cyberdyne-mcp 0.6.24 → 0.7.0

package/README.md

@@ -2,6 +2,17 @@
   <img src="https://raw.githubusercontent.com/Cyberdyne-OS/cyberdyne-mcp/main/assets/logo.png" alt="CYBERDYNE" width="280" />
 </p>
 
+<p align="center">
+  <a href="https://www.npmjs.com/package/cyberdyne-mcp"><img src="https://img.shields.io/npm/v/cyberdyne-mcp?color=131313&label=npm" alt="npm version" /></a>
+  <a href="https://github.com/Cyberdyne-OS/cyberdyne-mcp/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-MIT-131313" alt="License: MIT" /></a>
+  <a href="https://registry.modelcontextprotocol.io"><img src="https://img.shields.io/badge/MCP%20Registry-listed-131313" alt="MCP Registry" /></a>
+  <a href="https://app.cyberdyne-os.xyz"><img src="https://img.shields.io/badge/Base-mainnet-131313" alt="Live on Base mainnet" /></a>
+</p>
+
+<p align="center">
+  <b>Pay anyone, in any Bankr token, from any agent.</b>
+</p>
+
 # CYBERDYNE MCP — the agent gateway
 
 CYBERDYNE is the engagement marketplace for the agent economy, native to the
@@ -100,7 +111,9 @@ npx -y cyberdyne-mcp tasks                          # list your posted tasks + s
 
 | Command | Usage | What it does |
 |---|---|---|
-| `post` | `cyberdyne-mcp post --title <t> --reward <n> [--token USDC\|BNKR\|GITLAWB] [--quantity <n>] [--category <c>] [--action follow\|retweet\|reply\|quote\|original-post] [--url <x.com/…>]` | Like `bankr launch`. Opens a task. On the **pool** rail (default for BNKR/GITLAWB or `--quantity>1`) it autonomously signs the budget, pays the deploy fee from your wallet, and authorizes — printing each stage and the final task id + `escrow_status`. |
+| `post` | `cyberdyne-mcp post --title <t> --reward <n> [--token USDC\|BNKR\|GITLAWB] [--quantity <n>] [--category <c>] [--action follow\|retweet\|reply\|quote\|original-post] [--url <x.com/…>] [--bankr-wallet]` | Like `bankr launch`. Opens a task. On the **pool** rail (default for BNKR/GITLAWB or `--quantity>1`) it autonomously signs the budget, pays the deploy fee, and authorizes — printing each stage and the final task id + `escrow_status`. Add `--bankr-wallet` to fund from your Bankr custodial wallet (no key export). |
+| `launch-and-fund` | `cyberdyne-mcp launch-and-fund --token <0x…> --title <t> --reward <n> [--quantity <n>]` | Fund an engagement quest **in your own Bankr-launched token**, paid to verified humans (funds from your Bankr wallet by default). CYBERDYNE never launches a token — launch yours on Bankr first, then fund quests in it. |
+| `bankr-login` | `cyberdyne-mcp bankr-login [--private-key <0x…>] [--partner-key <k>]` | Headless SIWE → mint a Bankr `bk_` key with your wallet (zero-browser, no email OTP). Printed once; set it as `CYBERDYNE_BANKR_KEY`. Wallet API on by default; Agent API may need enabling at bankr.bot/api. |
 | `tasks` | `cyberdyne-mcp tasks` | Lists your own posted tasks: id, title, token, quantity, filled/remaining, status. |
 
 Flags accept both `--flag value` and `--flag=value`. `--title` and `--reward` (per
@@ -120,6 +133,7 @@ stdio MCP servers take their credentials from the environment. Set:
 |---|---|---|---|
 | `CYBERDYNE_IDENTITY_TOKEN` | yes (for any networked tool) | — | The agent's API key (`cyb_…`). |
 | `CYBERDYNE_API_URL` | no | `https://app.cyberdyne-os.xyz` | Base URL of the platform API. |
+| `CYBERDYNE_BANKR_KEY` | no | — | A `bk_…` Bankr Agent-API key. Enables `post --bankr-wallet` / `launch-and-fund` to fund from your Bankr custodial wallet. Falls back to `BANKR_API_KEY` / `~/.bankr/config.json`. Used against api.bankr.bot; never stored by CYBERDYNE. |
 
 No key is hardcoded anywhere. `list_categories` and `onboard` work without a token
 (`onboard` mints one); every other tool returns a clear error until a key is set —
@@ -227,6 +241,67 @@ claude mcp add cyberdyne -- npx -y cyberdyne-mcp
 `claude mcp add cyberdyne -e CYBERDYNE_IDENTITY_TOKEN=cyb_… -- npx -y cyberdyne-mcp`.
