mpp32-mcp-server 1.0.2 → 1.1.0

package/dist/index.js

@@ -5,20 +5,61 @@ import { z } from "zod";
 const API_URL = process.env.MPP32_API_URL?.replace(/\/$/, "") || "https://mpp32.org";
 const PRIVATE_KEY = process.env.MPP32_PRIVATE_KEY;
 const SOLANA_PRIVATE_KEY = process.env.MPP32_SOLANA_PRIVATE_KEY;
+// MPP32_AGENT_KEY is the canonical name; MPP32_API_KEY is accepted as an alias
+// because earlier docs used that name.
+const AGENT_KEY = process.env.MPP32_AGENT_KEY ?? process.env.MPP32_API_KEY;
 const server = new McpServer({
     name: "mpp32",
-    version: "1.0.0",
+    version: "1.1.0",
 });
-// ── Tool 1: list_mpp32_services ──
-server.tool("list_mpp32_services", "Browse the MPP32 ecosystem of machine-payable APIs. Returns all available services with their names, descriptions, categories, prices, and proxy URLs. Optionally filter by category.", {
+function buildHeaders(extra = {}) {
+    const headers = { ...extra };
+    if (AGENT_KEY)
+        headers["X-Agent-Key"] = AGENT_KEY;
+    return headers;
+}
+function isHttpCallable(svc) {
+    if (svc.source === "native")
+        return true;
+    const url = svc.endpointUrl ?? "";
+    if (!url)
+        return false;
+    if (url.startsWith("npx://") || url.startsWith("stdio://"))
+        return false;
+    return /^https?:\/\//.test(url);
+}
+// ── Tool 1: list_mpp32_services ─────────────────────────────────────────────
+server.tool("list_mpp32_services", "Browse the MPP32 federated catalog of machine-payable APIs and data services. Includes native MPP32 services (callable end-to-end through this MCP), the x402 Bazaar (USDC on Solana), curated free APIs (DexScreener, Jupiter, CoinGecko health, httpbin, etc.), and the public MCP Registry (npx-installable servers; listing-only). Each result indicates whether it is callable through `call_mpp32_endpoint` or listing-only. Use the `category`, `q`, or `source` filters to narrow down.", {
     category: z
         .string()
         .optional()
-        .describe("Filter by category slug (e.g. 'ai-inference', 'token-scanner', 'price-oracle', 'web-search'). Omit to list all services."),
-}, async ({ category }) => {
+        .describe("Filter by category slug (e.g. 'ai-inference', 'token-scanner', 'price-oracle', 'web-search', 'defi-analytics')."),
+    q: z
+        .string()
+        .optional()
+        .describe("Free-text search across name, description, tags, and category."),
+    source: z
+        .enum(["native", "x402-bazaar", "mcp-registry", "curated", "free"])
+        .optional()
+        .describe("Filter by catalog source. 'native' = callable end-to-end; 'curated'/'free' = often callable; 'x402-bazaar'/'mcp-registry' = mostly listing-only."),
+    limit: z
+        .number()
+        .int()
+        .min(1)
+        .max(500)
+        .optional()
+        .describe("Max results (default 100, max 500)."),
+}, async ({ category, q, source, limit }) => {
     try {
-        const url = new URL("/api/submissions", API_URL);
-        const res = await fetch(url.toString());
+        const url = new URL("/api/agent/services", API_URL);
+        if (category)
+            url.searchParams.set("category", category);
+        if (q)
+            url.searchParams.set("q", q);
+        if (source)
+            url.searchParams.set("source", source);
+        url.searchParams.set("limit", String(limit ?? 100));
+        const res = await fetch(url.toString(), { headers: buildHeaders() });
         if (!res.ok) {
             return {
                 content: [
@@ -30,34 +71,52 @@ server.tool("list_mpp32_services", "Browse the MPP32 ecosystem of machine-payabl
             };
         }
         const json = (await res.json());
-        let services = json.data;
-        if (category) {
-            services = services.filter((s) => s.category.toLowerCase() === category.toLowerCase());
-        }
+        const services = json.data.services ?? [];
         if (services.length === 0) {
-            const msg = category
-                ? `No services found in category "${category}". Try listing all services to see available categories.`
-                : "No services are currently listed in the MPP32 ecosystem.";
-            return { content: [{ type: "text", text: msg }] };
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: `No services matched. Filters: category=${category ?? "any"}, q=${q ?? "any"}, source=${source ?? "any"}.`,
+                    },
+                ],
+            };
         }
         const lines = services.map((s) => {
-            const price = s.pricePerQuery
-                ? `$${s.pricePerQuery} USD (pathUSD or USDC)`
-                : "Free";
+            const callable = isHttpCallable(s);
+            const priceLabel = s.basePrice === null
+                ? "Pay provider directly"
+                : s.basePrice === 0
+                    ? "Free"
+                    : `$${s.basePrice} per query`;
+            const protos = s.protocols?.length ? s.protocols.join(", ") : (s.primaryProtocol ?? "—");
             return [
-                `## ${s.name}`,
+                `## ${s.name}${s.verified ? " ✓" : ""}`,
                 `- **Slug:** \`${s.slug}\``,
-                `- **Category:** ${s.category}`,
-                `- **Price:** ${price} per query`,
-                `- **Description:** ${s.shortDescription}`,
-                `- **Proxy URL:** \`${API_URL}/api/proxy/${s.slug}\``,
-                `- **Queries served:** ${s.queryCount.toLocaleString()}`,
-                s.creatorName ? `- **Creator:** ${s.creatorName}` : null,
+                `- **Source:** ${s.source}`,
+                `- **Category:** ${s.category ?? "—"}`,
+                `- **Price:** ${priceLabel}`,
