frisk-mcp 0.0.2 → 0.0.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "frisk-mcp",
-  "version": "0.0.2",
+  "version": "0.0.3",
   "description": "MCP server for Frisk: screen an x402 payment counterparty before an agent pays.",
   "mcpName": "dev.tryfrisk/frisk",
   "type": "module",
@@ -8,10 +8,11 @@
     "frisk-mcp": "./dist/index.js"
   },
   "files": [
-    "dist"
+    "dist/index.js",
+    "THIRD_PARTY_NOTICES.md"
   ],
   "scripts": {
-    "build": "tsup",
+    "build": "tsup && node scripts/notices.mjs",
     "test": "vitest run",
     "typecheck": "tsc --noEmit",
     "lint": "biome check .",
@@ -38,19 +39,17 @@
     "url": "https://github.com/Jiangw2718i/frisk/issues"
   },
   "engines": {
-    "node": ">=18"
-  },
-  "dependencies": {
-    "@modelcontextprotocol/server": "^2.3.1",
-    "frisk-screen": "^0.0.2",
-    "zod": "^4.2.0"
+    "node": ">=20"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.5.13",
     "@modelcontextprotocol/client": "^2.3.1",
+    "@modelcontextprotocol/server": "^2.3.1",
     "@types/node": "^25.9.6",
+    "frisk-screen": "^0.0.2",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.12"
+    "vitest": "^4.1.12",
+    "zod": "^4.2.0"
   }
 }

package/dist/index.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/index.ts","../src/server.ts"],"sourcesContent":["import { StdioServerTransport } from \"@modelcontextprotocol/server/stdio\";\nimport { createServer } from \"./server.js\";\n\nasync function main(): Promise<void> {\n  const server = createServer({\n    apiKey: process.env.FRISK_API_KEY,\n    baseUrl: process.env.FRISK_BASE_URL,\n  });\n  await server.connect(new StdioServerTransport());\n}\n\nmain().catch((error) => {\n  // stdout carries the protocol, so diagnostics go to stderr.\n  console.error(error);\n  process.exit(1);\n});\n","import { McpServer } from \"@modelcontextprotocol/server\";\nimport { Client, type ScreenResult } from \"frisk-screen\";\nimport { z } from \"zod\";\n\nexport interface ServerOptions {\n  /** Hosted API key. Without one the server screens entirely offline. */\n  apiKey?: string;\n  /** Override the hosted base URL. Only used when an API key is supplied. */\n  baseUrl?: string;\n}\n\nconst inputSchema = z.object({\n  counterparty: z\n    .string()\n    .describe(\"The address the agent intends to pay, e.g. an 0x EVM address.\"),\n  endpoint: z\n    .string()\n    .optional()\n    .describe(\"URL that quoted the payment. Used to check transport safety.\"),\n  amount: z.number().optional().describe(\"Amount the agent is about to pay.\"),\n  asset: z.string().optional().describe(\"Asset symbol, e.g. USDC.\"),\n  observedPayTo: z\n    .string()\n    .optional()\n    .describe(\n      \"The payTo address the endpoint actually returned for this request. If it differs from the counterparty, that is the dynamic-payTo swap.\",\n    ),\n  strictness: z\n    .number()\n    .min(0)\n    .max(1)\n    .optional()\n    .describe(\"0 is permissive, 1 is paranoid. Defaults to 0.3.\"),\n  maxPerCall: z\n    .number()\n    .optional()\n    .describe(\"Spending ceiling for a single call.\"),\n  allowedAssets: z\n    .array(z.string())\n    .optional()\n    .describe(\"Assets the agent is permitted to pay in.\"),\n});\n\n/**\n * The verdict is advisory. Frisk returns a recommendation and the caller\n * decides; it never holds funds and cannot stop a payment by itself.\n */\nfunction describeResult(result: ScreenResult): string {\n  const lines = [\n    `verdict: ${result.verdict}`,\n    `trust score: ${result.trustScore}`,\n    `confidence: ${result.confidence}`,\n    `source: ${result.source}`,\n  ];\n  if (result.reasons.length > 0) {\n    lines.push(`reasons: ${result.reasons.join(\"; \")}`);\n  }\n  if (result.policyHits.length > 0) {\n    lines.push(`policy hits: ${result.policyHits.join(\"; \")}`);\n  }\n  return lines.join(\"\\n\");\n}\n\n/**\n * Build the Frisk MCP server.\n *\n * One tool, deliberately. `screen_payment` is the whole deterministic floor:\n * counterparty sanity, dynamic-payTo comparison, transport check, and the\n * caller's own spending policy. With an API key the same call is answered by\n * the hosted service, which adds reputation signals.