 Or skip the CLI entirely and call the `onboard` tool from inside the agent.)*
 
+### Works with any MCP agent
+
+`cyberdyne-mcp` is a standard stdio MCP server, so it drops into any MCP-capable
+agent. Same server, same tools, any client:
+
+| Agent / client | Install one-liner or config |
+|---|---|
+| **Claude Code** | `claude mcp add cyberdyne -- npx -y cyberdyne-mcp` |
+| **OpenClaw** | `openclaw mcp add cyberdyne -- npx -y cyberdyne-mcp` |
+| **OpenClaude** | Add the JSON config block below to its `mcpServers`. |
+| **Cursor** | Add the JSON config block below to `~/.cursor/mcp.json`. |
+| **Cline** | Add the JSON config block below to its MCP settings. |
+| **Any MCP client** | Run `npx -y cyberdyne-mcp` over stdio, or add the JSON config block below. |
+
+```json
+{
+  "mcpServers": {
+    "cyberdyne": {
+      "command": "npx",
+      "args": ["-y", "cyberdyne-mcp"],
+      "env": { "CYBERDYNE_IDENTITY_TOKEN": "cyb_YOURKEY" }
+    }
+  }
+}
+```
+
+Mint the key first with `npx -y cyberdyne-mcp onboard` (or the `onboard` tool). Same
+server, same tools, any agent — your agent can now hire and pay verified humans.
+
+### Fund quests in your OWN Bankr token
+
+Quests aren't limited to USDC or BNKR. `pay_token` accepts **any registered
+Bankr-launched token** — pass it by `0x` contract address and the dynamic registry
+resolves on-chain decimals, runs a fee-on-transfer probe, and applies a safety gate:
+
+```bash
+npx -y cyberdyne-mcp post --title "Quote-repost our launch" --token 0xYourBankrToken --reward 100 --quantity 5
+```
+
+The budget is frozen on the audited escrow at deploy in your token, and each approved
+human captures the full reward in that same token. Pay your own community, in your own
+coin, straight from your agent.
+
+### Use with the full Bankr stack
+
+CYBERDYNE is native to the Bankr ecosystem and consumes it where it helps — the core
+(non-custodial escrow + auth-capture signing) stays in CYBERDYNE; Bankr is a convenience
++ distribution layer around it:
+
+| Capability | How | Status |
+|---|---|---|
+| **Pay in any Bankr token** | `--token USDC\|BNKR\|0x…` — humans paid in-token from the audited escrow | **live** |
+| **Fund from your Bankr wallet** | `post --bankr-wallet` — deploy fee via `/wallet/transfer`, escrow auth via `/wallet/sign` (`eth_signTypedData_v4`), no key export | BETA¹ |
+| **Headless Bankr key** | `bankr-login` — SIWE mint a `bk_` with your wallet (no browser/OTP) | built |
+| **Discoverable by Bankr agents** | an x402 "front door" published to Bankr's x402 Cloud discovery index | platform-side |
+| **LLM proof-grading on Bankr** | submission grading routes through the Bankr LLM gateway (Anthropic-compatible, Anthropic fallback) | platform-side |
+
+¹ USDC (EIP-3009) funds custodially with no allowance; ecosystem tokens (BNKR/GITLAWB/
+Permit2) also need a one-time ERC-20→Permit2 approval from the Bankr wallet first. BETA:
+the local-wallet path (`post` without `--bankr-wallet`) is the certified default.
+
 ### …or install the plugin (skill + MCP together)
 
 ```
@@ -247,6 +322,12 @@ close_task` on its own. If CYBERDYNE's operator is ever down, it can `reclaim` t
 unfilled budget directly from the escrow after the authorization deadline. There is
 **no direct hire** — every task is an open FCFS pool bounty.
 
+## Star History
+
+<a href="https://star-history.com/#Cyberdyne-OS/cyberdyne-mcp&Date">
+  <img src="https://api.star-history.com/svg?repos=Cyberdyne-OS/cyberdyne-mcp&type=Date" alt="Star History Chart" width="600" />
+</a>
+
 ## Honesty / accuracy
 
 State only what is independently verifiable. This repository, its code, and the

package/dist/bankr-signer.js

@@ -0,0 +1,142 @@
+/**
+ * BETA — Bankr-wallet-native funding for CYBERDYNE (no private-key export).
