mcp-server-madeonsol 1.27.0 → 2.0.0

package/README.md

@@ -11,8 +11,14 @@
 
 MCP server for [MadeOnSol](https://madeonsol.com) Solana KOL intelligence API. Use from Claude Desktop, Cursor, or any MCP-compatible client.
 
-> Real-time Solana trading intelligence: track 1,069 KOL wallets with <3s latency on paid keys and x402 pay-per-call (free-tier live feeds are 5-min delayed), score 23,000+ Pump.fun deployers, surface deshred deploy signals **~500ms before on-chain confirmation**, detect multi-KOL coordination, surface bundle-cohort holdings (which same-slot wallets still hold a token's supply), verify any wallet's CURRENT on-chain holdings straight from its token accounts, and stream every DEX trade across 9+ programs. Free tier: 200 requests/day across 40+ endpoints (live feeds 5-min delayed) — no signup payment. Get a key at [madeonsol.com/pricing](https://madeonsol.com/pricing).
+<!-- Stats below are deliberate conservative floors kept in sync with the site's canonical labels (src/lib/constants.ts KOL_COUNT_LABEL / DEPLOYERS_PROFILED_LABEL / ALPHA_WALLETS_LABEL), rounded down from a live count measured on a known date and bumped only when the real count crosses the next threshold -- never the exact live number, which changes every minute. Do not replace with a live/volatile count. -->
 
+> Real-time Solana trading intelligence: track 2,000+ KOL wallets with <3s latency on paid keys and x402 pay-per-call (free-tier live feeds are 5-min delayed), score 85K+ Pump.fun deployers, surface deshred deploy signals **~500ms before on-chain confirmation**, detect multi-KOL coordination, surface bundle-cohort holdings (which same-slot wallets still hold a token's supply), verify any wallet's CURRENT on-chain holdings straight from its token accounts, and stream every DEX trade across 9+ programs. Free tier: 200 requests/day across 40+ endpoints (live feeds 5-min delayed) — no signup payment. Get a key at [madeonsol.com/pricing](https://madeonsol.com/pricing).
+
+> **New in 2.0.0 — BREAKING: HTTP mode now requires a separate token (security fix, SEC-02).** If you run this server with `MCP_TRANSPORT=http`, you must now also set `MCP_HTTP_TOKEN` (a random secret you generate) and send it as `Authorization: Bearer <token>` on **every** request, including `GET /health` and the server-card endpoint — previously, anything that could reach the bound port could call every tool using the operator's own API key with no authentication at all. HTTP mode is now hard-restricted to literal loopback (`127.0.0.1` / `::1`), rejects `Origin`/`X-Forwarded-*` headers and duplicate `Authorization`/`Host` headers outright, exposes only `POST /mcp` plus the two GET routes, and **refuses to start** if a wallet/payment signer is configured — HTTP mode can never carry a payer key. **If you use the default `stdio` transport (Claude Desktop, Cursor, most MCP clients), nothing changes — no action needed.** This is a single shared-operator-token fix, not a new multi-user or OAuth system; each HTTP caller still shares the operator's own MadeOnSol API key. Full writeup: `docs/audit/SEC02_PRIVATE_HTTP_MCP.md`.
+>
+> **New in 1.27.1 — the server now reports MCP `instructions`.** The `initialize` response's `instructions` field (operational guidance for the calling agent — distinct from this README/package description) was never set; directories that introspect the live server (Glama) reported "no recorded MCP instructions." No new tools; still 104 total.
+>
 > **New in 1.27.0 — top traders, sniper watchlist management, and two update tools (104 tools total).** Six additions found by an internal agentic-infra coverage audit. `madeonsol_token_top_traders` (`GET /tokens/{mint}/top-traders`, PRO/ULTRA) ranks a token's wallets by realized PnL or ROI, enriched with KOL/alpha-wallet identity — this endpoint already existed on the REST API and x402 rail but had no MCP tool. `madeonsol_sniper_watchlist_list` / `_add` / `_remove` (PRO+/ULTRA) manage your custom sniper-deploy watchlist (`madeonsol_sniper_recent(watchlist: true)` narrows to it) — previously only reachable via raw HTTP. `madeonsol_update_webhook` (PATCH) changes a webhook's URL, events, or active state without deleting and recreating it. `madeonsol_wallet_tracker_relabel` (PATCH) renames or clears a tracked wallet's label.
 >
 > **New in 1.26.0 — deployer reputation as-of a date, and creator-fee rewards.** Two new tools (PRO+, keyed `msk_` API only — no x402 route). `madeonsol_deployer_as_of` binds `GET /deployer-hunter/{wallet}/as-of`: the deployer's reputation exactly as it stood on `date` (default today, UTC) — the latest write-on-change snapshot at or before it, so an agent backtests without look-ahead bias. `snapshot.snapshot_date` can predate `date` (write-on-change); `snapshot.carried: true` marks that. No snapshot at or before `date` → `as_of: false, snapshot: null` — nothing is ever synthesized. `date` must be ≥ 2026-04-07 and not in the future. `madeonsol_deployer_rewards` binds `GET /deployer-hunter/{wallet}/rewards`: pump.fun creator-fee rewards, answered two ways that are never merged — `collected` (what actually reached the wallet: direct vault claims kept 90 days, social-handle claims, shareholder payouts on **any** token) and `attributed` (every payout on the tokens it **deployed**, split `to_self`/`to_others` + `redirected_pct`). Every money field is `{sol, usdc, usd}`; `usd` is `null` (never a silent 0) when a SOL amount exists and no SOL price was available. `top_tokens`/`top_recipients` (≤10, USD-sorted) show where attributed fees went. Works for non-deployers too (`is_deployer: false`, `attributed` empty).
@@ -165,6 +171,24 @@ Add to `claude_desktop_config.json`:
 
