zambo-agent-cli 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Brennan Zambo
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,108 @@
+# zambo-agent-cli — the Zambo execution layer on your command line
+
+**The problem:** AI models talk. Getting things *done* — checking a live price, auditing a site, running research, pulling data — means wiring up APIs, keys, and glue code for every single task.
+
+**The fix:** one command. Describe the job, get it done, get a receipt.
+
+```bash
+npx zambo-agent-cli "what's the price of BTC right now?"
+```
+
+```text
+BTC is currently priced at $81,270.00 ...
+
+🔗 receipt f410acad-e438-48c3-acae-f37871a764b1 · audit: https://zambo.dev/run/f410acad-e438-48c3-acae-f37871a764b1
+   verify: zambo verify f410acad-e438-48c3-acae-f37871a764b1
+```
+
+No account. No API key. No config. Free: 20 calls per tool per day.
+
+## Quickstart
+
+```bash
+# One-command: describe any goal
+npx zambo-agent-cli "audit example.com for AI discoverability"
+
+# Call a specific tool directly
+zambo call live_price '{"symbol":"BTC"}'
+zambo call ghost_audit_site '{"url":"https://example.com"}'
+
+# Search the 100+ tool catalog
+zambo search 'generate QR code'
+
+# List exposed tools
+zambo list
+
+# Verify any receipt
+zambo verify f410acad-e438-48c3-acae-f37871a764b1
+
+# Teach your agents about Zambo (writes to AGENTS.md / CLAUDE.md / .muserules)
+zambo init
+```
+
+Install it globally for the short `zambo` command:
+
+```bash
+npm install -g zambo-agent-cli
+```
+
+Or use it from Node:
+
+```js
+const zambo = require('zambo-agent-cli');
+
+const { text, receipt } = await zambo.callTool('live_price', { symbol: 'BTC' });
+console.log(text, receipt.id);
+
+const v = await zambo.verifyReceipt(receipt.id);
+console.log(v.verified, v.tool, v.sha256);
+```
+
+## What Zambo is
+
+[Zambo](https://zambo.dev) is a cross-AI execution layer: an MCP server with 100+ native tools — live crypto prices, site audits, web research, content tools, lead and data tools, multi-step agent jobs — behind one plain JSON-RPC endpoint (`https://zambo.dev/api/mcp`). This package is a thin, zero-dependency client for that endpoint.
+
+Don't know which tool fits? Skip the catalog — `zambo "<goal>"` routes through `zambo_universal`, which picks the right tools for the job. Pass `--session <id>` to keep a trail across calls.
+
+## Receipts: verifiable proof of execution
+
+Every call returns a **verifiable receipt**: a UUID, a timestamp, and a **sha256 of the result**. It proves the call executed and binds the result bytes — so anyone can check that a claimed result is exactly what Zambo produced.
+
+Honest scope: a receipt proves execution integrity, not correctness. It binds the result; it doesn't judge it.
+
+Check any receipt in your browser or on the command line:
+
+```bash
+zambo verify <receipt-uuid>     # confirms zambo.dev serves the receipt,
+                               # and shows tool, sha256, timestamp, audit URL
+```
+
+Receipt pages are real web pages with structured data (JSON-LD), Open Graph tags, and canonical URLs — shareable, linkable, citable.
+
+## Free tier, honestly
+
+- **Free:** 20 calls per tool per day. No account, no API key, no card.
+- **Paid:** a $1.49 Day Pass or $49/month Pass for heavier use, via [zambo.dev](https://zambo.dev).
+
+No fake limits, no "contact sales to see a price."
+
+## Commands
+
+| Command | What it does |
+|---|---|
+| `zambo "<goal>" [--session <id>]` | Do the thing. Routes via `zambo_universal`. |
+| `zambo call <tool> '<json>'` | Call one tool directly. |
+| `zambo search '<query>'` | Search the 100+ tool catalog. |
+| `zambo list` | List exposed tools with one-line descriptions. |
+| `zambo verify <receipt-uuid>` | Verify a receipt on zambo.dev. |
+| `zambo init [--root <dir>] [--file <name>] [--force]` | Write the Zambo section into your project's agent instruction file. |
+
+## Requirements & troubleshooting
+
+- Node.js 18 or newer. Zero runtime dependencies.