+                `- **Protocols:** ${protos}`,
+                `- **Callable via this MCP:** ${callable ? "Yes — use `call_mpp32_endpoint`" : "No — listing only"}`,
+                s.description ? `- **Description:** ${s.description}` : null,
+                s.endpointUrl && !callable ? `- **Install / direct URL:** \`${s.endpointUrl}\`` : null,
+                s.websiteUrl ? `- **Website:** ${s.websiteUrl}` : null,
             ]
                 .filter(Boolean)
                 .join("\n");
         });
-        const header = `# MPP32 Ecosystem — ${services.length} service${services.length !== 1 ? "s" : ""}${category ? ` in "${category}"` : ""}\n\nTo call any service, use the \`call_mpp32_endpoint\` tool with the service slug.\n`;
+        const counts = json.data.counts;
+        const callableCount = services.filter(isHttpCallable).length;
+        const header = [
+            `# MPP32 Federated Catalog — ${services.length} result${services.length !== 1 ? "s" : ""}`,
+            ``,
+            `**Sources:** ${counts.native} native + ${counts.external} external. **Callable through this MCP:** ${callableCount}.`,
+            ``,
+            AGENT_KEY
+                ? `Calls through \`call_mpp32_endpoint\` are tracked in your dashboard at ${API_URL}/agent-console (your X-Agent-Key is set).`
+                : `**Tip:** set \`MPP32_AGENT_KEY\` in your MCP config to track usage at ${API_URL}/agent-console. Get a key at ${API_URL}/agent-console.`,
+            ``,
+        ].join("\n");
         return {
             content: [{ type: "text", text: header + "\n" + lines.join("\n\n") }],
         };
@@ -73,244 +132,484 @@ server.tool("list_mpp32_services", "Browse the MPP32 ecosystem of machine-payabl
         };
     }
 });
-// ── Tool 2: call_mpp32_endpoint ──
-server.tool("call_mpp32_endpoint", "Call a machine-payable API endpoint on MPP32. Handles the full HTTP 402 payment flow automatically via Tempo (pathUSD) or x402 (USDC on Solana). Requires MPP32_PRIVATE_KEY (Tempo) or MPP32_SOLANA_PRIVATE_KEY (x402) environment variable.", {
+// ── Tool 2: call_mpp32_endpoint ─────────────────────────────────────────────
+server.tool("call_mpp32_endpoint", "Call any HTTP-callable service in the MPP32 federated catalog. Free services return immediately. Paid services return a 402 challenge that this tool will sign and retry automatically when a payment key (MPP32_SOLANA_PRIVATE_KEY for x402/USDC, MPP32_PRIVATE_KEY for Tempo/pathUSD) is configured. Set MPP32_AGENT_KEY for dashboard tracking. Use `list_mpp32_services` first to find a slug. Listing-only entries (npx-installable MCP servers, x402 Bazaar non-mirrored items) cannot be called through this tool — install them directly per the catalog instructions.", {
     slug: z
         .string()
-        .describe("The service slug to call (e.g. 'solana-token-intelligence'). Use list_mpp32_services to discover available slugs."),
+        .describe("Service slug from `list_mpp32_services` (e.g. 'mpp32-intelligence')."),
     method: z
         .enum(["GET", "POST", "PUT", "DELETE"])
-        .default("GET")
-        .describe("HTTP method for the request"),
+        .default("POST")
+        .describe("HTTP method."),
     body: z
-        .string()
+        .union([z.string(), z.record(z.unknown())])
         .optional()
-        .describe("JSON request body (for POST/PUT requests)"),
+        .describe("JSON body (object or stringified) for POST/PUT/DELETE."),
     query: z
         .record(z.string())
         .optional()
-        .describe("URL query parameters as key-value pairs"),
+        .describe("URL query parameters as key-value pairs."),
 }, async ({ slug, method, body, query }) => {
-    if (!PRIVATE_KEY && !SOLANA_PRIVATE_KEY) {
+    // Normalize body to an object so it can be JSON.stringified by the upstream call
+    let parsedBody = body;
+    if (typeof body === "string") {
+        try {
+            parsedBody = body.length > 0 ? JSON.parse(body) : undefined;
+        }
+        catch {
+            parsedBody = body;
+        }
+    }
+    if (AGENT_KEY) {
+        return await callViaAgentExecute(slug, method, parsedBody, query);
+    }
+    // Legacy path — only works for native services with payment keys
+    return await callViaLegacyProxy(slug, method, parsedBody, query);
+});
+// ── Tool 3: get_solana_token_intelligence ───────────────────────────────────
+server.tool("get_solana_token_intelligence", "Get real-time Solana token intelligence from the MPP32 Intelligence Oracle. Returns alpha score (0-100), rug risk assessment, whale activity, smart money signals, 24h pump probability, projected ROI ranges, and aggregated DexScreener/Jupiter/CoinGecko market data. Costs $0.008 per query, paid automatically via x402 (USDC on Solana) or Tempo (pathUSD on Eth L2). M32 token holders receive up to 40% discount once their wallet is signature-verified. Set MPP32_AGENT_KEY in config to attribute calls to your dashboard.", {
+    token: z
+        .string()
+        .describe("Solana token mint address or ticker symbol (e.g. SOL, BONK, JUP, M32, or full base58 address)."),
+    walletAddress: z
+        .string()
+        .optional()
+        .describe("Optional Solana wallet address. Used for M32-holder discount preview; discount only applies after SIWS wallet-signature verification."),
+}, async ({ token, walletAddress }) => {
+    if (AGENT_KEY) {
+        // Route through /api/agent/execute so the call shows up in the user's dashboard.
+        return await callViaAgentExecute("intelligence", "POST", { token, ...(walletAddress ? { walletAddress } : {}) }, undefined);
+    }
+    // Legacy path — direct call to /api/intelligence with manual 402 handling.