 Add to MCP settings with the same command and env vars.
 
+
+## Private HTTP transport (SEC-02)
+
+Stdio remains the default for Claude Desktop, Cursor and other local MCP clients. HTTP now requires an explicit private-operator configuration; previously unauthenticated HTTP launch settings will fail closed.
+
+1. Set `MADEONSOL_API_KEY` to the operator's `msk_` key.
+2. Generate a separate random access token, for example `node -e "console.log(require('node:crypto').randomBytes(32).toString('base64url'))"`, and store it as `MCP_HTTP_TOKEN`. Do not reuse the upstream API key or put either credential in a URL.
+3. Set `MCP_TRANSPORT=http`, `HOST=127.0.0.1` (default, or `::1`) and optionally `PORT` (default `3100`). Non-loopback bindings, missing credentials and any `SVM_PRIVATE_KEY` or `RHC_PAYER_KEY` are refused before startup. Solana wallet/x402 mode remains available through stdio.
+4. Connect to `http://127.0.0.1:3100/mcp` with `Authorization: Bearer <MCP_HTTP_TOKEN>` on **every request**, plus the normal MCP `Content-Type` and `Accept` headers. Use stdio if the client cannot attach headers. The local token is checked by the MCP adapter; only `MADEONSOL_API_KEY` is sent upstream.
+
+Only `POST /mcp`, `GET /health` and `GET /.well-known/mcp/server-card.json` are exposed, all authenticated. `/` and arbitrary paths are no longer MCP endpoints. The adapter is stateless: it does not issue session IDs, rejects supplied `Mcp-Session-Id`, and returns 405 for GET/DELETE on `/mcp`. Host must be the selected loopback literal with its port, or `localhost` with that exact port. Browser Origin headers, forwarded/proxy headers and cross-origin requests are rejected; no CORS access is granted.
+
+Limits: 256 KiB uncompressed JSON bodies, 8 KiB headers, a 10-second body-upload deadline, and 16 active authenticated requests. Oversized or malformed inputs are rejected before tool dispatch. This is not an overall tool-execution deadline; an upstream action already submitted may continue after a disconnect.
+
+Everyone holding the local token acts as the **same operator**, including access to that operator's mutation tools. This is not a multi-user/OAuth server: do not put it behind a public proxy, share it with untrusted users or expose a funded signer. Separate users require isolated processes/credentials or a future transport that authenticates each principal and maps their own credentials. Restart with a new `MCP_HTTP_TOKEN` to rotate access.
+
+The Docker image uses the same loopback restriction and requires both environment credentials. Its healthcheck authenticates without putting the token in the URL. It does not support a publicly published Docker port; use stdio or a client in the same trusted network namespace.
+
 ## Tools
 
