otto-intel-mcp 0.1.1 → 0.1.2

package/README.md

@@ -62,7 +62,9 @@ claude mcp add otto-intel -e X402_PRIVATE_KEY=0x… -- npx -y otto-intel-mcp
 }
 ```
 
-Requires Node 22 or newer. Optional: `X402_RPC_URL` (your own Base RPC), `X402_TIMEOUT_MS` (default 30000).
+Requires Node 22 or newer. Optional: `X402_RPC_URL` (your own Base RPC), `X402_TIMEOUT_MS` (default 30000). The local server serves the 10 intelligence tools only — **the four constructors are hosted-only**: to get an envelope, call `otto_prepare_swap` on `https://mcp.ottoai.services` (free). A paid local call carries the rail's settlement receipt in the result metadata under `com.ottoai/payment-response`, exactly like the hosted server.
+
+`npm audit` on a fresh install reports findings that all sit in the local server's third-party venue clients (`@polymarket/clob-client-v2` → ethers v5 → `ws`, `@nktkas/hyperliquid` → `valibot`, the optional `@coinbase/cdp-sdk` → an older `axios`), none of which the library entries (`otto-intel-mcp/execution`, `/adapter`, `/adapter-cdp`) or `otto-execute` load — `otto-execute` on its own installs 19 packages with 0 findings. `npm install otto-intel-mcp --omit=optional` drops the Coinbase subtree if you do not delegate.
 
 ## What you get
 
@@ -94,7 +96,7 @@ A constructor builds the transaction; **your wallet signs and sends it.** Give i
 | `otto_prepare_polymarket_order` | A Polymarket CTF Exchange V2 limit order as typed data, tick and size validated against the live market | Your Polygon EOA |
 | `otto_prepare_perp_order` | A Hyperliquid perp limit order (optional take-profit / stop-loss), as the L1 action plus the exact EIP-712 recipe to sign | Your Hyperliquid account |
 
-To verify, sign and submit an envelope from the command line or from code, use the companion `otto-execute` (CLI + library, in the same repository; npm release following this one) — see the [execution seam docs](https://docs.useotto.xyz/acp-swarm/execution-seam).
+To verify, sign and submit an envelope from the command line or from code, use the companion [`otto-execute`](https://www.npmjs.com/package/otto-execute) (CLI + library, `npm install otto-execute`) — see the [execution seam docs](https://docs.useotto.xyz/acp-swarm/execution-seam).
 
 ### Always free
 
@@ -229,6 +231,6 @@ Field-by-field documentation: https://docs.useotto.xyz/acp-swarm/execution-seam.
 - Docs: https://docs.useotto.xyz/acp-swarm/otto-intel-mcp · execution seam: https://docs.useotto.xyz/acp-swarm/execution-seam
 - The full Otto x402 catalog: https://x402.ottoai.services
 - Otto AI: https://useotto.xyz · X: [@useOttoAI](https://x.com/useOttoAI)
-- Changelog: 0.1.1 — README rewritten for first-time users and agents, source maps removed from the package, publish gated by a privacy audit; 0.1.0 — first release (hosted + local server, execution constructors, library entries).
+- Changelog: 0.1.2 — the hosted front door (`GET /`, `/health`) reports the live tool registry (21 tools, never a literal), the local server carries the settlement receipt like the hosted one, constructor descriptions state the freshness window, `serverInfo.version` = the package version; 0.1.1 — README rewritten for first-time users and agents, source maps removed from the package, publish gated by a privacy audit; 0.1.0 — first release (hosted + local server, execution constructors, library entries).
 
 Running the hosted server yourself, or building from the monorepo: see `SETUP.md` in the repository.

package/dist/data-source.d.ts

@@ -2,6 +2,25 @@ import type { IntelToolDefinition, ToolArguments } from './tool-definitions.js';
 export interface IntelReadOptions {
     readonly signal?: AbortSignal;
 }
+/** The `_meta` name under which BOTH servers (hosted and local) carry the settlement receipt, `{ header, value }`. */
+export declare const PAYMENT_RECEIPT_META = "com.ottoai/payment-response";
+/** The paid rail's own settlement receipt: the header name it used and the value, verbatim. */
+export interface IntelSettlementReceipt {
+    readonly header: string;
+    readonly value: string;
+}
+export interface IntelPaidRead {
+    readonly value: unknown;
+    /** Present only when the rail settled a payment for this read. */
+    readonly receipt?: IntelSettlementReceipt;
+}
 export interface IntelDataSource {
     read(definition: IntelToolDefinition, input: ToolArguments, options?: IntelReadOptions): Promise<unknown>;
+    /**
+     * A read that also surfaces the settlement receipt when the source paid for it. A source that never
+     * pays (the hosted free path, the internal read source) leaves this undefined; the local x402 source
+     * implements it so the stdio server can carry the receipt under `com.ottoai/payment-response` exactly
+     * as the hosted server does — a receipt only the hosted path surfaced was the 0.1.1 local gap.