\n *\n * Note on where this belongs: an MCP tool runs when a model decides to call it,\n * so it is a weaker guarantee than calling `screen()` on the code path that\n * actually signs the payment. Use this for inspection and for agents that\n * cannot import the library; use the library where the money moves.\n */\nexport function createServer(options: ServerOptions = {}): McpServer {\n  const client = new Client({\n    apiKey: options.apiKey,\n    baseUrl: options.baseUrl,\n  });\n\n  const server = new McpServer({\n    name: \"frisk\",\n    version: \"0.0.2\",\n  });\n\n  server.registerTool(\n    \"screen_payment\",\n    {\n      title: \"Screen a payment before paying\",\n      description:\n        client.mode === \"hosted\"\n          ? \"Screen a counterparty an agent is about to pay. Runs the local deterministic checks and the hosted reputation graph, and returns allow / review / block with reasons. Advisory: the caller decides.\"\n          : \"Screen a counterparty an agent is about to pay. Runs entirely offline: address sanity, dynamic-payTo comparison, transport check, and your spending policy. Returns allow / review / block with reasons. Advisory: the caller decides. Set FRISK_API_KEY to add hosted reputation signals.\",\n      inputSchema,\n      annotations: {\n        readOnlyHint: true,\n        openWorldHint: client.mode === \"hosted\",\n      },\n    },\n    async ({ counterparty, maxPerCall, allowedAssets, ...rest }) => {\n      const policy =\n        maxPerCall === undefined && allowedAssets === undefined\n          ? undefined\n          : { maxPerCall, allowedAssets };\n      try {\n        const result = await client.screen(counterparty, { ...rest, policy });\n        return {\n          content: [{ type: \"text\" as const, text: describeResult(result) }],\n          structuredContent: { ...result },\n        };\n      } catch (error) {\n        const message = error instanceof Error ? error.message : String(error);\n        return {\n          isError: true,\n          content: [\n            {\n              type: \"text\" as const,\n              text: `screening failed: ${message}`,\n            },\n          ],\n        };\n      }\n    },\n  );\n\n  return server;\n}\n"],"mappings":";;;AAAA,SAAS,4BAA4B;;;ACArC,SAAS,iBAAiB;AAC1B,SAAS,cAAiC;AAC1C,SAAS,SAAS;AASlB,IAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,cAAc,EACX,OAAO,EACP,SAAS,+DAA+D;AAAA,EAC3E,UAAU,EACP,OAAO,EACP,SAAS,EACT,SAAS,8DAA8D;AAAA,EAC1E,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,mCAAmC;AAAA,EAC1E,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,0BAA0B;AAAA,EAChE,eAAe,EACZ,OAAO,EACP,SAAS,EACT;AAAA,IACC;AAAA,EACF;AAAA,EACF,YAAY,EACT,OAAO,EACP,IAAI,CAAC,EACL,IAAI,CAAC,EACL,SAAS,EACT,SAAS,kDAAkD;AAAA,EAC9D,YAAY,EACT,OAAO,EACP,SAAS,EACT,SAAS,qCAAqC;AAAA,EACjD,eAAe,EACZ,MAAM,EAAE,OAAO,CAAC,EAChB,SAAS,EACT,SAAS,0CAA0C;AACxD,CAAC;AAMD,SAAS,eAAe,QAA8B;AACpD,QAAM,QAAQ;AAAA,IACZ,YAAY,OAAO,OAAO;AAAA,IAC1B,gBAAgB,OAAO,UAAU;AAAA,IACjC,eAAe,OAAO,UAAU;AAAA,IAChC,WAAW,OAAO,MAAM;AAAA,EAC1B;AACA,MAAI,OAAO,QAAQ,SAAS,GAAG;AAC7B,UAAM,KAAK,YAAY,OAAO,QAAQ,KAAK,IAAI,CAAC,EAAE;AAAA,EACpD;AACA,MAAI,OAAO,WAAW,SAAS,GAAG;AAChC,UAAM,KAAK,gBAAgB,OAAO,WAAW,KAAK,IAAI,CAAC,EAAE;AAAA,EAC3D;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AAeO,SAAS,aAAa,UAAyB,CAAC,GAAc;AACnE,QAAM,SAAS,IAAI,OAAO;AAAA,IACxB,QAAQ,QAAQ;AAAA,IAChB,SAAS,QAAQ;AAAA,EACnB,CAAC;AAED,QAAM,SAAS,IAAI,UAAU;AAAA,IAC3B,MAAM;AAAA,IACN,SAAS;AAAA,EACX,CAAC;AAED,SAAO;AAAA,IACL;AAAA,IACA;AAAA,MACE,OAAO;AAAA,MACP,aACE,OAAO,SAAS,WACZ,wMACA;AAAA,MACN;AAAA,MACA,aAAa;AAAA,QACX,cAAc;AAAA,QACd,eAAe,OAAO,SAAS;AAAA,MACjC;AAAA,IACF;AAAA,IACA,OAAO,EAAE,cAAc,YAAY,eAAe,GAAG,KAAK,MAAM;AAC9D,YAAM,SACJ,eAAe,UAAa,kBAAkB,SAC1C,SACA,EAAE,YAAY,cAAc;AAClC,UAAI;AACF,cAAM,SAAS,MAAM,OAAO,OAAO,cAAc,EAAE,GAAG,MAAM,OAAO,CAAC;AACpE,eAAO;AAAA,UACL,SAAS,CAAC,EAAE,MAAM,QAAiB,MAAM,eAAe,MAAM,EAAE,CAAC;AAAA,UACjE,mBAAmB,EAAE,GAAG,OAAO;AAAA,QACjC;AAAA,MACF,SAAS,OAAO;AACd,cAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,eAAO;AAAA,UACL,SAAS;AAAA,UACT,SAAS;AAAA,YACP;AAAA,cACE,MAAM;AAAA,cACN,MAAM,qBAAqB,OAAO;AAAA,YACpC;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;;;AD7HA,eAAe,OAAsB;AACnC,QAAM,SAAS,aAAa;AAAA,IAC1B,QAAQ,QAAQ,IAAI;AAAA,IACpB,SAAS,QAAQ,IAAI;AAAA,EACvB,CAAC;AACD,QAAM,OAAO,QAAQ,IAAI,qBAAqB,CAAC;AACjD;AAEA,KAAK,EAAE,MAAM,CAAC,UAAU;AAEtB,UAAQ,MAAM,KAAK;AACnB,UAAQ,KAAK,CAAC;AAChB,CAAC;","names":[]}