 ### KOL Intelligence
@@ -223,7 +247,7 @@ Cached server-side with dynamic TTL (5min / 1h / 24h based on last activity). Co
 
 ### Alpha Wallet Intelligence
 
-Scored from 1M+ early-buyer records (wallets seen in the first 20 buyers of Pump.fun tokens).
+Scored from 1.5M+ early-buyer records (wallets seen in the first 20 buyers of Pump.fun tokens).
 
 | Tool | Tier | Description |
 |---|---|---|

package/dist/http-security.d.ts

@@ -0,0 +1,14 @@
+import { type IncomingMessage, type ServerResponse } from "node:http";
+export declare const MAX_BODY_BYTES: number;
+export declare const BODY_TIMEOUT_MS = 10000;
+export declare const MAX_ACTIVE_REQUESTS = 16;
+export interface HttpConfig {
+    host: "127.0.0.1" | "::1";
+    port: number;
+    allowedHosts: string[];
+    tokenDigest: Buffer;
+}
+export declare function readHttpConfig(env?: NodeJS.ProcessEnv): HttpConfig;
+/** Bounded body ingestion; callers must authenticate before invoking this. */
+export declare function readJsonBody(req: IncomingMessage, maxBytes?: number, timeoutMs?: number): Promise<unknown>;
+export declare function createPrivateHttpServer(config: HttpConfig, handle: (req: IncomingMessage, res: ServerResponse, body?: unknown) => Promise<void>): import("http").Server<typeof IncomingMessage, typeof ServerResponse>;

