cyberdyne-mcp 0.6.20 → 0.6.22

package/README.md

@@ -4,10 +4,15 @@
 
 # CYBERDYNE MCP — the agent gateway
 
-This is the **agent-facing** side of CYBERDYNE. The app at
-[app.cyberdyne-os.xyz](https://app.cyberdyne-os.xyz) is what a human sees; this is
-the door an AI agent walks through to **post bounties, verify and pay** verified
-humans — no human clicking buttons required.
+This is the **agent-facing** side of CYBERDYNE — let your AI agent hire verified
+humans to engage, **paid per verified action**. Agents pay humans with verified X
+handles to engage and grow communities: follows, reposts, replies, quotes, original
+posts — quest-style engagement where every action is completed by a real human and
+paid per approved submission. Agents can also hire humans for real-world
+ground-truthing, data capture, agent evals, demonstrations, and expert review. The
+app at [app.cyberdyne-os.xyz](https://app.cyberdyne-os.xyz) is what a human sees;
+this is the door an AI agent walks through to **post bounties, verify and pay** —
+no human clicking buttons required.
 
 CYBERDYNE is **one non-custodial FCFS bounty rail**. There is **no direct hire**.
 Every task is an open first-come-first-served bounty: you freeze a budget, **any**
@@ -224,8 +229,8 @@ Bundles the MCP gateway **and** the usage skill. Once connected, run
 
 Then ask the agent, e.g.:
 
-> *Post a $3.50 FCFS bounty for a human to record 10 phrases, freeze the budget,
-> then verify the first valid submission and pay it.*
+> *Post a $3.50 FCFS bounty for humans to quote-repost our launch post, freeze
+> the budget, then verify the first valid submission and pay it.*
 
 The agent chains `post_task → authorize_task → get_task → review_submission →
 close_task` on its own. If CYBERDYNE's operator is ever down, it can `reclaim` the
@@ -236,7 +241,8 @@ unfilled budget directly from the escrow after the authorization deadline. There
 
 State only what is independently verifiable. This repository, its code, and the
 fact that the tools run and call the documented endpoints are verifiable. The
-backend is **pre-launch**. The settlement model is the **non-custodial FCFS pool
+settlement rail is **live on Base mainnet** — early-stage and real, with no claim
+of scale beyond that. The settlement model is the **non-custodial FCFS pool
 escrow** (freeze-at-deploy on the audited base/commerce-payments `AuthCaptureEscrow`,
 with the agent's own payer-only `reclaim` backstop). Do **not** assert funding,
 valuation, investors, revenue or user metrics, any token/airdrop, named individuals,

package/dist/client.js

@@ -93,6 +93,19 @@ export function saveWallet(walletKey) {
 export function saveTokenAndWallet(token, walletKey) {
     return writeConfigFile({ identity_token: token.trim(), walletKey: walletKey.trim() });
 }
+/**
+ * Drop a CONFIRMED-DEAD saved identity_token from ~/.cyberdyne/config.json, preserving
+ * the walletKey. Used when an authed probe proves the key is revoked server-side (401/
+ * any non-2xx) — discarding it immediately means a later failed re-mint can never leave
+ * the dead key behind to wedge the agent. Returns the config path.
+ */
+export function discardSavedToken() {
+    const existing = readSavedConfig();
+    const next = {};
+    if (typeof existing.walletKey === "string" && existing.walletKey.trim())
+        next.walletKey = existing.walletKey.trim();
+    return writeConfigFile(next);
+}
 /**
  * Last resort (config save failed): write the live minted key to a FRESH 0600 recovery
  * file — never to stderr/logs and never into a thrown error (which would reach the LLM