+ *
+ * Lets an agent fund a quest entirely from its Bankr-managed (Privy) custodial wallet:
+ *   - the deploy fee  → POST /wallet/transfer (a plain ERC-20 send)
+ *   - the auth-capture authorization → signed via POST /wallet/sign (eth_signTypedData_v4)
+ *
+ * The auth-capture TYPED DATA is built by the SAME audited @x402/evm AuthCaptureEvmScheme
+ * the local path uses (src/evm-signer.ts) — we only swap the SIGNER: a viem custom account
+ * whose signTypedData/signMessage forward to Bankr's custodial signer. So the payload shape
+ * is identical to the certified local path; only the signature source differs.
+ *
+ * STATUS: this path requires a valid bk_ key with Bankr Agent API access and has NOT yet
+ * been certified end-to-end on mainnet (the proven default remains the local-wallet path in
+ * evm-signer.ts). It is opt-in only (`post --bankr-wallet` / CYBERDYNE_SIGNER=bankr).
+ *
+ * Permit2-method tokens (BNKR/GITLAWB/non-EIP-3009) need a one-time ERC-20→Permit2 approval
+ * sent from the wallet before the budget can freeze. Sending that approval from a custodial
+ * Bankr wallet is not automated here, so we READ the allowance first and fail with a clear,
+ * actionable error if it's missing — rather than producing a signature that would revert at
+ * authorize. EIP-3009 tokens (USDC) need no approval and work directly.
+ */
+import { createPublicClient, getAddress, http, isAddress } from "viem";
+import { toAccount } from "viem/accounts";
+import { base, baseSepolia } from "viem/chains";
+import { AuthCaptureEvmScheme, toClientEvmSigner } from "@x402/evm";
+import { bankrSignTypedData, bankrSignMessage, bankrTransfer, bankrWalletAddress, resolveBankrKey, MissingBankrKeyError } from "./bankr.js";
+function chain() {
+    return Number(process.env.CYBERDYNE_CHAIN_ID ?? 8453) === 8453 ? base : baseSepolia;
+}
+const PERMIT2_ADDRESS = "0x000000000022D473030F116dDEE9F6B43aC78BA3";
+const ERC20_ALLOWANCE_ABI = [
+    { name: "allowance", type: "function", stateMutability: "view", inputs: [{ name: "owner", type: "address" }, { name: "spender", type: "address" }], outputs: [{ type: "uint256" }] },
+];
+/** True when a bk_ key is discoverable (so callers can offer the Bankr-wallet path). */
+export function hasBankrSigner() {
+    return !!resolveBankrKey();
+}
+/**
+ * A viem custom account backed by the Bankr custodial wallet. Its address is the
+ * canonical Bankr EVM wallet; its signTypedData/signMessage call POST /wallet/sign.
+ * signTransaction is unsupported (the custodial wallet broadcasts via /wallet/transfer
+ * | /wallet/submit, not via a locally-serialized signed tx).
+ */
+export async function bankrAccount(key) {
+    const bk = key ?? resolveBankrKey();
+    if (!bk)
+        throw new MissingBankrKeyError();
+    const address = getAddress(await bankrWalletAddress(bk));
+    return toAccount({
+        address,
+        // viem passes the full EIP-712 definition { domain, types, primaryType, message };
+        // we forward it verbatim to Bankr's eth_signTypedData_v4 signer (correct shape).
+        async signTypedData(typedData) {
+            return bankrSignTypedData(typedData, bk);
+        },
+        async signMessage({ message }) {
+            const text = typeof message === "string"
+                ? message
+                : typeof message?.raw === "string"
+                    ? (message.raw)
+                    : JSON.stringify(message);
+            return bankrSignMessage(text, bk);
+        },
+        async signTransaction() {
+            throw new Error("the Bankr custodial wallet does not export raw signed transactions — use /wallet/transfer (fees) or /wallet/submit");
+        },
+    });
+}
+/** The agent's Bankr wallet address (the on-chain payer the platform will verify). */
+export async function bankrSignerAddress(key) {
+    return bankrWalletAddress(key);
+}
+/**
+ * Guard Permit2-method tokens: the on-chain freeze needs an ERC-20→Permit2 allowance
+ * the signature alone can't set. Read it; if insufficient, fail with a clear next step
+ * instead of producing a payload that would revert at authorize.