+    return await legacyIntelligenceCall(token, walletAddress);
+});
+// ── Core: agent/execute path with 402 sign-and-retry ────────────────────────
+async function callViaAgentExecute(service, method, body, query) {
+    try {
+        const execUrl = new URL("/api/agent/execute", API_URL).toString();
+        const reqBody = JSON.stringify({
+            service,
+            method,
+            ...(body !== undefined ? { body } : {}),
+            ...(query ? { query } : {}),
+        });
+        // Round 1: no payment headers
+        const firstRes = await fetch(execUrl, {
+            method: "POST",
+            headers: buildHeaders({ "Content-Type": "application/json" }),
+            body: reqBody,
+        });
+        // Hard errors from /execute (auth, validation, not-callable)
+        if (!firstRes.ok) {
+            const errJson = (await firstRes.json().catch(() => null));
+            return formatExecuteHardError(firstRes.status, errJson);
+        }
+        const firstJson = (await firstRes.json());
+        // Wrapped 402 — sign and retry if we have keys
+        const paymentRequired = detectPaymentRequired(firstJson);
+        if (paymentRequired) {
+            if (!PRIVATE_KEY && !SOLANA_PRIVATE_KEY) {
+                return paymentKeyMissingMessage(firstJson, paymentRequired);
+            }
+            return await signAndRetry(execUrl, reqBody, paymentRequired);
+        }
+        // Free or otherwise-successful call
+        return formatExecuteSuccess(firstJson);
+    }
+    catch (err) {
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: `Network error reaching ${API_URL}: ${err instanceof Error ? err.message : String(err)}. Check connectivity and that MPP32_API_URL (if set) is correct.`,
+                },
+            ],
+        };
+    }
+}
+function detectPaymentRequired(resp) {
+    const result = resp?.data?.result;
+    if (!result?.error || result.error.code !== "PAYMENT_REQUIRED")
+        return null;
+    const headers = result.error.challenge?.headers ?? {};
+    return {
+        wwwAuthenticate: headers["www-authenticate"],
+        paymentRequired: headers["payment-required"],
+        rawHeaders: headers,
+        priceQuoted: result.error.challenge?.priceQuoted ?? resp.data.meta?.priceQuoted ?? 0,
+        serviceName: resp.data.meta?.service ?? "service",
+    };
+}
+async function signAndRetry(execUrl, reqBody, challenge) {
+    const paymentHeaders = {};
+    let usedProtocol = "";
+    // Prefer x402 if Solana key present and server offered Payment-Required
+    if (challenge.paymentRequired && SOLANA_PRIVATE_KEY) {
+        try {
+            paymentHeaders["X-Payment"] = await completeX402Payment(challenge.paymentRequired, SOLANA_PRIVATE_KEY);
+            usedProtocol = "USDC (x402)";
+        }
+        catch (err) {
+            // Fall through to Tempo if available
+            if (challenge.wwwAuthenticate && PRIVATE_KEY) {
+                const parsed = parseWwwAuthenticate(challenge.wwwAuthenticate);
+                try {
+                    const token = await completeTempoPayment(parsed.params, PRIVATE_KEY);
+                    paymentHeaders["Authorization"] = `Payment ${token}`;
+                    usedProtocol = "pathUSD (Tempo)";
+                }
+                catch (tempoErr) {
+                    return paymentFailedMessage(challenge, "x402+tempo", `${err}; ${tempoErr}`);
+                }
+            }
+            else {
+                return paymentFailedMessage(challenge, "x402", err);
+            }
+        }
+    }
+    else if (challenge.wwwAuthenticate && PRIVATE_KEY) {
+        const parsed = parseWwwAuthenticate(challenge.wwwAuthenticate);
+        if (!parsed.scheme || !parsed.params) {
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: `Could not parse Tempo challenge. WWW-Authenticate: ${challenge.wwwAuthenticate}`,
+                    },
+                ],
+            };
+        }
+        try {
+            const token = await completeTempoPayment(parsed.params, PRIVATE_KEY);
+            paymentHeaders["Authorization"] = `Payment ${token}`;
+            usedProtocol = "pathUSD (Tempo)";
+        }
+        catch (err) {
+            return paymentFailedMessage(challenge, "tempo", err);
+        }
+    }
+    else {
+        const offered = [
+            challenge.wwwAuthenticate ? "Tempo (pathUSD)" : null,
+            challenge.paymentRequired ? "x402 (USDC)" : null,
+        ]
+            .filter(Boolean)
+            .join(", ");
+        const have = [PRIVATE_KEY ? "Tempo" : null, SOLANA_PRIVATE_KEY ? "x402" : null]
+            .filter(Boolean)
+            .join(", ") || "none";
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: `No compatible payment method. Server offers: ${offered}. You have keys for: ${have}.`,
+                },
+            ],
+        };
+    }
+    // Round 2: with payment headers
+    const secondRes = await fetch(execUrl, {
+        method: "POST",
+        headers: buildHeaders({ "Content-Type": "application/json", ...paymentHeaders }),
+        body: reqBody,
+    });
+    if (!secondRes.ok) {
+        const errJson = (await secondRes.json().catch(() => null));
+        return formatExecuteHardError(secondRes.status, errJson);
+    }
+    const secondJson = (await secondRes.json());
+    return formatExecuteSuccess(secondJson, usedProtocol);
+}
+function formatExecuteSuccess(resp, protoOverride) {
+    const meta = resp.data.meta;
+    const result = resp.data.result;
+    const formatted = (() => {
+        try {
+            return JSON.stringify(result, null, 2);
+        }
+        catch {
+            return String(result);
+        }
+    })();
+    const lines = [];
+    const safeStatus = meta?.statusCode ?? 0;
+    const safeLatency = meta?.latencyMs ?? 0;
+    lines.push(`**${meta?.service ?? "service"}** — HTTP ${safeStatus} (${safeLatency}ms)`);
+    if (meta?.isFree) {
+        lines.push(`Free service. No payment.`);
+    }
+    else if (meta?.settled) {
+        const proto = protoOverride ?? meta.paymentMethod ?? "—";
+        const txLine = meta.settlementTxSignature
+            ? `Settlement tx: ${meta.settlementExplorerUrl ?? meta.settlementTxSignature}`
+            : "Settled by upstream facilitator.";
+        const settled = typeof meta.priceSettled === "number" ? meta.priceSettled.toFixed(6) : "—";