package/dist/http-security.js

@@ -0,0 +1,180 @@
+// Keep this standalone-package helper identical in both MCP packages.
+// HTTP is a private, single-operator adapter. Public/multi-user hosting is
+// intentionally unsupported until credentials can be scoped per principal.
+import { createServer } from "node:http";
+import { createHash, timingSafeEqual } from "node:crypto";
+export const MAX_BODY_BYTES = 256 * 1024;
+export const BODY_TIMEOUT_MS = 10_000;
+export const MAX_ACTIVE_REQUESTS = 16;
+export function readHttpConfig(env = process.env) {
+    const host = env.HOST || "127.0.0.1";
+    if (host !== "127.0.0.1" && host !== "::1") {
+        throw new Error("HTTP MCP requires HOST=127.0.0.1 or ::1; public binding is unsupported. Use stdio for local clients.");
+    }
+    const portText = env.PORT || "3100";
+    const port = Number(portText);
+    if (!/^\d+$/.test(portText) || !Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new Error("HTTP MCP requires a valid PORT between 1 and 65535.");
+    }
+    if (env.SVM_PRIVATE_KEY || env.RHC_PAYER_KEY) {
+        throw new Error("HTTP MCP cannot expose a payment signer. Remove wallet credentials or use stdio.");
+    }
+    if (!env.MADEONSOL_API_KEY?.startsWith("msk_")) {
+        throw new Error("HTTP MCP requires the operator's MADEONSOL_API_KEY.");
+    }
+    const token = env.MCP_HTTP_TOKEN || "";
+    if (!/^[A-Za-z0-9_-]{32,256}$/.test(token) || token === env.MADEONSOL_API_KEY) {
+        throw new Error("HTTP MCP requires a separate random MCP_HTTP_TOKEN (32–256 base64url characters).");
+    }
+    const authority = host === "::1" ? `[::1]:${port}` : `${host}:${port}`;
+    return {
+        host, port, allowedHosts: [authority, `localhost:${port}`],
+        tokenDigest: createHash("sha256").update(token).digest(),
+    };
+}
+class HttpFailure extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+function fail(res, status, message) {
+    if (res.headersSent) {
+        res.destroy();
+        return;
+    }
+    res.writeHead(status, {
+        "Content-Type": "application/json",
+        "Cache-Control": "no-store",
+        "Connection": "close",
+        ...(status === 401 ? { "WWW-Authenticate": 'Bearer realm="private-mcp"' } : {}),
+    });
+    res.end(JSON.stringify({ error: message }));
+}
+function headerCount(req, name) {
+    let count = 0;
+    for (let i = 0; i < req.rawHeaders.length; i += 2) {
+        if (req.rawHeaders[i].toLowerCase() === name)
+            count++;
+    }
+    return count;
+}
+function authorize(req, res, config) {
+    const remote = req.socket.remoteAddress;
+    if ((remote !== "127.0.0.1" && remote !== "::1") ||
+        headerCount(req, "host") !== 1 || !config.allowedHosts.includes(req.headers.host || "")) {
+        fail(res, 403, "Forbidden host");
+        return false;
+    }
+    // Native local MCP clients do not need browser origins, CORS or proxy headers.
+    if (req.headers.origin !== undefined || Object.keys(req.headers).some(h => h === "forwarded" || h.startsWith("x-forwarded-"))) {
+        fail(res, 403, "Browser origins and forwarded requests are unsupported");
+        return false;
+    }
+    const auth = req.headers.authorization;
+    const match = typeof auth === "string" ? /^Bearer ([A-Za-z0-9_-]{32,256})$/i.exec(auth) : null;
+    if (headerCount(req, "authorization") !== 1 || !match || !timingSafeEqual(createHash("sha256").update(match[1]).digest(), config.tokenDigest)) {
+        fail(res, 401, "Unauthorized");
+        return false;
+    }
+    return true;
+}
+/** Bounded body ingestion; callers must authenticate before invoking this. */
+export function readJsonBody(req, maxBytes = MAX_BODY_BYTES, timeoutMs = BODY_TIMEOUT_MS) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        const cleanup = () => {
+            clearTimeout(timer);