+ */
+async function assertPermit2Ready(requirements, owner) {
+    const r = (requirements ?? {});
+    if (r.extra?.assetTransferMethod !== "permit2")
+        return; // USDC/EIP-3009: nothing to approve
+    const token = r.asset;
+    if (!token || !isAddress(token))
+        return;
+    const need = (() => { try {
+        return BigInt(r.amount ?? 0);
+    }
+    catch {
+        return 0n;
+    } })();
+    const pub = createPublicClient({ chain: chain(), transport: http(process.env.CYBERDYNE_RPC_URL) });
+    if (need === 0n)
+        return; // nothing to freeze → no approval needed
+    const allowance = (await pub.readContract({
+        address: getAddress(token), abi: ERC20_ALLOWANCE_ABI, functionName: "allowance", args: [getAddress(owner), PERMIT2_ADDRESS],
+    }));
+    if (allowance >= need)
+        return;
+    throw new Error(`Bankr-wallet funding for this Permit2 token (${token}) needs a one-time ERC-20→Permit2 approval ` +
+        `from your Bankr wallet (${owner}) that isn't in place yet. Approve Permit2 (spender ` +
+        `${PERMIT2_ADDRESS}) from the Bankr wallet first, or fund this token from a local wallet. ` +
+        "USDC (EIP-3009) needs no approval and works directly.");
+}
+/**
+ * Sign the auth-capture requirements with the Bankr custodial wallet → base64 payload
+ * the platform's /authorize route consumes as `signedPayment`. Same scheme + payload
+ * shape as the local path; only the signer is Bankr.
+ */
+export async function bankrSignAuthCapture(requirements, key) {
+    const bk = key ?? resolveBankrKey();
+    if (!bk)
+        throw new MissingBankrKeyError();
+    const account = await bankrAccount(bk);
+    await assertPermit2Ready(requirements, account.address);
+    const pub = createPublicClient({ chain: chain(), transport: http(process.env.CYBERDYNE_RPC_URL) });
+    const scheme = new AuthCaptureEvmScheme(toClientEvmSigner(account, pub));
+    const result = await scheme.createPaymentPayload(2, requirements);
+    return Buffer.from(JSON.stringify(result)).toString("base64");
+}
+/**
+ * Pay the SEPARATE deploy fee from the Bankr custodial wallet via /wallet/transfer.
+ * `amount` is the fee in the FEE TOKEN's own (human-readable) units, as post_task pins it
+ * (Bankr resolves on-chain decimals server-side from the token address). Returns the tx
+ * hash to pass to authorize as `fee_tx_hash`.
+ *
+ * Like the local payDeployFee, we WAIT for on-chain inclusion (2 confs) + a success status
+ * before returning: authorize runs immediately after and the platform's verifyFeePayment
+ * reads the tx on-chain, so returning an un-mined hash would make authorize fail spuriously.
+ */
+export async function bankrPayDeployFee(fee, key) {
+    if (!isAddress(fee.token) || !isAddress(fee.recipient)) {
+        throw new Error("deploy_fee.token/recipient is not a valid address — pass the full deployFee object from post_task");
+    }
+    const hash = await bankrTransfer({ tokenAddress: getAddress(fee.token), recipientAddress: getAddress(fee.recipient), amount: fee.amount, isNativeToken: false, chain: "base" }, key);
+    const pub = createPublicClient({ chain: chain(), transport: http(process.env.CYBERDYNE_RPC_URL) });
+    const receipt = await pub.waitForTransactionReceipt({ hash: hash, confirmations: 2 });
+    if (receipt.status !== "success") {
+        throw new Error(`Bankr deploy-fee tx ${hash} reverted on-chain — fee NOT paid (no budget will freeze)`);
+    }
+    return hash;
+}

package/dist/bankr.js

@@ -0,0 +1,261 @@
+/**
+ * Thin, typed client for the LIVE Bankr Agent API (https://api.bankr.bot).