+        lines.push(`Paid $${settled} via ${proto}. ${txLine}`);
+        if ((meta.discountPercent ?? 0) > 0) {
+            lines.push(`M32 holder discount applied: ${meta.discountPercent}%.`);
+        }
+    }
+    else if (meta?.paymentMethod === "unsettled") {
+        lines.push(`Service responded but no payment was verified. This should not happen for paid services.`);
+    }
+    lines.push("");
+    lines.push("```json");
+    lines.push(formatted);
+    lines.push("```");
+    return { content: [{ type: "text", text: lines.join("\n") }] };
+}
+function formatExecuteHardError(status, body) {
+    const code = body?.error?.code;
+    if (code === "NOT_HTTP_CALLABLE") {
         return {
             content: [
                 {
                     type: "text",
                     text: [
-                        "**No payment key configured.**",
-                        "",
-                        "To make paid API calls, set at least one payment key in your MCP server configuration:",
-                        "",
-                        "```json",
-                        '{',
-                        '  "mcpServers": {',
-                        '    "mpp32": {',
-                        '      "command": "npx",',
-                        '      "args": ["mpp32-mcp-server"],',
-                        '      "env": {',
-                        '        "MPP32_PRIVATE_KEY": "your-evm-private-key (for Tempo/pathUSD)",',
-                        '        "MPP32_SOLANA_PRIVATE_KEY": "your-solana-private-key (for x402/USDC)"',
-                        "      }",
-                        "    }",
-                        "  }",
-                        "}",
-                        "```",
-                        "",
-                        "Provide either key — or both for maximum compatibility.",
-                        "- **MPP32_PRIVATE_KEY**: EVM key for a wallet funded with pathUSD on Tempo.",
-                        "- **MPP32_SOLANA_PRIVATE_KEY**: Solana key for a wallet funded with USDC.",
+                        `**Not callable through HTTP.**`,
+                        ``,
+                        body?.error?.message ?? "This service is a stdio MCP server.",
+                        body?.error?.installCommand ? `\nInstall: \`${body.error.installCommand}\`` : "",
+                        body?.error?.hint ? `\nHint: ${body.error.hint}` : "",
                     ].join("\n"),
                 },
             ],
         };
     }
+    if (code === "AUTH_REQUIRED" || status === 401) {
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: [
+                        `**Agent session is missing or invalid.**`,
+                        ``,
+                        `Set \`MPP32_AGENT_KEY\` in your MCP config (the value of \`apiKey\` from POST /api/agent/sessions).`,
+                        `Get one at ${API_URL}/agent-console.`,
+                        body?.error?.message ? `\nServer said: ${body.error.message}` : "",
+                    ].join("\n"),
+                },
+            ],
+        };
+    }
+    if (code === "SERVICE_NOT_FOUND") {
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: `Service not found. Use \`list_mpp32_services\` to discover valid slugs.`,
+                },
+            ],
+        };
+    }
+    return {
+        content: [
+            {
+                type: "text",
+                text: `MPP32 returned HTTP ${status}: ${body?.error?.message ?? "unknown error"}`,
+            },
+        ],
+    };
+}
+function paymentKeyMissingMessage(resp, challenge) {
+    const offered = [
+        challenge.wwwAuthenticate ? "Tempo (pathUSD on Ethereum L2)" : null,
+        challenge.paymentRequired ? "x402 (USDC on Solana)" : null,
+    ]
+        .filter(Boolean)
+        .join(" or ");
+    const price = challenge.priceQuoted ?? resp.data.meta.priceQuoted;
+    return {
+        content: [
+            {
+                type: "text",
+                text: [
+                    `**${resp.data.meta.service} requires payment** (~$${price}).`,
+                    ``,
+                    `The provider accepts: ${offered || "(unknown)"}.`,
+                    ``,
+                    `To enable automatic payment, add a private key to your MCP config:`,
+                    ``,
+                    "```json",
+                    "{",
+                    '  "mcpServers": {',
+                    '    "mpp32": {',
+                    '      "command": "npx",',
+                    '      "args": ["mpp32-mcp-server"],',
+                    '      "env": {',
+                    AGENT_KEY ? `        "MPP32_AGENT_KEY": "${AGENT_KEY.slice(0, 12)}…",` : "",
+                    '        "MPP32_SOLANA_PRIVATE_KEY": "<solana-base58-key for USDC>",',
+                    '        "MPP32_PRIVATE_KEY": "<EVM-hex-key for pathUSD>"',
+                    "      }",
+                    "    }",
+                    "  }",
+                    "}",
+                    "```",
+                    ``,
+                    `Free services (DexScreener, Jupiter price, CoinGecko ping, httpbin) work without any private key.`,
+                ]
+                    .filter((l) => l !== "")
+                    .join("\n"),
+            },
+        ],
+    };
+}
+function paymentFailedMessage(challenge, proto, err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return {
+        content: [
+            {
+                type: "text",
+                text: [
+                    `**Payment failed (${proto})** for ${challenge.serviceName} ($${challenge.priceQuoted}).`,
+                    ``,
+                    msg,
+                    ``,
+                    `Common causes: insufficient balance, malformed key, or expired challenge nonce.`,
+                ].join("\n"),
+            },
+        ],
+    };
+}
+// ── Legacy path (no MPP32_AGENT_KEY) ────────────────────────────────────────
+async function callViaLegacyProxy(slug, method, body, query) {
     try {
-        // First, get service info to confirm it exists and show the price
-        const infoUrl = new URL(`/api/proxy/${encodeURIComponent(slug)}/info`, API_URL);
-        const infoRes = await fetch(infoUrl.toString());
+        // Without an agent key, only native /api/proxy/<slug> is reachable.