+            req.off("data", data);
+            req.off("end", end);
+            req.off("aborted", aborted);
+            req.off("error", error);
+        };
+        const stop = (reason) => { cleanup(); req.pause(); reject(reason); };
+        const timer = setTimeout(() => stop(new HttpFailure(408, "Request body timed out")), timeoutMs);
+        const data = (chunk) => {
+            size += chunk.length;
+            if (size > maxBytes) {
+                stop(new HttpFailure(413, "Request body too large"));
+                return;
+            }
+            chunks.push(chunk);
+        };
+        const end = () => {
+            cleanup();
+            try {
+                resolve(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+            }
+            catch {
+                reject(new HttpFailure(400, "Invalid JSON"));
+            }
+        };
+        const aborted = () => stop(new HttpFailure(400, "Request aborted"));
+        const error = () => stop(new HttpFailure(400, "Request failed"));
+        req.on("data", data);
+        req.once("end", end);
+        req.once("aborted", aborted);
+        req.once("error", error);
+    });
+}
+export function createPrivateHttpServer(config, handle) {
+    let active = 0;
+    const server = createServer({ maxHeaderSize: 8192 }, (req, res) => {
+        void (async () => {
+            if (!authorize(req, res, config))
+                return;
+            const isMcp = req.url === "/mcp";
+            const isInfo = req.url === "/health" || req.url === "/.well-known/mcp/server-card.json";
+            if (!isMcp && !isInfo) {
+                fail(res, 404, "Not found");
+                return;
+            }
+            const method = isMcp ? "POST" : "GET";
+            if (req.method !== method) {
+                res.setHeader("Allow", method);
+                fail(res, 405, "Method not allowed");
+                return;
+            }
+            if (isMcp && (req.headers["content-type"]?.split(";")[0].trim().toLowerCase() !== "application/json" ||
+                (req.headers["content-encoding"] !== undefined && req.headers["content-encoding"] !== "identity"))) {
+                fail(res, 415, "Only uncompressed application/json is supported");
+                return;
+            }
+            if (Number(req.headers["content-length"] || 0) > MAX_BODY_BYTES) {
+                fail(res, 413, "Request body too large");
+                return;
+            }
+            // No sessions are issued: a supplied session id must never become an auth bypass.
+            if (req.headers["mcp-session-id"] !== undefined) {
+                fail(res, 400, "HTTP MCP is stateless; session identifiers are unsupported");
+                return;
+            }
+            if (active >= MAX_ACTIVE_REQUESTS) {
+                fail(res, 503, "Too many active requests");
+                return;
+            }
+            active++;
+            let released = false;
+            const release = () => { if (!released) {
+                released = true;
+                active--;
+            } };
+            res.once("close", release);
+            res.once("finish", release);
+            res.setHeader("Cache-Control", "no-store");
+            const body = isMcp ? await readJsonBody(req) : undefined;
+            if (!res.destroyed)
+                await handle(req, res, body);
+        })().catch(error => {
+            if (!res.destroyed)
+                fail(res, error instanceof HttpFailure ? error.status : 500, error instanceof HttpFailure ? error.message : "Internal server error");
+        });
+    });
+    server.headersTimeout = 10_000;
+    server.requestTimeout = 15_000;
+    server.keepAliveTimeout = 5_000;
+    server.maxRequestsPerSocket = 100;
+    return server;
+}

