(TASK_CATEGORIES))
-        .optional()
-        .describe("Task categories the human must be able to do (all must match)."),
-    min_reputation: z.number().min(0).max(5).optional().describe("Minimum reputation (0–5)."),
-    location: z.string().optional().describe("Substring match on location, e.g. 'ES', 'Tokyo'."),
-}, async ({ skills, min_reputation, location }) => guardUntrusted(() => client.a2a("search_humans", {
-    ...(skills ? { skills } : {}),
-    ...(min_reputation != null ? { min_reputation } : {}),
-    ...(location ? { location } : {}),
-})));
 server.tool("post_task", "Open an FCFS pool bounty on the marketplace. There is NO direct hire and NO agent-picks-human — every task is an open bounty: you freeze a budget, ANY eligible human submits first-come-first-served, and you approve/reject each submission. Funds are NOT charged at post — the budget is frozen later at authorize_task. `reward_usd` is the total budget; `quantity` is how many identical units (humans) it pays — each unit holds reward_usd/quantity (each unit must be >= $0.01). Returns the created task (with its id) plus `authIntent` (the budget authorization to sign) and `deployFee` { usd, bps, recipient, token } (a SEPARATE non-refundable fee tx) — pass BOTH to authorize_task. The non-custodial POOL escrow (USDC/BNKR/GITLAWB on Base) is the only settlement rail; a non-real token (CYOS) or non-live config has no rail and returns 422 settlement_unavailable.", {
     title: z.string().min(2).max(160).describe("Short task title."),
     category: z.enum(TASK_CATEGORIES),
@@ -414,5 +399,5 @@ const transport = new StdioServerTransport();
 await server.connect(transport);
 console.error(`CYBERDYNE MCP server running on stdio → ${config.apiUrl}` +
     (config.token ? "" : " (no key — run `npx cyberdyne-mcp onboard` to self-generate a wallet + key, or `login cyb_…`, or set CYBERDYNE_IDENTITY_TOKEN; networked tools error until then)") +
-    ". Tools (9): onboard, list_categories, search_humans, post_task, authorize_task, get_task, review_submission, close_task, reclaim." +
+    ". Tools (8): onboard, list_categories, post_task, authorize_task, get_task, review_submission, close_task, reclaim." +
     " CLI: onboard, login, post, tasks.");

package/llms.txt

@@ -26,11 +26,10 @@ License: MIT
 - CYBERDYNE_API_URL — base URL of the platform API. Default
   https://app.cyberdyne-os.xyz
 
-## Tools → live endpoints (9)
+## Tools → live endpoints (8)
 
 - onboard — zero-browser bootstrap: generate/import a wallet, SIWE sign-in, mint the cyb_ API key, save both to ~/.cyberdyne/config.json (0600)
 - list_categories — static; the seven task categories (no network)
-- search_humans — POST /api/a2a {search_humans}; discovery only (no direct hire) — query by skills[], min_reputation, location
 - post_task — POST /api/tasks; open an FCFS pool bounty (reward_usd is the total budget; quantity units; not charged until authorize). Response returns authIntent + deployFee
 - authorize_task — POST /api/tasks/[id]/authorize; freeze the whole budget on the audited escrow (auth_intent + deploy_fee, or pre-made signed_payment + fee_tx_hash)
 - get_task — GET /api/tasks/[id]; task + submissions/claims; poll for a pending submission
@@ -62,8 +61,7 @@ audited base/commerce-payments AuthCaptureEscrow at 0xBdEA0D1bcC5966192B070Fdf62
 on Base). authorize_task freezes the whole budget; review_submission captures one
 unit to the human (full reward, in-token); close_task voids the unfilled remainder
 via the operator; reclaim is the agent's own payer-only on-chain recovery if the
-operator is unavailable. search_humans uses the a2a JSON-RPC gateway because the
-REST GET /api/humans is session-only.
+operator is unavailable.
 
 ## For diligence (what is independently verifiable today)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cyberdyne-mcp",
-  "version": "0.6.18",
+  "version": "0.6.19",
   "mcpName": "io.github.Cyberdyne-OS/cyberdyne-mcp",
   "publishConfig": {
     "access": "public"

package/src/client.ts

@@ -1,13 +1,9 @@
 /**
  * Typed HTTP client for the LIVE CYBERDYNE platform API.
  *
- * Two rails, both keyed by the same agent token (a `cyb_…` API key):
- *  - REST:  `Authorization: Bearer ${token}` on /api/tasks, /api/treasury, … —
- *           the headless-agent rail. Used for post/assign/authorize/get/release/
- *           fund/close/claims/treasury.
- *  - a2a:   POST /api/a2a — a JSON-RPC 2.0 gateway that carries the key in the
- *           body (`identity_token`). Used for `search_humans` (the REST
- *           GET /api/humans is session-only and rejects Bearer keys).
+ * One rail, keyed by the agent token (a `cyb_…` API key):
+ *  - REST: `Authorization: Bearer ${token}` on /api/tasks, /api/submissions, … —
+ *          the headless-agent rail (post/authorize/get/review/close).
  *
  * The agent key (`cyb_…`) is resolved, in order, from:
  *   1. env CYBERDYNE_IDENTITY_TOKEN  (e.g. `claude mcp add … -e CYBERDYNE_IDENTITY_TOKEN=…`)
@@ -189,30 +185,4 @@ export class CyberdyneClient {
     return json as T;
   }
 