+- The upstream endpoint occasionally resets connections; the client retries transient transport failures automatically (up to 4 attempts). A received JSON-RPC error is never retried — it's shown to you as-is.
+- Timeouts: 60s per attempt.
+
+## License
+
+MIT — see [LICENSE](LICENSE). Built by [Zambo](https://zambo.dev) (Brennan Zambo, solo founder).

package/SELF-REVIEW.md

@@ -0,0 +1,37 @@
+# SELF-REVIEW — zambo-agent-cli 1.0.0 (pre-publish, 2026-09-19)
+
+Checked against rambo's standing laws before publish.
+
+1. **Data-integrity law** — every number shown must be real and recomputable.
+   - "100+ native tools": Brennan's canonical Zambo language (set 2026-09-12). Not measured at publish time; phrased as catalog size per zambo.dev's own claim. Acceptable as vendor-stated, not measured.
+   - "20 calls per tool per day": the free-tier limit, verified live (call 21 → HTTP 402, re-verified 2026-09-18). Real.
+   - "$1.49 Day Pass / $49/month Pass": Brennan-stated pricing (2026-09-18). Real.
+   - No invented metrics anywhere. No "users", no "uptime", no fake counts. PASS.
+
+2. **"Signed receipts"** — never said. The word "signed" appears nowhere in the package.
+   README states receipts carry "UUID + timestamp + sha256" and the honest scope line:
+   "a receipt proves execution integrity, not correctness. It binds the result; it doesn't judge it."
+   The `verify` command checks the receipt page exists on zambo.dev with matching structured
+   data — a genuine existence check, not a cryptographic claim. PASS.
+
+3. **Free-tier honesty** — "free 20 calls/tool/day, no account or API key" is the verified
+   live behavior. Paid tier presented as optional ("for heavier use"), no fake limits. PASS.
+
+4. **No-names rule** — only "Brennan Zambo" (the founder, self-published attribution in
+   LICENSE/package author field — his own package, his own name). No third parties named. PASS.
+
+5. **Voice law** — README reads like a human wrote it: problem → quickstart → mechanism → honest scope. Not templated. PASS.
+
+6. **Discoverability law** — keyword-rich description + README, semantic markdown, real
+   outbound links to zambo.dev, repository + homepage + bugs fields set. npm page will
+   carry full keyword set. PASS.
+
+7. **Publish-last-mile law** — this package publishes in this run; the publish step is the
+   same job, not a warehouse. PASS (pending successful publish).
+
+8. **Name squatting** — `zambo` is taken by an unrelated package (4.1.2); `zambo-agent-cli` is
+   Brennan's own official placeholder (maintainer zambodotdev, published 2026-09-14,
+   description literally says "official placeholder. Get the real thing"). Publishing 1.0.0
+   over his own placeholder is not squatting. PASS.
+
+Outcome: GO, pending end-to-end live test passing first.

package/bin/zambo.js

@@ -0,0 +1,239 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * zambo — command-line client for the Zambo cross-AI execution layer.
+ *
+ *   npx zambo-agent-cli "audit my site for AI discoverability"
+ *   zambo call live_price '{"symbol":"BTC"}'
+ *   zambo verify <receipt-uuid>
+ *
+ * No API key, no account. Free: 20 calls/tool/day. Every call returns a
+ * verifiable receipt (UUID + timestamp + sha256 of the result).
+ */
+
+const path = require("path");
+const fs = require("fs");
+const zambo = require(path.join(__dirname, "..", "index.js"));
+
+const PKG = require(path.join(__dirname, "..", "package.json"));
+
+const HELP = `zambo v${PKG.version} — the Zambo cross-AI execution layer on the command line.