+     */
+    readPaid?(definition: IntelToolDefinition, input: ToolArguments, options?: IntelReadOptions): Promise<IntelPaidRead>;
 }

package/dist/data-source.js

@@ -1,2 +1,3 @@
-export {};
+/** The `_meta` name under which BOTH servers (hosted and local) carry the settlement receipt, `{ header, value }`. */
+export const PAYMENT_RECEIPT_META = 'com.ottoai/payment-response';
 //# sourceMappingURL=data-source.js.map

package/dist/execution-registration.js

@@ -86,10 +86,15 @@ export async function callDelegationAdminDefinition(runtime, run, rawInput, head
     }
 }
 export function registerExecutionTools(server, runtime, admission) {
+    // The freshness window is stated in the description from the runtime's OWN config — never a literal:
+    // the 0.1.1 docs said "10 minutes" (the ceiling) while every hosted envelope carried 5 (the default),
+    // and a submit paced on the doc halts mid-plan with STALE_ARTIFACT.
+    const windowSeconds = Math.round(runtime.config.artifactTtlMs / 1000);
+    const freshness = ` Every envelope from this server is valid for ${windowSeconds} seconds from construction (valid_until); a stale envelope is refused by the verifier — request a fresh one.`;
     for (const definition of EXECUTION_TOOL_DEFINITIONS) {
         server.registerTool(definition.name, {
             title: definition.title,
-            description: definition.description,
+            description: definition.description + freshness,
             inputSchema: definition.inputSchema,
             outputSchema: definition.outputSchema,
             annotations: EXECUTION_TOOL_ANNOTATIONS,

package/dist/mcp-server.d.ts

@@ -1,4 +1,4 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import type { IntelDataSource } from './data-source.js';
+import { type IntelDataSource } from './data-source.js';
 import type { ExecutionToolRuntime } from './execution-tools.js';
 export declare function createIntelMcpServer(dataSource: IntelDataSource, executionRuntime?: ExecutionToolRuntime): McpServer;

package/dist/mcp-server.js

@@ -1,6 +1,8 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { PAYMENT_RECEIPT_META } from './data-source.js';
 import { mapToolError } from './errors.js';
 import { registerExecutionTools } from './execution-registration.js';
+import { PACKAGE_VERSION } from './package-version.js';
 import { TOOL_DEFINITIONS } from './tool-definitions.js';
 const READ_ONLY_ANNOTATIONS = Object.freeze({
     readOnlyHint: true,
@@ -14,6 +16,15 @@ function stringify(value) {
 async function callDefinition(dataSource, definition, rawInput) {
     const input = definition.inputSchema.parse(rawInput);
     try {
+        if (dataSource.readPaid) {
+            const paid = await dataSource.readPaid(definition, input);
+            return {
+                content: [{ type: 'text', text: stringify(paid.value) }],
+                ...(paid.receipt
+                    ? { _meta: { [PAYMENT_RECEIPT_META]: { header: paid.receipt.header, value: paid.receipt.value } } }
+                    : {}),
+            };
+        }
         const result = await dataSource.read(definition, input);
         return {
             content: [{ type: 'text', text: stringify(result) }],
@@ -27,7 +38,7 @@ export function createIntelMcpServer(dataSource, executionRuntime) {
     const server = new McpServer({
         name: 'otto-intel',
         title: 'Otto Intel',
-        version: '0.1.0',
+        version: PACKAGE_VERSION,
     });
     for (const definition of TOOL_DEFINITIONS) {
         server.registerTool(definition.name, {

package/dist/package-version.d.ts

@@ -0,0 +1,6 @@
+/**
+ * package-version.ts — the version the servers announce in `serverInfo`, read from package.json so it
+ * cannot drift from what npm shows (0.1.1 on npm announced `0.1.0` in `initialize`). `dist/` sits one
+ * level below the package root in both the monorepo and the published tarball.
+ */
+export declare const PACKAGE_VERSION: string;

package/dist/package-version.js

@@ -0,0 +1,9 @@
+/**
+ * package-version.ts — the version the servers announce in `serverInfo`, read from package.json so it
+ * cannot drift from what npm shows (0.1.1 on npm announced `0.1.0` in `initialize`). `dist/` sits one
+ * level below the package root in both the monorepo and the published tarball.