+        // We fetch /info first to detect that the slug exists as a native service.
+        const infoUrl = new URL(`/api/proxy/${encodeURIComponent(slug)}/info`, API_URL).toString();
+        const infoRes = await fetch(infoUrl);
         if (!infoRes.ok) {
-            if (infoRes.status === 404) {
-                return {
-                    content: [
-                        {
-                            type: "text",
-                            text: `Service "${slug}" not found. Use list_mpp32_services to see available services.`,
-                        },
-                    ],
-                };
-            }
             return {
                 content: [
                     {
                         type: "text",
-                        text: `Error checking service: HTTP ${infoRes.status}`,
+                        text: [
+                            `Service "${slug}" is not a native MPP32 service.`,
+                            ``,
+                            `Without \`MPP32_AGENT_KEY\` set, only native services are callable. To call federated catalog entries (free curated APIs, x402 Bazaar mirrors, etc.), add \`MPP32_AGENT_KEY\` to your MCP config — get one at ${API_URL}/agent-console.`,
+                        ].join("\n"),
                     },
                 ],
             };
         }
         const info = (await infoRes.json());
-        const price = info.data.pricePerQuery ?? 0.001;
-        // Build the proxy request URL
         const proxyUrl = new URL(`/api/proxy/${encodeURIComponent(slug)}`, API_URL);
-        if (query) {
-            for (const [key, value] of Object.entries(query)) {
-                proxyUrl.searchParams.set(key, value);
-            }
-        }
-        // Step 1: Initial request to get the 402 payment challenge
-        const headers = {
-            Accept: "application/json",
-        };
-        if (body) {
-            headers["Content-Type"] = "application/json";
-        }
+        if (query)
+            for (const [k, v] of Object.entries(query))
+                proxyUrl.searchParams.set(k, v);
+        const baseHeaders = { Accept: "application/json" };
+        if (body !== undefined)
+            baseHeaders["Content-Type"] = "application/json";
         const challengeRes = await fetch(proxyUrl.toString(), {
             method,
-            headers,
-            body: method !== "GET" ? body : undefined,
+            headers: baseHeaders,
+            body: method !== "GET" && body !== undefined ? JSON.stringify(body) : undefined,
         });
-        // If we get a non-402 response, the endpoint might not require payment
         if (challengeRes.status !== 402) {
-            const responseText = await challengeRes.text();
+            const text = await challengeRes.text();
             let formatted;
             try {
-                formatted = JSON.stringify(JSON.parse(responseText), null, 2);
+                formatted = JSON.stringify(JSON.parse(text), null, 2);
             }
             catch {
-                formatted = responseText;
+                formatted = text;
             }
             return {
                 content: [
                     {
                         type: "text",
-                        text: `**${info.data.name}** responded with HTTP ${challengeRes.status}:\n\n\`\`\`json\n${formatted}\n\`\`\``,
+                        text: `**${info.data.name}** — HTTP ${challengeRes.status}\n\n\`\`\`json\n${formatted}\n\`\`\``,
                     },
                 ],
             };
         }
-        // Step 2: Parse the 402 challenge — detect available protocols
-        const wwwAuth = challengeRes.headers.get("www-authenticate");
-        const paymentRequiredHeader = challengeRes.headers.get("payment-required");
-        if (!wwwAuth && !paymentRequiredHeader) {
+        // Got 402 — sign with available keys
+        const wwwAuth = challengeRes.headers.get("www-authenticate") ?? undefined;
+        const paymentRequired = challengeRes.headers.get("payment-required") ?? undefined;
+        const challenge = {
+            wwwAuthenticate: wwwAuth,
+            paymentRequired,
+            rawHeaders: {},
+            priceQuoted: info.data.pricePerQuery ?? 0,
+            serviceName: info.data.name,
+        };
+        if (!PRIVATE_KEY && !SOLANA_PRIVATE_KEY) {
             return {
                 content: [
                     {
                         type: "text",
-                        text: "Received 402 but no payment challenge headers. The payment protocol may have changed.",
+                        text: [
+                            `**${info.data.name}** requires payment ($${info.data.pricePerQuery}).`,
+                            ``,
+                            `Add a payment key to your MCP config (\`MPP32_SOLANA_PRIVATE_KEY\` for USDC or \`MPP32_PRIVATE_KEY\` for pathUSD), or set \`MPP32_AGENT_KEY\` to use the agent execute path.`,
+                        ].join("\n"),
                     },
                 ],
             };
         }
-        // Step 3: Choose protocol and complete payment
-        let paymentAuthHeader;
-        let paymentAuthKey;
-        let usedProtocol;
-        // Prefer x402 if Solana key is available and server supports it
-        if (paymentRequiredHeader && SOLANA_PRIVATE_KEY) {
+        const paymentHeaders = {};
+        let usedProtocol = "";
+        if (paymentRequired && SOLANA_PRIVATE_KEY) {
             try {
-                const x402Token = await completeX402Payment(paymentRequiredHeader, SOLANA_PRIVATE_KEY);
-                paymentAuthHeader = x402Token;
-                paymentAuthKey = "X-Payment";
+                paymentHeaders["X-Payment"] = await completeX402Payment(paymentRequired, SOLANA_PRIVATE_KEY);
                 usedProtocol = "USDC (x402)";
             }
             catch (err) {
-                // Fall back to Tempo if x402 fails and Tempo key is available
                 if (wwwAuth && PRIVATE_KEY) {
-                    const challengeParams = parseWwwAuthenticate(wwwAuth);
-                    if (!challengeParams.scheme) {
-                        return { content: [{ type: "text", text: `x402 payment failed and could not parse Tempo challenge.` }] };
+                    const parsed = parseWwwAuthenticate(wwwAuth);
+                    try {