+
+USAGE
+  zambo "<goal>"                  Get anything done, one command (routed via zambo_universal)
+  zambo call <tool> '<json>'      Call a specific tool, e.g. zambo call live_price '{"symbol":"BTC"}'
+  zambo search '<query>'          Search the 100+ tool catalog
+  zambo list                      List exposed tools
+  zambo verify <receipt-uuid>     Verify a receipt on zambo.dev
+  zambo init [--root <dir>] [--file <name>] [--force]
+                                  Teach agents about Zambo (writes to AGENTS.md / CLAUDE.md / .muserules)
+  zambo --help                    Show this help
+  zambo --version                 Show version
+
+EXAMPLES
+  zambo "what's the price of BTC right now?"
+  zambo call live_price '{"symbol":"ETH"}'
+  zambo call ghost_audit_site '{"url":"https://example.com"}'
+  zambo verify f410acad-e438-48c3-acae-f37871a764b1
+
+RECEIPTS
+  Every call returns a verifiable receipt: a UUID, a timestamp, and a sha256
+  of the result. It proves the call executed and binds the result bytes —
+  not whether the result was correct. Check any receipt at:
+      https://zambo.dev/run/<receipt-uuid>
+  or run: zambo verify <receipt-uuid>
+
+FREE TIER
+  20 calls per tool per day, no account, no API key. Just works.
+
+More: https://zambo.dev
+`;
+
+function die(msg, code = 1) {
+  process.stderr.write(`zambo: ${msg}\n`);
+  process.exit(code);
+}
+
+function printCallResult({ text, receipt }) {
+  if (text) process.stdout.write(text + "\n");
+  if (receipt && receipt.id) {
+    process.stdout.write(`\n\u{1F517} receipt ${receipt.id} · audit: ${receipt.audit || `https://zambo.dev/run/${receipt.id}`}\n`);
+    process.stdout.write(`   verify: zambo verify ${receipt.id}\n`);
+  }
+}
+
+async function cmdCall(tool, argsJson) {
+  let args;
+  try {
+    args = argsJson === undefined ? {} : JSON.parse(argsJson);
+  } catch (e) {
+    die(`bad JSON args: ${e.message}`);
+  }
+  if (args === null || typeof args !== "object" || Array.isArray(args)) {
+    die("args must be a JSON object, e.g. '{\"symbol\":\"BTC\"}'");
+  }
+  printCallResult(await zambo.callTool(tool, args));
+}
+
+async function cmdVerify(uuid) {
+  let v;
+  try {
+    v = await zambo.verifyReceipt(uuid);
+  } catch (e) {
+    die(e.message, 3);
+  }
+  if (v.verified) {
+    process.stdout.write(`\u2713 receipt verified on zambo.dev\n`);
+    process.stdout.write(`  id:      ${v.id}\n`);
+    process.stdout.write(`  tool:    ${v.tool}\n`);
+    process.stdout.write(`  sha256:  ${v.sha256}\n`);
+    process.stdout.write(`  created: ${v.created}\n`);
+    process.stdout.write(`  audit:   ${v.audit}\n`);
+  } else {
+    process.stderr.write(`\u2717 NOT verified: ${v.reason}\n`);
+    process.stderr.write(`  audit: ${v.audit}\n`);
+    process.exit(2);
+  }
+}
+
+async function cmdList() {
+  const tools = await zambo.listTools();
+  for (const t of tools) {
+    const desc = String(t.description || "").split("\n")[0].slice(0, 100);
+    process.stdout.write(`${t.name} \u2014 ${desc}\n`);
+  }
+}
+
+// --- init: write the Zambo section into the project's agent instruction file ---
+const MARK_BEGIN = "<!-- ZAMBO:BEGIN -->";
+const MARK_END = "<!-- ZAMBO:END -->";
+const CANDIDATE_FILES = ["AGENTS.md", "CLAUDE.md", ".muserules"];
+
+const ZAMBO_SECTION = `<!-- ZAMBO:BEGIN -->
+## Zambo — cross-AI execution layer
+
+Zambo (https://zambo.dev) is an MCP execution layer: one endpoint that gets jobs done for AI agents. Describe the job, get a verifiable receipt.