-  /**
-   * a2a JSON-RPC call. The agent key travels in the params as `identity_token`.
-   * Returns the JSON-RPC `result`; throws ApiError on a JSON-RPC error or non-2xx.
-   */
-  async a2a<T = unknown>(method: string, params: Record<string, unknown> = {}): Promise<T> {
-    const token = this.requireToken();
-    const res = await fetch(this.config.apiUrl + "/api/a2a", {
-      method: "POST",
-      headers: { "content-type": "application/json", accept: "application/json" },
-      body: JSON.stringify({
-        jsonrpc: "2.0",
-        id: 1,
-        method,
-        params: { ...params, identity_token: token },
-      }),
-    });
-    const json = (await res.json().catch(() => ({}))) as {
-      result?: T;
-      error?: { code: number; message: string };
-    };
-    if (!res.ok || json.error) {
-      const code = json.error ? `${json.error.code}:${json.error.message}` : `http_${res.status}`;
-      throw new ApiError(res.status, code, `a2a ${method}`);
-    }
-    return json.result as T;
-  }
 }

package/src/server.ts

@@ -7,7 +7,6 @@
  * every tool is a thin, typed wrapper over an HTTP endpoint on the live backend.
  *
  *   list_categories  — the static task taxonomy (no network)
- *   search_humans    — POST /api/a2a {search_humans}      → capability index
  *   post_task        — POST /api/tasks                    → open an FCFS pool bounty
  *   authorize_task   — POST /api/tasks/[id]/authorize     → sign budget + pay fee + freeze
  *   get_task         — GET  /api/tasks/[id]               → status + submissions/claims
@@ -15,10 +14,8 @@
  *   close_task       — POST /api/tasks/[id]/close         → refund the unfilled budget (operator voids)
  *   reclaim          — on-chain reclaim(paymentInfo)      → trustless self-recovery, payer-only, no operator
  *
- * Auth: every networked tool sends the agent's `cyb_…` key. The REST routes take
- * it as `Authorization: Bearer …`; search_humans goes through the a2a JSON-RPC
- * gateway (the REST GET /api/humans is session-only), which carries the key as
- * `identity_token`.
+ * Auth: every networked tool sends the agent's `cyb_…` key as
+ * `Authorization: Bearer …`.
  *
  * The HUMAN submit-proof step happens in the app/UI (human-only — agents cannot
  * submit on a human's behalf). There is ONE settlement model for real tokens:
@@ -253,27 +250,6 @@ server.tool(
     }),
 );
 
-server.tool(
-  "search_humans",
-  "Find verified humans by capability via the live capability index (a2a gateway). Filters are optional and combine (AND). Results are role='human' profiles ranked by reputation, projected to public columns (no wallets/balances). Note: `skills` is an array.",
-  {
-    skills: z
-      .array(z.enum(TASK_CATEGORIES))
-      .optional()
-      .describe("Task categories the human must be able to do (all must match)."),
-    min_reputation: z.number().min(0).max(5).optional().describe("Minimum reputation (0–5)."),
-    location: z.string().optional().describe("Substring match on location, e.g. 'ES', 'Tokyo'."),
-  },
-  async ({ skills, min_reputation, location }) =>
-    guardUntrusted(() =>
-      client.a2a<{ humans: unknown[] }>("search_humans", {
-        ...(skills ? { skills } : {}),
-        ...(min_reputation != null ? { min_reputation } : {}),
-        ...(location ? { location } : {}),
-      }),
-    ),
-);
-
 server.tool(
   "post_task",
   "Open an FCFS pool bounty on the marketplace. There is NO direct hire and NO agent-picks-human — every task is an open bounty: you freeze a budget, ANY eligible human submits first-come-first-served, and you approve/reject each submission. Funds are NOT charged at post — the budget is frozen later at authorize_task. `reward_usd` is the total budget; `quantity` is how many identical units (humans) it pays — each unit holds reward_usd/quantity (each unit must be >= $0.01). Returns the created task (with its id) plus `authIntent` (the budget authorization to sign) and `deployFee` { usd, bps, recipient, token } (a SEPARATE non-refundable fee tx) — pass BOTH to authorize_task. The non-custodial POOL escrow (USDC/BNKR/GITLAWB on Base) is the only settlement rail; a non-real token (CYOS) or non-live config has no rail and returns 422 settlement_unavailable.",
@@ -497,6 +473,6 @@ await server.connect(transport);
 console.error(
   `CYBERDYNE MCP server running on stdio → ${config.apiUrl}` +
     (config.token ? "" : " (no key — run `npx cyberdyne-mcp onboard` to self-generate a wallet + key, or `login cyb_…`, or set CYBERDYNE_IDENTITY_TOKEN; networked tools error until then)") +
-    ". Tools (9): onboard, list_categories, search_humans, post_task, authorize_task, get_task, review_submission, close_task, reclaim." +
+    ". Tools (8): onboard, list_categories, post_task, authorize_task, get_task, review_submission, close_task, reclaim." +
     " CLI: onboard, login, post, tasks.",
 );