package/dist/index.js

@@ -4,11 +4,16 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { z } from "zod";
 import { VERSION } from "./version.js";
-import { createServer } from "node:http";
+import { createPrivateHttpServer, readHttpConfig } from "./http-security.js";
+// MCP `initialize` response `instructions` field (ServerOptions.instructions in
+// the SDK) — operational guidance for the calling agent, distinct from the
+// package/marketing description in package.json and glama.json. Left unset
+// until 2026-09-18, which is why directories that introspect the live server
+// (e.g. Glama) reported "no recorded MCP instructions."
+const SERVER_INSTRUCTIONS = "Real-time Solana on-chain intelligence: KOL wallet trades, Pump.fun deployer reputation, token risk/holders/buyer-quality, wallet PnL, and the all-DEX trade tape. Call madeonsol_discovery first to see every endpoint and its x402 price. Auth is either a msk_ API key (MADEONSOL_API_KEY env var, madeonsol.com/pricing) or pay-per-call x402 micropayments (SVM_PRIVATE_KEY env var) — no signup required for x402. Prefer a single-item lookup (madeonsol_token_get, madeonsol_wallet_stats) before a heavier call (madeonsol_wallet_pnl, madeonsol_token_risk, madeonsol_token_trades) on the same mint/wallet. Free-tier live feeds (KOL/deployer alerts) are delayed 5 minutes; paid keys and x402 calls are real-time.";
 const BASE_URL = process.env.MADEONSOL_API_URL || "https://madeonsol.com";
 const MADEONSOL_API_KEY = process.env.MADEONSOL_API_KEY; // Native key from madeonsol.com/pricing
 const PRIVATE_KEY = process.env.SVM_PRIVATE_KEY; // x402 micropayments (for AI agents)
-const PORT = parseInt(process.env.PORT || "3100", 10);
 const MODE = process.env.MCP_TRANSPORT || "stdio"; // "stdio" or "http"
 let authMode = "none";
 let paidFetch = fetch;
@@ -1269,12 +1274,11 @@ function registerTools(server) {
     });
 }
 async function main() {
+    const httpConfig = MODE === "http" ? readHttpConfig() : undefined;
     await initAuth();
     if (MODE === "http") {
-        // HTTP transport for hosted environments (Smithery, etc.)
-        const httpServer = createServer();
-        const transports = new Map();
-        httpServer.on("request", async (req, res) => {
+        // Configuration is validated before authentication can initialize a signer.
+        const httpServer = createPrivateHttpServer(httpConfig, async (req, res, body) => {
             // Health check
             if (req.method === "GET" && req.url === "/health") {
                 res.writeHead(200, { "Content-Type": "application/json" });
@@ -1286,7 +1290,7 @@ async function main() {
                 res.writeHead(200, { "Content-Type": "application/json" });
                 res.end(JSON.stringify({
                     name: "madeonsol",
-                    description: "Solana KOL trading intelligence and deployer analytics. Real-time data from 1,000+ KOL wallets, 15,500+ Pump.fun deployers, 25,000+ scored alpha wallets, copy-trade rules, and wallet tracker. Supports MadeOnSol API key (msk_) or x402 micropayments.",
+                    description: "Solana KOL trading intelligence and deployer analytics. Real-time data from 1,000+ KOL wallets, 15,500+ Pump.fun deployers, 25,000+ scored alpha wallets, copy-trade rules, and wallet tracker. Private HTTP access with the operator's MadeOnSol API key (msk_).",
                     version: VERSION,
                     tools: [
                         { name: "madeonsol_kol_feed", description: "Get real-time Solana KOL trades from 1,000+ tracked wallets." },
@@ -1384,54 +1388,35 @@ async function main() {
                 }));
                 return;
             }
-            // MCP endpoint
-            const sessionId = req.headers["mcp-session-id"];
-            {
-                if (req.method === "POST") {
-                    let transport = sessionId ? transports.get(sessionId) : undefined;
-                    if (!transport) {
-                        transport = new StreamableHTTPServerTransport({
-                            sessionIdGenerator: undefined,
-                        });
-                        const server = new McpServer({ name: "madeonsol", version: VERSION });
-                        registerTools(server);
-                        await server.connect(transport);
-                    }
-                    await transport.handleRequest(req, res);
-                    return;
-                }
-                if (req.method === "GET" && sessionId) {
-                    const transport = transports.get(sessionId);
-                    if (transport) {
-                        await transport.handleRequest(req, res);
-                        return;
-                    }
-                }
-                if (req.method === "DELETE" && sessionId) {
-                    const transport = transports.get(sessionId);
-                    if (transport) {
-                        await transport.handleRequest(req, res);
-                        transports.delete(sessionId);
-                        return;
-                    }
-                }
+            // One server/transport per authenticated stateless POST /mcp.
+            const transport = new StreamableHTTPServerTransport({
+                sessionIdGenerator: undefined,
+                enableJsonResponse: true,
+                enableDnsRebindingProtection: true,
+                allowedHosts: httpConfig.allowedHosts,
+                allowedOrigins: [],
+            });
+            const server = new McpServer({ name: "madeonsol", version: VERSION }, { instructions: SERVER_INSTRUCTIONS });
+            res.once("close", () => { void server.close().catch(() => { }); });
+            registerTools(server);
+            await server.connect(transport);
+            if (res.destroyed) {
+                await server.close();
+                return;
             }
-            res.writeHead(404);
-            res.end("Not found");
+            await transport.handleRequest(req, res, body);
         });
-        // Bind to 127.0.0.1 only — defense in depth. UFW already blocks the port
-        // externally, but binding to all interfaces would expose the server to any
-        // misconfigured firewall rule. Override with HOST=0.0.0.0 if you ever need
-        // to expose it directly (e.g. for hosted environments behind a separate
-        // reverse proxy).
-        const HOST = process.env.HOST || "127.0.0.1";
-        httpServer.listen(PORT, HOST, () => {
-            console.error(`[madeonsol-mcp] HTTP server listening on ${HOST}:${PORT}`);
+        httpServer.on("error", () => {
+            console.error("[madeonsol-mcp] HTTP listener failed");
+            process.exitCode = 1;
+        });
+        httpServer.listen(httpConfig.port, httpConfig.host, () => {
+            console.error(`[madeonsol-mcp] HTTP server listening on ${httpConfig.host}:${httpConfig.port}/mcp (private operator only)`);
         });
     }
     else {
         // Stdio transport for local use (Claude Desktop, Cursor, Claude Code)
-        const server = new McpServer({ name: "madeonsol", version: VERSION });
+        const server = new McpServer({ name: "madeonsol", version: VERSION }, { instructions: SERVER_INSTRUCTIONS });
         registerTools(server);
         const transport = new StdioServerTransport();
         await server.connect(transport);
@@ -1440,5 +1425,8 @@ async function main() {
 // Only auto-run when executed as a program (CLI / spawned process), not when
 // the module is imported by a test for its exported pure helpers.
 if (process.env.MADEONSOL_MCP_NO_AUTORUN !== "1") {
-    main().catch(console.error);
+    main().catch(error => {
+        console.error(error instanceof Error ? error.message : "MCP startup failed");
+        process.exitCode = 1;
+    });
 }

