logos-layer 0.1.0 → 0.1.1

package/README.md

@@ -17,7 +17,7 @@ Add to your MCP client config (Claude Desktop, Claude Code, or any MCP client):
   "mcpServers": {
     "logos-layer": {
       "command": "npx",
-      "args": ["-y", "logos-layer"],
+      "args": ["-y", "logos-layer@0.1.1"],
       "env": {
         "VAULT_ADDRESS": "<your-vault-address>",
         "RPC_URL": "https://rpc.testnet.chain.robinhood.com",
@@ -34,11 +34,34 @@ Requires Node 20+.
 | --- | --- | --- |
 | `VAULT_ADDRESS` | yes | The deployed vault the agent trades inside |
 | `RPC_URL` | yes | Robinhood Chain RPC endpoint |
-| `PRIVATE_KEY` | yes | The agent wallet key; must be the vault owner to trade |
+| `PRIVATE_KEY` | one of | The agent wallet key, inline |
+| `PRIVATE_KEY_FILE` | one of | Path to a file containing the key; preferred over inline |
 | `EXPLORER_URL` | no | Explorer base URL for transaction links |
 
+## Key handling
+
+The key never leaves your machine. This server reads it locally, signs locally, and sends only signed transactions to the RPC; there is no backend and nothing is ever transmitted to anyone else. The AI agent can call the trading tools but can never read the key.
+
+Prefer `PRIVATE_KEY_FILE` pointing at a `chmod 600` file over an inline `PRIVATE_KEY`, so the key does not sit inside an MCP config that cloud backups and dotfile syncs pick up:
+
+```sh
+printf '%s' '0xYOUR_KEY' > ~/.logos-layer-key && chmod 600 ~/.logos-layer-key
+```
+
+```json
+"env": {
+  "VAULT_ADDRESS": "<your-vault-address>",
+  "RPC_URL": "https://rpc.testnet.chain.robinhood.com",
+  "PRIVATE_KEY_FILE": "~/.logos-layer-key"
+}
+```
+
+Note: use an absolute path; `~` is not expanded by all MCP clients.
+
 ## Safety
 
-The agent wallet must be the vault owner to trade, so use the key you deployed the vault with. Never use a key that holds real funds. Testnet instruments only; this is a research demo, not investment advice.
+Generate a FRESH burner wallet for the agent and fund it with faucet ETH only. The agent wallet must be the vault owner to trade, so deploy the vault with that same burner. Never use a key that holds real funds. Testnet instruments only; this is a research demo, not investment advice.
+
+The version in the config is pinned; review the changelog before moving to a newer release.
 
 This package ships as a compiled artifact.

package/dist/index.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
+import { readFileSync } from "fs";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import {
@@ -125,8 +126,24 @@ function firstViolation(m, prices, p, o) {
 // src/index.ts
 var VAULT = requireEnv("VAULT_ADDRESS");
 var RPC_URL = requireEnv("RPC_URL");
-var PRIVATE_KEY = requireEnv("PRIVATE_KEY");
+var PRIVATE_KEY = loadPrivateKey();
 var EXPLORER_URL = process.env.EXPLORER_URL;
+function loadPrivateKey() {
+  const file = process.env.PRIVATE_KEY_FILE;
+  if (file) {
+    try {
+      const raw = readFileSync(file, "utf8").trim();
+      if (raw) return raw;
+      console.error(`PRIVATE_KEY_FILE ${file} is empty`);
+    } catch (err) {
+      console.error(
+        `Cannot read PRIVATE_KEY_FILE ${file}: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    process.exit(1);
+  }
+  return requireEnv("PRIVATE_KEY");
+}
 function requireEnv(name) {
   const v = process.env[name];
   if (!v) {
@@ -232,7 +249,7 @@ function describeVerdict(state, asset, side, quantity) {
   });
   return { signedQty, verdict: v, ruleLines: lines.join("\n") };
 }
-var server = new McpServer({ name: "logos-layer", version: "0.1.0" });
+var server = new McpServer({ name: "logos-layer", version: "0.1.1" });
 server.tool(
   "get_portfolio",
   "Read the vault's on-chain portfolio: cash, positions, prices, NAV, and the mandate thresholds that every trade must satisfy.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "logos-layer",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "type": "module",
   "description": "Logos Layer: an MCP server that lets AI agents trade inside a mandate-guarded vault on Robinhood Chain. Compliant orders execute; violations revert on-chain.",
   "license": "MIT",