+ *
+ * This is how CYBERDYNE consumes the Bankr stack so an agent can act through its
+ * Bankr-managed (Privy) custodial wallet WITHOUT exporting a private key:
+ *   - GET  /wallet/me                  → the agent's canonical Bankr wallet address
+ *   - POST /wallet/transfer            → send an ERC-20 (e.g. the deploy fee) → txHash
+ *   - POST /wallet/sign                → custodial EIP-712 / personal_sign → signature
+ *   - GET  /_health                    → API-key liveness
+ *   - GET  /tokens/search?query=       → resolve a symbol ↔ address (public)
+ *
+ * Endpoint shapes verified against the published `@bankr/cli` (0.3.1) source. Auth is
+ * the `bk_…` Agent API key in the `X-API-Key` header (Bankr Club / Agent API access
+ * required — a key without it returns 401 on /wallet/*). NOTHING here is x402-specific:
+ * CYBERDYNE's own auth-capture signing stays in src/evm-signer.ts (@x402/evm) — this
+ * module only forwards a typed-data struct to Bankr's signer and returns the signature.
+ *
+ * The bk_ key is read fresh from the env / ~/.bankr each call and is NEVER persisted by
+ * CYBERDYNE and NEVER logged.
+ */
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { readSavedWalletKey } from "./client.js";
+export const BANKR_API_URL = "https://api.bankr.bot";
+/**
+ * Resolve the agent's Bankr `bk_` key, most-explicit first:
+ *   CYBERDYNE_BANKR_KEY → BANKR_API_KEY (Bankr's own standard env var) →
+ *   any bk_-prefixed value in ~/.bankr/config.json (the file Bankr's CLI/SDK use).
+ * Returns undefined when Bankr isn't configured (callers then skip Bankr cleanly).
+ */
+export function resolveBankrKey(env = process.env) {
+    const fromEnv = env.CYBERDYNE_BANKR_KEY?.trim() || env.BANKR_API_KEY?.trim();
+    if (fromEnv?.startsWith("bk_"))
+        return fromEnv;
+    try {
+        const cfg = JSON.parse(readFileSync(join(homedir(), ".bankr", "config.json"), "utf8"));
+        for (const v of Object.values(cfg)) {
+            if (typeof v === "string" && v.startsWith("bk_"))
+                return v.trim();
+        }
+    }
+    catch {
+        /* no ~/.bankr/config.json — Bankr just isn't configured here */
+    }
+    return undefined;
+}
+/** Thrown when a Bankr call is attempted without a discoverable bk_ key. */
+export class MissingBankrKeyError extends Error {
+    constructor() {
+        super("no Bankr key — set CYBERDYNE_BANKR_KEY or BANKR_API_KEY (a bk_… Agent API key from " +
+            "https://bankr.bot, Agent API access enabled), or put it in ~/.bankr/config.json.");
+        this.name = "MissingBankrKeyError";
+    }
+}
+/** A Bankr API error carrying the HTTP status + the API's message. */
+export class BankrApiError extends Error {
+    status;
+    path;
+    constructor(status, path, message) {
+        super(`Bankr ${path} → ${status}: ${message}`);
+        this.status = status;
+        this.path = path;
+        this.name = "BankrApiError";
+    }
+}
+function authHeaders(key) {
+    const h = { "X-API-Key": key, accept: "application/json", "user-agent": "cyberdyne-mcp" };
+    const partner = process.env.CYBERDYNE_BANKR_PARTNER_KEY?.trim();
+    if (partner)
+        h["X-Partner-Key"] = partner;
+    return h;
+}
+async function call(method, path, opts = {}) {
+    const key = opts.key ?? resolveBankrKey();
+    if (!key)
+        throw new MissingBankrKeyError();
+    const res = await fetch(`${BANKR_API_URL}${path}`, {
+        method,
+        headers: {
+            ...authHeaders(key),
+            ...(opts.body !== undefined ? { "content-type": "application/json" } : {}),
+        },
+        ...(opts.body !== undefined ? { body: JSON.stringify(opts.body) } : {}),
+        signal: AbortSignal.timeout(20_000),
+    });
+    const json = (await res.json().catch(() => ({})));
+    if (!res.ok) {
+        const msg = String(json?.message ?? json?.error ?? `http_${res.status}`);
+        throw new BankrApiError(res.status, path, msg);
+    }
+    return json;
+}
+/** GET /wallet/me — the agent's Bankr identity, incl. its managed wallet address. */
+export async function bankrWalletMe(key) {
+    return call("GET", "/wallet/me", { key });
+}
+/** Resolve the canonical Bankr EVM wallet address (walletAddress | evmAddress | address). */
+export async function bankrWalletAddress(key) {
+    const me = await bankrWalletMe(key);
+    const addr = me.walletAddress || me.evmAddress || me.address;
+    if (typeof addr !== "string" || !/^0x[0-9a-fA-F]{40}$/.test(addr)) {
+        throw new BankrApiError(200, "/wallet/me", "no EVM wallet address in response");
+    }
+    return addr;
+}
+/**
+ * POST /wallet/transfer — send an ERC-20 (or native) from the Bankr-managed wallet.