+                        const token = await completeTempoPayment(parsed.params, PRIVATE_KEY);
+                        paymentHeaders["Authorization"] = `Payment ${token}`;
+                        usedProtocol = "pathUSD (Tempo)";
+                    }
+                    catch (te) {
+                        return paymentFailedMessage(challenge, "x402+tempo", `${err}; ${te}`);
                     }
-                    paymentAuthHeader = await completeTempoPayment(challengeParams.params, PRIVATE_KEY);
-                    paymentAuthKey = "Authorization";
-                    paymentAuthHeader = `Payment ${paymentAuthHeader}`;
-                    usedProtocol = "pathUSD (Tempo)";
                 }
                 else {
-                    return {
-                        content: [
-                            {
-                                type: "text",
-                                text: [
-                                    `**x402 payment failed** for ${info.data.name} ($${price}):`,
-                                    "",
-                                    err instanceof Error ? err.message : String(err),
-                                    "",
-                                    "Ensure your Solana wallet has sufficient USDC balance.",
-                                ].join("\n"),
-                            },
-                        ],
-                    };
+                    return paymentFailedMessage(challenge, "x402", err);
                 }
             }
         }
         else if (wwwAuth && PRIVATE_KEY) {
-            const challengeParams = parseWwwAuthenticate(wwwAuth);
-            if (!challengeParams.scheme || !challengeParams.params) {
-                return { content: [{ type: "text", text: `Could not parse payment challenge. WWW-Authenticate: ${wwwAuth}` }] };
-            }
+            const parsed = parseWwwAuthenticate(wwwAuth);
             try {
-                const token = await completeTempoPayment(challengeParams.params, PRIVATE_KEY);
-                paymentAuthHeader = `Payment ${token}`;
-                paymentAuthKey = "Authorization";
+                const token = await completeTempoPayment(parsed.params, PRIVATE_KEY);
+                paymentHeaders["Authorization"] = `Payment ${token}`;
                 usedProtocol = "pathUSD (Tempo)";
             }
             catch (err) {
-                return {
-                    content: [
-                        {
-                            type: "text",
-                            text: [
-                                `**Tempo payment failed** for ${info.data.name} ($${price}):`,
-                                "",
-                                err instanceof Error ? err.message : String(err),
-                                "",
-                                "Ensure your wallet has sufficient pathUSD balance on Tempo.",
-                            ].join("\n"),
-                        },
-                    ],
-                };
+                return paymentFailedMessage(challenge, "tempo", err);
             }
         }
         else {
-            const available = [wwwAuth ? "Tempo (pathUSD)" : null, paymentRequiredHeader ? "x402 (USDC)" : null].filter(Boolean).join(", ");
-            const configured = [PRIVATE_KEY ? "Tempo" : null, SOLANA_PRIVATE_KEY ? "x402" : null].filter(Boolean).join(", ");
             return {
                 content: [
                     {
                         type: "text",
-                        text: `No compatible payment method. Server offers: ${available}. You have keys for: ${configured || "none"}.`,
+                        text: `No compatible payment method.`,
                     },
                 ],
             };
         }
-        // Step 4: Retry with payment receipt
-        const authedRes = await fetch(proxyUrl.toString(), {
+        const paidRes = await fetch(proxyUrl.toString(), {
             method,
-            headers: {
-                ...headers,
-                [paymentAuthKey]: paymentAuthHeader,
-            },
-            body: method !== "GET" ? body : undefined,
+            headers: { ...baseHeaders, ...paymentHeaders },
+            body: method !== "GET" && body !== undefined ? JSON.stringify(body) : undefined,
         });
-        const responseText = await authedRes.text();
+        const paidText = await paidRes.text();
         let formatted;
         try {
-            formatted = JSON.stringify(JSON.parse(responseText), null, 2);
+            formatted = JSON.stringify(JSON.parse(paidText), null, 2);
         }
         catch {
-            formatted = responseText;
+            formatted = paidText;
         }
         return {
             content: [
                 {
                     type: "text",
-                    text: [
-                        `**${info.data.name}** — HTTP ${authedRes.status} (paid $${price} via ${usedProtocol})`,
-                        "",
-                        "```json",
-                        formatted,
-                        "```",
-                    ].join("\n"),
+                    text: `**${info.data.name}** — HTTP ${paidRes.status} (paid $${info.data.pricePerQuery} via ${usedProtocol})\n\n\`\`\`json\n${formatted}\n\`\`\``,
                 },
             ],
         };
@@ -320,37 +619,24 @@ server.tool("call_mpp32_endpoint", "Call a machine-payable API endpoint on MPP32
             content: [
                 {
                     type: "text",
-                    text: `Request failed: ${err instanceof Error ? err.message : String(err)}`,
+                    text: `Network error reaching ${API_URL}: ${err instanceof Error ? err.message : String(err)}`,
                 },
             ],
         };
     }
-});
-// ── Tool 3: get_solana_token_intelligence ──
-server.tool("get_solana_token_intelligence", "Get comprehensive Solana token intelligence including alpha score (0-100), rug risk assessment, whale activity tracking, smart money signals, 24h pump probability, projected ROI ranges, and real-time market data from DexScreener, Jupiter, and CoinGecko. Accepts any token address or ticker symbol. M32 token holders receive up to 40% discount.", {
-    token: z
-        .string()
-        .describe("Solana token mint address or ticker symbol (e.g. SOL, BONK, JUP, or full base58 address)"),
-    walletAddress: z
-        .string()
-        .optional()