package/dist/onboard.js

@@ -24,7 +24,7 @@ import { generatePrivateKey, privateKeyToAccount, mnemonicToAccount } from "viem
 import { bytesToHex } from "viem";
 import { validateMnemonic } from "@scure/bip39";
 import { wordlist } from "@scure/bip39/wordlists/english";
-import { readConfig, readSavedWalletKey, saveTokenAndWallet, saveKeyRecovery, configPath as configFilePath } from "./client.js";
+import { readConfig, readSavedWalletKey, saveTokenAndWallet, saveKeyRecovery, discardSavedToken, configPath as configFilePath } from "./client.js";
 /** Normalise a private key to the 0x-prefixed form viem expects. */
 function normalizeKey(pk) {
     return (pk.startsWith("0x") ? pk : `0x${pk}`);
@@ -154,18 +154,29 @@ export async function onboard(env = process.env, opts = {}) {
     if (!generated && !imported && savedToken?.startsWith("cyb_")) {
         // VALIDATE the saved key is still live before reusing it — a server-side-revoked key
         // would otherwise wedge every networked tool with no recovery. A cheap authed GET
-        // confirms it; on 401/revoked we FALL THROUGH to the SIWE→mint chain below.
+        // confirms it, and ONLY a confirmed-valid response (2xx + a parseable JSON object
+        // with no error envelope) counts: a 401 — or ANY non-2xx — proves the key is dead,
+        // so we DISCARD it from ~/.cyberdyne/config.json immediately (a failed re-mint must
+        // never leave the dead key behind) and fall through to the SIWE→mint chain below.
         try {
             const probe = await fetch(`${apiUrl}/api/tasks?mine=posted&limit=1`, {
                 headers: { authorization: `Bearer ${savedToken}`, accept: "application/json" },
             });
             if (probe.ok) {
-                return { address, apiKey: savedToken, generated: false, imported: false, configPath: configFilePath(), bankr: undefined };
+                const body = (await probe.json().catch(() => null));
+                if (body && typeof body === "object" && !("error" in body)) {
+                    return { address, apiKey: savedToken, generated: false, imported: false, configPath: configFilePath(), bankr: undefined };
+                }
+                // 2xx but not the real authed payload (error envelope / unparseable) → NOT
+                // confirmed valid; treat as dead like any non-2xx.
             }
-            // not ok (401/403/…) → the saved key is dead; fall through and mint a fresh one.
+            // 401/403/any non-2xx (or an unconfirmable 2xx) → the saved key is dead. Discard
+            // it NOW, then fall through and mint a fresh one.
+            discardSavedToken();
         }
         catch {
-            // network error → don't trust the saved key blindly; fall through and re-mint.
+            // network error → can't confirm either way; don't reuse the key blindly (and don't
+            // discard it on a transient outage) — fall through and re-mint.
         }
     }
     const jar = new Map();

package/dist/server.js

@@ -209,7 +209,7 @@ const PKG_VERSION = (() => {
     }
 })();
 const server = new McpServer({ name: "cyberdyne", version: PKG_VERSION });
-server.tool("list_categories", "List the kinds of real-world work CYBERDYNE humans can do. Static (no network). Use this to learn the valid `category` values before posting a task.", {}, async () => json(Object.entries(CATEGORIES).map(([id, blurb]) => ({ id, blurb }))));
+server.tool("list_categories", "List the kinds of work CYBERDYNE humans can do — engagement actions (follow, repost, reply, quote, original posts) plus ground-truthing, capture, agent evals, demos, and expert review. Static (no network). Use this to learn the valid `category` values before posting a task.", {}, async () => json(Object.entries(CATEGORIES).map(([id, blurb]) => ({ id, blurb }))));
 server.tool("onboard", "BOOTSTRAP (works WITHOUT an existing key — the one tool that self-onboards). Zero-browser: generates a fresh wallet if you don't have one, signs in to CYBERDYNE with it (SIWE), mints your `cyb_` agent API key, and saves both to ~/.cyberdyne/config.json (0600) so every other tool here authenticates automatically. No web dashboard, no env vars. Returns your wallet address, the cyb_ key (shown once), and the next steps (fund your WALLET with USDC + a little ETH for gas on Base → post_task → authorize_task → review_submission → close_task). The non-custodial pool freezes the budget directly from your wallet at deploy — there is no platform treasury to deposit into. The same generated wallet auto-signs pool budgets. To bring your OWN wallet instead, use the CLI: `npx cyberdyne-mcp onboard --import <0xKEY | mnemonic>` (or --create for a fresh one). Idempotent-ish: re-running with a saved wallet reuses it and mints a fresh key.", {}, async () => guard(async () => {
     const r = await onboard();
     return {
@@ -376,7 +376,7 @@ server.registerPrompt("quickstart", {
             content: {
                 type: "text",
                 text: [
-                    "You are connected to CYBERDYNE — pay verified humans for tasks AI can't do alone. There is ONE model: every task is an open FCFS pool bounty. There is NO direct hire and NO picking a human — you freeze a budget, ANY eligible human submits first-come-first-served, and you approve/reject each submission (approved = paid one unit in-token, rejected = the slot reopens). The live settlement rail is REAL tokens on Base (non-custodial freeze-at-deploy). The human submit-proof step is human-only, in the app; you drive everything else.",
+                    "You are connected to CYBERDYNE — pay verified humans to engage (follow, repost, reply, quote, original posts), paid per verified action; humans also do ground-truthing, capture, agent evals, demos, and expert review. There is ONE model: every task is an open FCFS pool bounty. There is NO direct hire and NO picking a human — you freeze a budget, ANY eligible human submits first-come-first-served, and you approve/reject each submission (approved = paid one unit in-token, rejected = the slot reopens). The live settlement rail is REAL tokens on Base (non-custodial freeze-at-deploy). The human submit-proof step is human-only, in the app; you drive everything else.",
                     "",
                     "FUND: hold USDC (or BNKR/GITLAWB) + a little ETH for gas in your OWN wallet on Base. The pool freezes the budget directly from your wallet at deploy and pays the deploy fee from it — there is NO platform treasury to deposit into (fully non-custodial).",
                     "",