+
+**Endpoint:** \`https://zambo.dev/api/mcp\` (plain JSON-RPC over HTTPS, no auth)
+**Full catalog:** 100+ native tools (crypto prices, web research, site audits, content tools, lead/data tools, multi-step jobs)
+**Install:** \`npx zambo-agent-cli "<goal>"\` · **Try it:** https://zambo.dev — no account, no key needed
+
+**How to call:**
+\`\`\`bash
+curl -s https://zambo.dev/api/mcp -X POST -H 'Content-Type: application/json' \\
+  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call",
+       "params":{"name":"live_price","arguments":{"symbol":"BTC"}}}'
+\`\`\`
+Or route any goal through \`zambo_universal\`:
+\`\`\`json
+{"name": "zambo_universal", "arguments": {"goal": "<what you want done>", "_session_id": "<stable id>"}}
+\`\`\`
+
+**When to use it:** anything you'd rather get done than figure out — prices, research, audits, transforms, data/lead tools, multi-step jobs.
+
+**Receipts:** every call returns a verifiable receipt (UUID + timestamp + sha256). Check it at \`https://zambo.dev/run/<uuid>\`. Keep receipt IDs for anything the user may want to audit or continue.
+
+Created by Brennan Zambo (solo founder, no VC). MCP server is MIT licensed.
+<!-- ZAMBO:END -->
+`;
+
+function findProjectRoot(start) {
+  let cur = path.resolve(start);
+  const markers = [".git", "package.json", "pyproject.toml", "Cargo.toml", "go.mod", "README.md"];
+  while (true) {
+    for (const m of markers) {
+      if (fs.existsSync(path.join(cur, m))) return cur;
+    }
+    const parent = path.dirname(cur);
+    if (parent === cur) return path.resolve(start);
+    cur = parent;
+  }
+}
+
+async function cmdInit(argv) {
+  let root = null, forcedFile = null, force = false;
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "-h" || a === "--help") {
+      process.stdout.write("Usage: zambo init [--root <dir>] [--file <name>] [--force]\nWrite the Zambo tool section into the project's agent instruction file (AGENTS.md, CLAUDE.md, or .muserules). Idempotent.\n");
+      return;
+    } else if (a === "--root" && argv[i + 1]) { root = path.resolve(argv[++i]); }
+    else if (a === "--file" && argv[i + 1]) { forcedFile = path.basename(argv[++i]); }
+    else if (a === "--force") { force = true; }
+    else die(`unknown init option: ${a}`);
+  }
+  root = root || findProjectRoot(process.cwd());
+  if (!fs.existsSync(root) || !fs.statSync(root).isDirectory()) die(`not a directory: ${root}`);
+  const candidates = forcedFile ? [forcedFile] : CANDIDATE_FILES;
+  let target = null;
+  for (const name of candidates) {
+    const p = path.join(root, name);
+    if (fs.existsSync(p) && fs.statSync(p).isFile()) { target = p; break; }
+  }
+  let created = false;
+  if (!target) { target = path.join(root, candidates[0]); created = true; }
+  const existing = fs.existsSync(target) ? fs.readFileSync(target, "utf8") : "";
+  if (existing.includes(MARK_BEGIN) && !force) {
+    process.stdout.write(`Zambo section already present in ${target} — nothing to do.\n(Use --force to rewrite it.)\n`);
+    return;
+  }
+  let body;
+  if (existing.includes(MARK_BEGIN) && force) {
+    const pre = existing.split(MARK_BEGIN)[0];