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "1.27.0";
+export declare const VERSION = "2.0.0";

package/dist/version.js

@@ -1,2 +1,2 @@
 // AUTO-GENERATED by ../gen-version.mjs (npm prebuild) from package.json. Do not edit.
-export const VERSION = "1.27.0";
+export const VERSION = "2.0.0";

package/glama.json

@@ -4,8 +4,8 @@
     "madeonsol"
   ],
   "display_name": "MadeOnSol — Solana memecoin intelligence",
-  "description": "Real-time Solana memecoin trading intelligence — track 1,000+ KOL wallets with <3s latency on paid keys and x402 (free-tier live feeds are 5-min delayed), score 15,500+ Pump.fun deployers, surface multi-KOL coordination signals, run server-side copy-trade rules, and stream every DEX trade across 14 programs. Backtested first-touch scout signal (S-tier scouts attract ≥3 follow-on KOLs ~50% of the time vs 14% baseline). Free tier 200 requests per day (live feeds 5-min delayed), no payment to start; auth via msk_ API key or x402 micropayments.",
-  "version": "1.26.0",
+  "description": "Real-time Solana memecoin trading intelligence — track 2,000+ KOL wallets with sub-second latency on paid keys and x402 (free-tier live feeds are 5-min delayed), score 85,000+ reputation-profiled Pump.fun deployers out of 1.2M+ indexed, surface multi-KOL coordination signals, run server-side copy-trade rules, and stream every DEX trade across 14 programs. Backtested first-touch scout signal (S-tier scouts attract ≥3 follow-on KOLs ~50% of the time vs 14% baseline). Free tier 200 requests per day (live feeds 5-min delayed), no payment to start; auth via msk_ API key or x402 micropayments.",
+  "version": "1.27.1",
   "homepage": "https://madeonsol.com/solana-api",
   "repository": "https://github.com/madeonsol/mcp-server-madeonsol",
   "license": "MIT",
@@ -427,11 +427,32 @@
     {
       "name": "madeonsol_signal_performance",
       "description": "Signal performance stats for a named signal — hit rate, sample size, median outcome, and confidence window."
+    },
+    {
+      "name": "madeonsol_sniper_watchlist_list",
+      "description": "List your custom sniper watchlist (tracked deployer wallets, any tier). PRO+/ULTRA only."
+    },
+    {
+      "name": "madeonsol_sniper_watchlist_add",
+      "description": "Add one or many deployer wallets to your sniper watchlist. PRO+/ULTRA only."
+    },
+    {
+      "name": "madeonsol_sniper_watchlist_remove",
+      "description": "Remove a deployer wallet from your sniper watchlist. PRO+/ULTRA only."
+    },
+    {
+      "name": "madeonsol_wallet_tracker_relabel",
+      "description": "Rename (or clear) the label on a wallet already in your watchlist."
+    },
+    {
+      "name": "madeonsol_update_webhook",
+      "description": "Update a webhook's URL, subscribed events, or active state."
+    },
+    {
+      "name": "madeonsol_token_top_traders",
+      "description": "Wallets that made (or lost) the most on a token, ranked by realized PnL or ROI, enriched with KOL/alpha-wallet identity."
     }
   ],
-  "transports": [
-    "stdio",
-    "http"
-  ],
+  "transports": ["stdio"],
   "runtime": "node"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-server-madeonsol",
-  "version": "1.27.0",
+  "version": "2.0.0",
   "mcpName": "io.github.MadeOnSol/madeonsol",
   "description": "MCP server for MadeOnSol Solana KOL intelligence API — use from Claude, Cursor, or any MCP client. Free tier 200 req/day (live feeds 5-min delayed; paid is real-time), no payment to start.",
   "type": "module",