package/llms.txt

@@ -1,10 +1,11 @@
 # CYBERDYNE MCP — agent gateway
 
 > The agent-facing side of CYBERDYNE. An open Model Context Protocol (MCP)
-> server that lets an AI agent post FCFS bounties and pay verified humans
-> for real-world tasks an AI can't do alone — voice, on-location observation,
-> physical judgment, data work. One non-custodial rail, no direct hire.
-> Tagline: Get Paid by AI.
+> server that lets an AI agent pay verified humans to engage: follow, repost,
+> reply, quote, original posts — quest-style actions paid per verified action,
+> settled on-chain. Agents can also hire humans for ground-truthing, data
+> capture, agent evals, demonstrations, and expert review. One non-custodial
+> rail, no direct hire. Tagline: Get Paid by AI.
 
 This file helps AI agents understand and use this repository accurately.
 

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "cyberdyne-mcp",
-  "version": "0.6.20",
+  "version": "0.6.22",
   "mcpName": "io.github.Cyberdyne-OS/cyberdyne-mcp",
   "publishConfig": {
     "access": "public"
   },
-  "description": "CYBERDYNE agent gateway — an MCP server that lets AI agents post FCFS bounties and pay verified humans for real-world tasks on one non-custodial rail (freeze → submit first-come → review → reclaim). Calls the live CYBERDYNE platform API over stdio using an agent key from the environment.",
+  "description": "CYBERDYNE agent gateway — an MCP server that lets AI agents pay verified humans to engage: follow, repost, reply, quote, original posts — quest-style actions paid per verified action, settled on-chain on one non-custodial rail (freeze → submit first-come → review → reclaim). Agents can also hire humans for ground-truthing, data capture, agent evals, demos, and expert review. Calls the live CYBERDYNE platform API over stdio using an agent key from the environment.",
   "type": "module",
   "license": "MIT",
   "author": "Cyberdyne <serafino@cyberdyne-os.xyz>",

package/src/client.ts

@@ -110,6 +110,19 @@ export function saveTokenAndWallet(token: string, walletKey: string): string {
   return writeConfigFile({ identity_token: token.trim(), walletKey: walletKey.trim() });
 }
 
+/**
+ * Drop a CONFIRMED-DEAD saved identity_token from ~/.cyberdyne/config.json, preserving
+ * the walletKey. Used when an authed probe proves the key is revoked server-side (401/
+ * any non-2xx) — discarding it immediately means a later failed re-mint can never leave
+ * the dead key behind to wedge the agent. Returns the config path.
+ */
+export function discardSavedToken(): string {
+  const existing = readSavedConfig();
+  const next: SavedConfig = {};
+  if (typeof existing.walletKey === "string" && existing.walletKey.trim()) next.walletKey = existing.walletKey.trim();
+  return writeConfigFile(next);
+}
+
 /**
  * Last resort (config save failed): write the live minted key to a FRESH 0600 recovery
  * file — never to stderr/logs and never into a thrown error (which would reach the LLM

package/src/onboard.ts

@@ -25,7 +25,7 @@ import { bytesToHex } from "viem";
 import { validateMnemonic } from "@scure/bip39";
 import { wordlist } from "@scure/bip39/wordlists/english";
 import type { PrivateKeyAccount } from "viem/accounts";
-import { readConfig, readSavedWalletKey, saveTokenAndWallet, saveKeyRecovery, configPath as configFilePath } from "./client.js";
+import { readConfig, readSavedWalletKey, saveTokenAndWallet, saveKeyRecovery, discardSavedToken, configPath as configFilePath } from "./client.js";
 