+    const post = existing.split(MARK_END).slice(1).join(MARK_END);
+    body = pre.replace(/\s+$/, "") + "\n\n" + ZAMBO_SECTION + (post.trim() ? "\n" + post.replace(/^\s+/, "") : "");
+    process.stdout.write(`Rewrote the Zambo section in ${target}.\n`);
+  } else if (existing.trim()) {
+    const sep = existing.endsWith("\n\n") ? "" : existing.endsWith("\n") ? "\n" : "\n\n";
+    body = existing + sep + "\n" + ZAMBO_SECTION;
+    process.stdout.write(`Appended the Zambo section to ${target}.\n`);
+  } else {
+    body = ZAMBO_SECTION;
+    process.stdout.write(`Wrote the Zambo section to a new ${path.basename(target)}.\n`);
+  }
+  fs.writeFileSync(target, body, "utf8");
+  process.stdout.write("Agents reading this file now know: endpoint https://zambo.dev/api/mcp,\nplain-JSON-RPC calls with verifiable receipts at zambo.dev/run/<uuid>.\n");
+}
+
+async function main() {
+  const argv = process.argv.slice(2);
+  if (argv.length === 0 || argv[0] === "-h" || argv[0] === "--help") {
+    process.stdout.write(HELP);
+    return;
+  }
+  if (argv[0] === "--version" || argv[0] === "-V") {
+    process.stdout.write(`${PKG.version}\n`);
+    return;
+  }
+  const cmd = argv[0];
+  try {
+    if (cmd === "call") {
+      if (!argv[1]) die("usage: zambo call <tool> '<json-args>'");
+      await cmdCall(argv[1], argv[2]);
+    } else if (cmd === "search") {
+      if (!argv[1]) die("usage: zambo search '<query>'");
+      printCallResult(await zambo.search(argv.slice(1).join(" ")));
+    } else if (cmd === "list") {
+      await cmdList();
+    } else if (cmd === "verify") {
+      if (!argv[1]) die("usage: zambo verify <receipt-uuid>");
+      await cmdVerify(argv[1]);
+    } else if (cmd === "init") {
+      await cmdInit(argv.slice(1));
+    } else if (!cmd.startsWith("-")) {
+      // Bare goal → universal. Session persists across calls when given.
+      const words = argv.slice();
+      let session = null;
+      const si = words.indexOf("--session");
+      if (si !== -1) { session = words[si + 1] || null; words.splice(si, 2); }
+      printCallResult(await zambo.universal(words.join(" "), session));
+    } else {
+      die(`unknown option: ${cmd}\nRun 'zambo --help'.`);
+    }
+  } catch (e) {
+    if (e.zamboError) die(`server error: ${e.message}`, 2);
+    die(e.message, 3);
+  }
+}
+
+main();

package/index.js

@@ -0,0 +1,211 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * zambo-agent-cli — programmatic client for the Zambo execution layer.
+ *
+ *   const zambo = require('zambo-agent-cli');
+ *   const { result, receipt } = await zambo.callTool('live_price', { symbol: 'BTC' });
+ *   const v = await zambo.verifyReceipt(receipt.id);
+ *
+ * No API key, no account. Free tier: 20 calls/tool/day.
+ * Every tool call returns a verifiable receipt (UUID + timestamp + sha256).
+ */
+
+const ENDPOINT = "https://zambo.dev/api/mcp";
+const RECEIPT_BASE = "https://zambo.dev/run";
+const TIMEOUT_MS = 60_000;
+const MAX_ATTEMPTS = 4;
+
+// Transport flakiness the upstream shows intermittently (resets, empty
+// bodies). Retry the transport; never retry a received JSON-RPC error.