-        .describe("Optional Solana wallet address for M32 token holder discount verification"),
-}, async ({ token, walletAddress }) => {
+}
+async function legacyIntelligenceCall(token, walletAddress) {
     try {
-        const headers = {
-            "Content-Type": "application/json",
-        };
-        if (walletAddress) {
-            headers["X-Wallet-Address"] = walletAddress;
-        }
-        // First request to get the 402 challenge
-        const challengeRes = await fetch(`${API_URL}/api/intelligence`, {
+        const reqHeaders = { "Content-Type": "application/json" };
+        if (walletAddress)
+            reqHeaders["X-Wallet-Address"] = walletAddress;
+        const res = await fetch(`${API_URL}/api/intelligence`, {
             method: "POST",
-            headers,
+            headers: reqHeaders,
             body: JSON.stringify({ token }),
         });
-        if (challengeRes.status !== 402) {
-            const text = await challengeRes.text();
+        if (res.status !== 402) {
+            const text = await res.text();
             let formatted;
             try {
                 formatted = JSON.stringify(JSON.parse(text), null, 2);
@@ -358,87 +644,105 @@ server.tool("get_solana_token_intelligence", "Get comprehensive Solana token int
             catch {
                 formatted = text;
             }
-            if (challengeRes.ok) {
+            if (res.ok) {
                 return {
                     content: [
                         {
                             type: "text",
-                            text: `**Solana Token Intelligence** for \`${token}\`:\n\n\`\`\`json\n${formatted}\n\`\`\``,
+                            text: `**Solana Token Intelligence** — \`${token}\`\n\n\`\`\`json\n${formatted}\n\`\`\``,
                         },
                     ],
                 };
             }
             return {
-                content: [
-                    {
-                        type: "text",
-                        text: `Error: HTTP ${challengeRes.status}\n\n${formatted}`,
-                    },
-                ],
+                content: [{ type: "text", text: `Error: HTTP ${res.status}\n\n${formatted}` }],
             };
         }
-        // Handle payment
-        const wwwAuth = challengeRes.headers.get("www-authenticate");
-        const paymentRequired = challengeRes.headers.get("payment-required");
         if (!PRIVATE_KEY && !SOLANA_PRIVATE_KEY) {
             return {
                 content: [
                     {
                         type: "text",
-                        text: "Payment required ($0.008 per query). Set MPP32_PRIVATE_KEY or MPP32_SOLANA_PRIVATE_KEY in your MCP config to enable automatic payments.",
+                        text: [
+                            "Intelligence Oracle requires payment ($0.008 per query).",
+                            "",
+                            "Set `MPP32_AGENT_KEY` (recommended — also gives dashboard tracking) and/or `MPP32_SOLANA_PRIVATE_KEY` / `MPP32_PRIVATE_KEY` in your MCP config.",
+                            "",
+                            `Create a session at ${API_URL}/agent-console.`,
+                        ].join("\n"),
                     },
                 ],
             };
         }
-        let paymentHeaders = {};
+        const wwwAuth = res.headers.get("www-authenticate") ?? undefined;
+        const paymentRequired = res.headers.get("payment-required") ?? undefined;
+        const paymentHeaders = {};
+        let usedProtocol = "";
         if (paymentRequired && SOLANA_PRIVATE_KEY) {
             try {
-                const x402Token = await completeX402Payment(paymentRequired, SOLANA_PRIVATE_KEY);
-                paymentHeaders["X-Payment"] = x402Token;
+                paymentHeaders["X-Payment"] = await completeX402Payment(paymentRequired, SOLANA_PRIVATE_KEY);
+                usedProtocol = "USDC (x402)";
             }
-            catch {
+            catch (x402Err) {
                 if (wwwAuth && PRIVATE_KEY) {
-                    const challenge = parseWwwAuthenticate(wwwAuth);
-                    const tempoToken = await completeTempoPayment(challenge.params, PRIVATE_KEY);
-                    paymentHeaders["Authorization"] = `Payment ${tempoToken}`;
+                    try {
+                        const parsed = parseWwwAuthenticate(wwwAuth);
+                        const tempoToken = await completeTempoPayment(parsed.params, PRIVATE_KEY);
+                        paymentHeaders["Authorization"] = `Payment ${tempoToken}`;
+                        usedProtocol = "pathUSD (Tempo)";
+                    }
+                    catch (tempoErr) {
+                        return {
+                            content: [
+                                { type: "text", text: `Payment failed (x402: ${x402Err instanceof Error ? x402Err.message : String(x402Err)}; tempo: ${tempoErr instanceof Error ? tempoErr.message : String(tempoErr)}). Check wallet balance and key format.` },
+                            ],
+                        };
+                    }
                 }
                 else {
                     return {
-                        content: [{ type: "text", text: "Payment failed. Check your wallet balance." }],
+                        content: [
+                            { type: "text", text: `x402 payment failed: ${x402Err instanceof Error ? x402Err.message : String(x402Err)}. Check Solana wallet balance.` },
+                        ],
                     };
                 }
             }
         }
         else if (wwwAuth && PRIVATE_KEY) {
-            const challenge = parseWwwAuthenticate(wwwAuth);
-            const tempoToken = await completeTempoPayment(challenge.params, PRIVATE_KEY);
-            paymentHeaders["Authorization"] = `Payment ${tempoToken}`;
-        }
-        else {
-            return {
-                content: [{ type: "text", text: "No compatible payment key configured for available protocols." }],
-            };
+            try {
+                const parsed = parseWwwAuthenticate(wwwAuth);
+                const tempoToken = await completeTempoPayment(parsed.params, PRIVATE_KEY);
+                paymentHeaders["Authorization"] = `Payment ${tempoToken}`;
+                usedProtocol = "pathUSD (Tempo)";
+            }
+            catch (tempoErr) {
+                return {