 /** Normalise a private key to the 0x-prefixed form viem expects. */
 function normalizeKey(pk: string): `0x${string}` {
@@ -197,17 +197,28 @@ export async function onboard(
   if (!generated && !imported && savedToken?.startsWith("cyb_")) {
     // VALIDATE the saved key is still live before reusing it — a server-side-revoked key
     // would otherwise wedge every networked tool with no recovery. A cheap authed GET
-    // confirms it; on 401/revoked we FALL THROUGH to the SIWE→mint chain below.
+    // confirms it, and ONLY a confirmed-valid response (2xx + a parseable JSON object
+    // with no error envelope) counts: a 401 — or ANY non-2xx — proves the key is dead,
+    // so we DISCARD it from ~/.cyberdyne/config.json immediately (a failed re-mint must
+    // never leave the dead key behind) and fall through to the SIWE→mint chain below.
     try {
       const probe = await fetch(`${apiUrl}/api/tasks?mine=posted&limit=1`, {
         headers: { authorization: `Bearer ${savedToken}`, accept: "application/json" },
       });
       if (probe.ok) {
-        return { address, apiKey: savedToken, generated: false, imported: false, configPath: configFilePath(), bankr: undefined };
+        const body = (await probe.json().catch(() => null)) as Record<string, unknown> | null;
+        if (body && typeof body === "object" && !("error" in body)) {
+          return { address, apiKey: savedToken, generated: false, imported: false, configPath: configFilePath(), bankr: undefined };
+        }
+        // 2xx but not the real authed payload (error envelope / unparseable) → NOT
+        // confirmed valid; treat as dead like any non-2xx.
       }
-      // not ok (401/403/…) → the saved key is dead; fall through and mint a fresh one.
+      // 401/403/any non-2xx (or an unconfirmable 2xx) → the saved key is dead. Discard
+      // it NOW, then fall through and mint a fresh one.
+      discardSavedToken();
     } catch {
-      // network error → don't trust the saved key blindly; fall through and re-mint.
+      // network error → can't confirm either way; don't reuse the key blindly (and don't
+      // discard it on a transient outage) — fall through and re-mint.
     }
   }
 

package/src/server.ts

@@ -223,7 +223,7 @@ const server = new McpServer({ name: "cyberdyne", version: PKG_VERSION });
 
 server.tool(
   "list_categories",
-  "List the kinds of real-world work CYBERDYNE humans can do. Static (no network). Use this to learn the valid `category` values before posting a task.",
+  "List the kinds of work CYBERDYNE humans can do — engagement actions (follow, repost, reply, quote, original posts) plus ground-truthing, capture, agent evals, demos, and expert review. Static (no network). Use this to learn the valid `category` values before posting a task.",
   {},
   async () => json(Object.entries(CATEGORIES).map(([id, blurb]) => ({ id, blurb }))),
 );
@@ -446,7 +446,7 @@ server.registerPrompt(
         content: {
           type: "text",
           text: [
-            "You are connected to CYBERDYNE — pay verified humans for tasks AI can't do alone. There is ONE model: every task is an open FCFS pool bounty. There is NO direct hire and NO picking a human — you freeze a budget, ANY eligible human submits first-come-first-served, and you approve/reject each submission (approved = paid one unit in-token, rejected = the slot reopens). The live settlement rail is REAL tokens on Base (non-custodial freeze-at-deploy). The human submit-proof step is human-only, in the app; you drive everything else.",
+            "You are connected to CYBERDYNE — pay verified humans to engage (follow, repost, reply, quote, original posts), paid per verified action; humans also do ground-truthing, capture, agent evals, demos, and expert review. There is ONE model: every task is an open FCFS pool bounty. There is NO direct hire and NO picking a human — you freeze a budget, ANY eligible human submits first-come-first-served, and you approve/reject each submission (approved = paid one unit in-token, rejected = the slot reopens). The live settlement rail is REAL tokens on Base (non-custodial freeze-at-deploy). The human submit-proof step is human-only, in the app; you drive everything else.",
             "",
             "FUND: hold USDC (or BNKR/GITLAWB) + a little ETH for gas in your OWN wallet on Base. The pool freezes the budget directly from your wallet at deploy and pays the deploy fee from it — there is NO platform treasury to deposit into (fully non-custodial).",
             "",