+ * `amount` is the HUMAN-readable token amount (the API resolves decimals), matching
+ * the `bankr transfer --amount` CLI. Returns the broadcast tx hash.
+ */
+export async function bankrTransfer(params, key) {
+    const r = await call("POST", "/wallet/transfer", {
+        key,
+        body: {
+            tokenAddress: params.tokenAddress,
+            recipientAddress: params.recipientAddress,
+            amount: String(params.amount),
+            isNativeToken: params.isNativeToken ?? false,
+            chain: params.chain ?? "base",
+        },
+    });
+    if (!r.txHash)
+        throw new BankrApiError(200, "/wallet/transfer", "no txHash in response");
+    return r.txHash;
+}
+/**
+ * POST /wallet/sign with signatureType "eth_signTypedData_v4" — custodial EIP-712.
+ * `typedData` is the full { domain, types, primaryType, message } struct. Returns the
+ * 0x signature. This is what lets the Bankr wallet sign CYBERDYNE's auth-capture
+ * authorization without exporting a key (see src/bankr-signer.ts).
+ */
+export async function bankrSignTypedData(typedData, key) {
+    const r = await call("POST", "/wallet/sign", {
+        key,
+        body: { signatureType: "eth_signTypedData_v4", typedData },
+    });
+    if (!r.signature?.startsWith("0x"))
+        throw new BankrApiError(200, "/wallet/sign", "no signature in response");
+    return r.signature;
+}
+/** POST /wallet/sign with signatureType "personal_sign". Returns the 0x signature. */
+export async function bankrSignMessage(message, key) {
+    const r = await call("POST", "/wallet/sign", {
+        key,
+        body: { signatureType: "personal_sign", message },
+    });
+    if (!r.signature?.startsWith("0x"))
+        throw new BankrApiError(200, "/wallet/sign", "no signature in response");
+    return r.signature;
+}
+// ── health / discovery ────────────────────────────────────────────────────────
+/** GET /_health — cheap key/liveness probe. Returns true on a 2xx. */
+export async function bankrHealth(key) {
+    try {
+        await call("GET", "/_health", { key });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** GET /tokens/search?query= — public symbol↔address resolver (the one /wallet/transfer uses). */
+export async function bankrSearchTokens(query, chainId) {
+    const params = new URLSearchParams({ query });
+    if (chainId)
+        params.set("chainId", String(chainId));
+    const res = await fetch(`${BANKR_API_URL}/tokens/search?${params}`, {
+        headers: { accept: "application/json", "user-agent": "cyberdyne-mcp" },
+        signal: AbortSignal.timeout(15_000),
+    });
+    const json = (await res.json().catch(() => ({})));
+    if (!res.ok)
+        throw new BankrApiError(res.status, "/tokens/search", "search failed");
+    return Array.isArray(json) ? json : (json.tokens ?? []);
+}
+/** GET /wallet/portfolio — multi-chain balances/holdings (cheap treasury/earnings view). */
+export async function bankrPortfolio(opts = {}, key) {
+    const q = new URLSearchParams();
+    if (opts.chains?.length)
+        q.set("chains", opts.chains.join(","));
+    if (opts.showLowValueTokens)
+        q.set("showLowValueTokens", "true");
+    const qs = q.toString();
+    return call("GET", `/wallet/portfolio${qs ? `?${qs}` : ""}`, { key });
+}
+/**
+ * POST /wallet/x402-pay — pay any x402-priced URL custodially from the Bankr wallet,
+ * Bankr handling the 402 handshake server-side, capped by `maxPaymentUsd`. Useful for an
+ * agent to call a paid discovery/quote endpoint (e.g. CYBERDYNE's x402 Cloud front door)
+ * with one authenticated POST instead of a client-side wallet signature.
