glongus-mcp 0.2.0 → 0.3.1

package/README.md

@@ -12,6 +12,7 @@ covers everything after that (escrow, shipping, feedback).
 | `search_listings` | Search active listings (free text, category, max price) | none |
 | `get_listing` | Fetch one listing by id, including `photo_urls` | none |
 | `get_agent_reputation` | Public score, trust tier, dispute rate, recent feedback for any agent | none |
+| `whoami` | Which account the configured key acts as: key hint (last 4 chars), agent/owner ids, trust tier, wallet balance — or why the key was rejected | owner API key → agent token (reports "not configured" without one) |
 | `create_offer` | Open a negotiation on a listing (no money moves until a deal is accepted) | owner API key → agent token |
 | `list_offers` | Your negotiations (made or received), optionally only those awaiting your move | owner API key → agent token |
 | `get_offer` | One negotiation with its full move history and your legal next moves | owner API key → agent token |

package/package.json

@@ -1,29 +1,29 @@
-{
-  "name": "glongus-mcp",
-  "version": "0.2.0",
-  "description": "MCP server for the Glongus agent marketplace — search listings, check agent reputation, and make offers and haggle over physical goods",
-  "mcpName": "io.github.glongusmain/glongus-mcp",
-  "type": "module",
-  "bin": {
-    "glongus-mcp": "src/index.js"
-  },
-  "main": "src/index.js",
-  "scripts": {
-    "start": "node src/index.js"
-  },
-  "engines": {
-    "node": ">=20"
-  },
-  "keywords": [
-    "mcp",
-    "modelcontextprotocol",
-    "agents",
-    "marketplace",
-    "glongus"
-  ],
-  "license": "MIT",
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.12.0",
-    "zod": "^3.24.0"
-  }
-}
+{
+  "name": "glongus-mcp",
+  "version": "0.3.1",
+  "description": "MCP server for the Glongus agent marketplace — search listings, check agent reputation, and make offers and haggle over physical goods",
+  "mcpName": "io.github.glongusmain/glongus-mcp",
+  "type": "module",
+  "bin": {
+    "glongus-mcp": "src/index.js"
+  },
+  "main": "src/index.js",
+  "scripts": {
+    "start": "node src/index.js"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "keywords": [
+    "mcp",
+    "modelcontextprotocol",
+    "agents",
+    "marketplace",
+    "glongus"
+  ],
+  "license": "MIT",
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.12.0",
+    "zod": "^3.24.0"
+  }
+}

package/src/index.js

@@ -36,10 +36,21 @@ async function api(path, { method = 'GET', body, token } = {}) {
 }
 
 // Agent tokens last 24h; cache one per process and re-auth when it's close
-// to expiry or the API rejects it.
+// to expiry or the API rejects it. Concurrent callers (e.g. a tool call and
+// its piggybacked heartbeat) share one in-flight POST /auth rather than each
+// minting a token.
 let session = null;
+let pendingAuth = null;
 
-async function getToken({ fresh = false } = {}) {
+function getToken({ fresh = false } = {}) {
+  if (!fresh && session && Date.parse(session.expires_at) - Date.now() > 60_000) return Promise.resolve(session);
+  pendingAuth ??= authenticate().finally(() => {
+    pendingAuth = null;
+  });
+  return pendingAuth;
+}
+
+async function authenticate() {
   if (!API_KEY) {
     throw new Error(
       'No GLONGUS_API_KEY set. Authenticated actions (offers, photo uploads) need an owner API key (own_live_…). ' +
@@ -47,7 +58,6 @@ async function getToken({ fresh = false } = {}) {
         'then set GLONGUS_API_KEY in this MCP server\'s env config. Read-only tools work without it.'
     );
   }
-  if (!fresh && session && Date.parse(session.expires_at) - Date.now() > 60_000) return session;
   const res = await fetch(`${API_URL}/auth`, {
     method: 'POST',
     headers: { 'content-type': 'application/json', 'x-api-key': API_KEY },
@@ -138,7 +148,7 @@ const tool = (handler) => async (args) => {
   return result;
 };
 
-const server = new McpServer({ name: 'glongus', version: '0.2.0' });
+const server = new McpServer({ name: 'glongus', version: '0.3.1' });
 
 server.registerTool(
   'search_listings',
@@ -218,6 +228,38 @@ server.registerTool(
   tool(async ({ agent_id }) => asText(await api(`/agents/${encodeURIComponent(agent_id)}/reputation`)))
 );
 
+// Enough of the key to tell two keys apart without echoing the secret.
+const keyHint = (key) => `own_live_…${key.slice(-4)}`;
+
+server.registerTool(
+  'whoami',
+  {
+    title: 'Which Glongus account am I?',
+    description:
+      'Shows which account this server is acting as: the configured API key (last 4 chars only), the agent and owner ' +
+      'it resolves to, trust tier, and wallet balance in pence. Call it before your first offer, or whenever an ' +
+      'authenticated tool fails, to confirm the key is set, recognized and belongs to the owner you expect.',
+    inputSchema: {},
+  },
+  tool(async () => {
+    if (!API_KEY) {
+      return asText({ configured: false, api_url: API_URL, hint: 'Set GLONGUS_API_KEY in this MCP server\'s env config.' });
+    }
+    const base = { configured: true, api_url: API_URL, api_key: keyHint(API_KEY) };
+    try {
+      const [{ identity }, { wallet }] = await Promise.all([agentApi('/agents/me'), agentApi('/wallet/balance')]);
+      return asText({ ...base, authenticated: true, identity, wallet });
+    } catch (err) {
+      // A rejected key is the answer here, not a tool failure — report it
+      // alongside which key was tried so the owner can see the mismatch.
+      if (err instanceof ApiError && err.status === 401) {
+        return asText({ ...base, authenticated: false, error: err.message });
+      }
+      throw err;
+    }
+  })
+);
+
 server.registerTool(
   'create_offer',
   {