+                    content: [
+                        { type: "text", text: `Tempo payment failed: ${tempoErr instanceof Error ? tempoErr.message : String(tempoErr)}` },
+                    ],
+                };
+            }
         }
         const paidRes = await fetch(`${API_URL}/api/intelligence`, {
             method: "POST",
-            headers: { ...headers, ...paymentHeaders },
+            headers: { ...reqHeaders, ...paymentHeaders },
             body: JSON.stringify({ token }),
         });
-        const text = await paidRes.text();
+        const paidText = await paidRes.text();
         let formatted;
         try {
-            formatted = JSON.stringify(JSON.parse(text), null, 2);
+            formatted = JSON.stringify(JSON.parse(paidText), null, 2);
         }
         catch {
-            formatted = text;
+            formatted = paidText;
         }
         const discount = paidRes.headers.get("X-M32-Discount");
-        const discountNote = discount && discount !== "0" ? ` (${discount}% M32 holder discount applied)` : "";
+        const discountNote = discount && discount !== "0" ? ` (${discount}% M32 discount)` : "";
         return {
             content: [
                 {
                     type: "text",
-                    text: `**Solana Token Intelligence** for \`${token}\`${discountNote}:\n\n\`\`\`json\n${formatted}\n\`\`\``,
+                    text: `**Solana Token Intelligence** — \`${token}\` via ${usedProtocol}${discountNote}\n\n\`\`\`json\n${formatted}\n\`\`\``,
                 },
             ],
         };
@@ -448,12 +752,12 @@ server.tool("get_solana_token_intelligence", "Get comprehensive Solana token int
             content: [
                 {
                     type: "text",
-                    text: `Failed to get token intelligence: ${err instanceof Error ? err.message : String(err)}`,
+                    text: `Network error reaching ${API_URL}: ${err instanceof Error ? err.message : String(err)}`,
                 },
             ],
         };
     }
-});
+}
 function parseWwwAuthenticate(header) {
     const match = header.match(/^(\w+)\s+(.+)$/);
     if (!match)
@@ -469,11 +773,6 @@ function parseWwwAuthenticate(header) {
     return { scheme, params };
 }
 async function completeTempoPayment(challengeParams, privateKey) {
-    // The Tempo payment flow:
-    // 1. Parse amount, currency, recipient, nonce from challenge
-    // 2. Sign a payment authorization with the private key
-    // 3. Return the signed token for the Authorization header
-    // Dynamic import — mppx and viem are optional peer dependencies
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     let mppxClient;
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -485,18 +784,17 @@ async function completeTempoPayment(challengeParams, privateKey) {
         viemAccounts = await import(viemPkg);
     }
     catch {
-        throw new Error("Payment client not available. Install mppx and viem as peer dependencies:\n  npm install mppx viem");
+        throw new Error("Tempo payment client not available. Install: npm install mppx viem");
     }
     try {
         const account = viemAccounts.privateKeyToAccount(privateKey.startsWith("0x") ? privateKey : `0x${privateKey}`);
         const client = mppxClient.Mppx.create({
             methods: [mppxClient.tempo({ account })],
         });
-        const token = await client.pay(challengeParams);
-        return token;
+        return (await client.pay(challengeParams));
     }
     catch (payErr) {
-        throw new Error(`Payment failed: ${payErr instanceof Error ? payErr.message : String(payErr)}`);
+        throw new Error(`Tempo payment failed: ${payErr instanceof Error ? payErr.message : String(payErr)}`);
     }
 }
 async function completeX402Payment(paymentRequiredHeader, solanaPrivateKey) {
@@ -507,22 +805,22 @@ async function completeX402Payment(paymentRequiredHeader, solanaPrivateKey) {
     catch {
         throw new Error("Could not decode Payment-Required header");
     }
-    // Build x402 payment payload with the Solana key
-    // Dynamic import for optional dependency
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     let solanaWeb3;
     try {
         const pkg = "@solana/web3.js";
         solanaWeb3 = await import(pkg);
     }
     catch {
-        throw new Error("x402 payment requires @solana/web3.js:\n  npm install @solana/web3.js");
+        throw new Error("x402 payment requires @solana/web3.js: npm install @solana/web3.js");
     }
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     let keypair;
     try {
         if (solanaPrivateKey.startsWith("[")) {
             keypair = solanaWeb3.Keypair.fromSecretKey(new Uint8Array(JSON.parse(solanaPrivateKey)));
         }
-        else if (/^[0-9a-fA-F]+$/.test(solanaPrivateKey)) {
+        else if (/^[0-9a-fA-F]+$/.test(solanaPrivateKey) && solanaPrivateKey.length % 2 === 0) {
             keypair = solanaWeb3.Keypair.fromSecretKey(new Uint8Array(Buffer.from(solanaPrivateKey, "hex")));
         }
         else {
@@ -549,24 +847,26 @@ async function completeX402Payment(paymentRequiredHeader, solanaPrivateKey) {
     };
     const message = JSON.stringify(payload.payload);
     const messageBytes = new TextEncoder().encode(message);
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     let tweetnacl;
     try {
         const pkg = "tweetnacl";
         tweetnacl = await import(pkg);
     }
     catch {
-        throw new Error("x402 signing requires tweetnacl:\n  npm install tweetnacl");
+        throw new Error("x402 signing requires tweetnacl: npm install tweetnacl");
     }
     const naclSign = tweetnacl.default?.sign ?? tweetnacl.sign;
     const signed = naclSign.detached(messageBytes, keypair.secretKey);
     payload.payload.signature = Buffer.from(signed).toString("base64");
     return Buffer.from(JSON.stringify(payload)).toString("base64");
 }
-// ── Start ──
+// ── Start ───────────────────────────────────────────────────────────────────
 async function main() {
     const transport = new StdioServerTransport();
     await server.connect(transport);
-    console.error("MPP32 MCP server running on stdio");
+    const keyHint = AGENT_KEY ? "agent-key configured" : "no agent-key (legacy mode)";
+    console.error(`MPP32 MCP server v1.1.0 running on stdio — ${keyHint}`);
 }
 main().catch((err) => {
     console.error("Fatal:", err);