+ */
+import { readFileSync } from 'node:fs';
+const pkg = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
+export const PACKAGE_VERSION = pkg.version;
+//# sourceMappingURL=package-version.js.map

package/dist/x402-read-source.d.ts

@@ -1,11 +1,18 @@
 import type { SelectPaymentRequirements } from '@x402/axios';
 import type { LocalX402Config } from './local-config.js';
-import type { IntelDataSource } from './data-source.js';
+import type { IntelDataSource, IntelPaidRead } from './data-source.js';
 import type { IntelToolDefinition, ToolArguments } from './tool-definitions.js';
+/** Header names the paid rail may use for the settlement receipt, in precedence order (same set as the hosted proxy). */
+export declare const SETTLEMENT_RECEIPT_HEADERS: readonly ["payment-response", "x-payment-response"];
 export declare function boundedPaymentSelector(maxPaymentAtomic: bigint): SelectPaymentRequirements;
 export declare class X402ReadSource implements IntelDataSource {
     private readonly config;
     private readonly scheme;
     constructor(config: LocalX402Config);
     read(definition: IntelToolDefinition, input: ToolArguments): Promise<unknown>;
+    /**
+     * The read plus the rail's settlement receipt, taken from the response header the rail used
+     * (`payment-response`, or the v1 `x-payment-response`) — relayed verbatim, never re-encoded.
+     */
+    readPaid(definition: IntelToolDefinition, input: ToolArguments): Promise<IntelPaidRead>;
 }

package/dist/x402-read-source.js

@@ -6,6 +6,8 @@ import { createPublicClient, http } from 'viem';
 import { base } from 'viem/chains';
 import { privateKeyToAccount } from 'viem/accounts';
 import { WarmReadUnavailableError, X402PaymentError } from './errors.js';
+/** Header names the paid rail may use for the settlement receipt, in precedence order (same set as the hosted proxy). */
+export const SETTLEMENT_RECEIPT_HEADERS = ['payment-response', 'x-payment-response'];
 const BASE_NETWORK = 'eip155:8453';
 const BASE_USDC = '0x833589fcd6edb6e08f4c7c32d4f71b54bda02913';
 function amountOf(requirement) {
@@ -50,6 +52,13 @@ export class X402ReadSource {
         this.scheme = new ExactEvmScheme(signer);
     }
     async read(definition, input) {
+        return (await this.readPaid(definition, input)).value;
+    }
+    /**
+     * The read plus the rail's settlement receipt, taken from the response header the rail used
+     * (`payment-response`, or the v1 `x-payment-response`) — relayed verbatim, never re-encoded.
+     */
+    async readPaid(definition, input) {
         const paymentClient = new x402Client(boundedPaymentSelector(definition.maxPaymentAtomic));
         paymentClient.register('eip155:*', this.scheme);
         const httpClient = wrapAxiosWithPayment(axios.create({
@@ -62,7 +71,16 @@ export class X402ReadSource {
             const response = await httpClient.get(definition.publicPath, {
                 params: definition.toQuery(input),
             });
-            return response.data;
+            const receiptHeader = SETTLEMENT_RECEIPT_HEADERS.find((name) => {
+                const value = response.headers[name];
+                return typeof value === 'string' && value.length > 0;
+            });
+            return {
+                value: response.data,
+                ...(receiptHeader
+                    ? { receipt: { header: receiptHeader, value: response.headers[receiptHeader] } }
+                    : {}),
+            };
         }
         catch (error) {
             if (axios.isAxiosError(error) && error.response?.status === 503) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "otto-intel-mcp",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Otto AI market intelligence + execution constructors over MCP — hosted at mcp.ottoai.services (first call free, then pay per call in USDC via x402) or local via `npx otto-intel-mcp`. Library entries: otto-intel-mcp/execution, /adapter, /adapter-cdp.",
   "type": "module",
   "homepage": "https://docs.useotto.xyz/acp-swarm/otto-intel-mcp",
@@ -96,7 +96,9 @@
     "dist/execution-delegation-admin-definition.js",
     "dist/execution-delegation-admin-definition.d.ts",
     "dist/boot-redaction.js",
-    "dist/boot-redaction.d.ts"
+    "dist/boot-redaction.d.ts",
+    "dist/package-version.js",
+    "dist/package-version.d.ts"
   ],
   "scripts": {
     "build": "tsc -p tsconfig.build.json",