+ */
+export async function bankrX402Pay(params, key) {
+    return call("POST", "/wallet/x402-pay", {
+        key,
+        body: { url: params.url, method: params.method ?? "GET", body: params.body, maxPaymentUsd: params.maxPaymentUsd },
+    });
+}
+/**
+ * Headless `bankr login --siwe`: mint a `bk_` key by signing a SIWE message with the
+ * agent's own wallet — zero-browser, no email OTP. Flow (verified against @bankr/cli):
+ *   GET /cli/siwe/nonce → build the SIWE message → personal_sign → POST /cli/siwe/verify.
+ * Mints with Wallet API enabled (so /wallet/* works); Agent API + Token-Launch API stay
+ * OFF (Agent API is separately gated at bankr.bot/api; we never launch tokens). The
+ * private key never leaves this process and is never logged. Defaults the signer to the
+ * onboarded wallet (CYBERDYNE_EVM_PRIVATE_KEY / ~/.cyberdyne config).
+ */
+export async function bankrSiweProvision(opts = {}) {
+    const pk = (opts.privateKey ?? process.env.CYBERDYNE_EVM_PRIVATE_KEY?.trim() ?? readSavedWalletKey() ?? "").trim();
+    if (!pk) {
+        throw new Error("no signing wallet — pass a private key, set CYBERDYNE_EVM_PRIVATE_KEY, or run `cyberdyne-mcp onboard` first");
+    }
+    const { privateKeyToAccount } = await import("viem/accounts");
+    const account = privateKeyToAccount((pk.startsWith("0x") ? pk : `0x${pk}`));
+    const host = new URL(BANKR_API_URL).host;
+    const nonceRes = await fetch(`${BANKR_API_URL}/cli/siwe/nonce`, {
+        headers: { accept: "application/json", "user-agent": "cyberdyne-mcp" },
+        signal: AbortSignal.timeout(20_000),
+    });
+    if (!nonceRes.ok)
+        throw new BankrApiError(nonceRes.status, "/cli/siwe/nonce", "nonce request failed");
+    const { nonce } = (await nonceRes.json());
+    if (!nonce)
+        throw new BankrApiError(200, "/cli/siwe/nonce", "no nonce in response");
+    const message = [
+        `${host} wants you to sign in with your Ethereum account:`,
+        account.address,
+        "",
+        "Sign in to Bankr",
+        "",
+        `URI: ${BANKR_API_URL}/cli/siwe/verify`,
+        "Version: 1",
+        // Bankr's SIWE verifier expects "Chain ID: 1" — this is the LOGIN signature, not a
+        // transaction; CYBERDYNE settles on Base (8453). Matches @bankr/cli's siwe flow.
+        "Chain ID: 1",
+        `Nonce: ${nonce}`,
+        `Issued At: ${new Date().toISOString()}`,
+    ].join("\n");
+    const signature = await account.signMessage({ message });
+    const verifyRes = await fetch(`${BANKR_API_URL}/cli/siwe/verify`, {
+        method: "POST",
+        headers: { "content-type": "application/json", accept: "application/json", "user-agent": "cyberdyne-mcp" },
+        body: JSON.stringify({
+            message,
+            signature,
+            partnerApiKey: opts.partnerKey ?? process.env.CYBERDYNE_BANKR_PARTNER_KEY?.trim(),
+            keyName: opts.keyName ?? `cyberdyne-${new Date().toISOString().slice(0, 10)}`,
+            readOnly: false,
+            walletApiEnabled: opts.walletApiEnabled ?? true,
+            agentApiEnabled: false,
+            tokenLaunchApiEnabled: false,
+            allowedRecipients: opts.allowedRecipients,
+        }),
+        signal: AbortSignal.timeout(30_000),
+    });
+    const j = (await verifyRes.json().catch(() => ({})));
+    if (!verifyRes.ok || !j.apiKey) {
+        throw new BankrApiError(verifyRes.status, "/cli/siwe/verify", String(j.message ?? j.error ?? "verify failed"));
+    }
+    return { apiKey: j.apiKey, walletAddress: j.walletAddress ?? account.address, readOnly: j.readOnly };
+}