+const TRANSIENT_CODES = new Set([
+  "ECONNRESET", "EPIPE", "ETIMEDOUT", "EAI_AGAIN",
+  "UND_ERR_CONNECT_TIMEOUT", "UND_ERR_SOCKET", "UND_ERR_HEADERS_TIMEOUT",
+]);
+
+function isTransient(err) {
+  if (!err) return false;
+  if (err.name === "AbortError" || err.name === "TimeoutError") return true;
+  const code = err.cause && err.cause.code;
+  if (code && TRANSIENT_CODES.has(code)) return true;
+  // undici wraps many socket failures in a plain TypeError("fetch failed")
+  if (err instanceof TypeError && /fetch failed|terminated|socket/i.test(err.message)) return true;
+  return false;
+}
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+async function postJsonRpc(method, params) {
+  const body = JSON.stringify({ jsonrpc: "2.0", id: 1, method, params });
+  let lastErr = null;
+  for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
+    try {
+      const res = await fetch(ENDPOINT, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Accept: "application/json, text/event-stream" },
+        body,
+        signal: AbortSignal.timeout(TIMEOUT_MS),
+      });
+      if (!res.ok) {
+        const transientHttp = res.status === 502 || res.status === 503 || res.status === 504;
+        if (transientHttp && attempt < MAX_ATTEMPTS) {
+          await sleep(600 * attempt);
+          continue;
+        }
+        throw new Error(`HTTP ${res.status} ${res.statusText} from ${ENDPOINT}`);
+      }
+      const text = (await res.text()).trim();
+      const payload = parseRpcBody(text);
+      if (payload.error) {
+        const e = new Error(`Zambo error: ${payload.error.message || JSON.stringify(payload.error)}`);
+        e.code = payload.error.code;
+        e.zamboError = payload.error;
+        throw e; // JSON-RPC error: never retry
+      }
+      return payload.result;
+    } catch (err) {
+      if (err.zamboError) throw err;
+      lastErr = err;
+      if (!isTransient(err) || attempt === MAX_ATTEMPTS) break;
+      await sleep(600 * attempt);
+    }
+  }
+  throw new Error(`Transport failed after ${MAX_ATTEMPTS} attempts: ${lastErr && lastErr.message}`);
+}
+
+function parseRpcBody(text) {
+  if (text.startsWith("{")) return JSON.parse(text);
+  // Server may answer SSE (data: {...} lines)
+  for (const line of text.split("\n")) {
+    const t = line.trim();
+    if (t.startsWith("data:")) {
+      try { return JSON.parse(t.slice(5).trim()); } catch { /* keep scanning */ }
+    }
+  }
+  throw new Error(`Unparseable response from ${ENDPOINT}: ${text.slice(0, 200)}`);
+}
+
+/** Extract plain text from an MCP tool result's content blocks. */
+function resultText(result) {
+  const parts = [];
+  for (const block of (result && result.content) || []) {
+    if (block.type === "text" && typeof block.text === "string") parts.push(block.text);
+  }
+  return parts.join("\n");
+}
+
+/**
+ * Call a Zambo tool by name with JSON arguments.
+ * Returns { result, text, receipt } where receipt is
+ * { id, status, audit } — check it at https://zambo.dev/run/<id>.
+ */
+async function callTool(name, args = {}) {
+  if (!name || typeof name !== "string") throw new Error("callTool: tool name is required");
+  if (args === null || typeof args !== "object" || Array.isArray(args)) {
+    throw new Error("callTool: args must be a JSON object");
+  }
+  const result = await postJsonRpc("tools/call", { name, arguments: args });
+  const receipt = (result && result._receipt) || {};
+  return { result, text: resultText(result), receipt };
+}
+
+/** Route any natural-language goal through zambo_universal (the main entry point). */
+async function universal(goal, sessionId) {
+  if (!goal || typeof goal !== "string") throw new Error("universal: a goal string is required");
+  const args = { goal };
+  args._session_id = sessionId || `npm-${randomId(8)}`;
+  const result = await postJsonRpc("tools/call", { name: "zambo_universal", arguments: args });
+  const receipt = (result && result._receipt) || {};
+  return { result, text: resultText(result), receipt };
+}
+
+/** Search the full 100+ tool catalog. */
+async function search(query) {
+  if (!query || typeof query !== "string") throw new Error("search: a query string is required");
+  const result = await postJsonRpc("tools/call", { name: "capability_search", arguments: { query } });
+  const receipt = (result && result._receipt) || {};
+  return { result, text: resultText(result), receipt };
+}
+
+/** List the exposed top-level tools. */
+async function listTools() {
+  const result = await postJsonRpc("tools/list", {});
+  return result.tools || [];
+}
+
+/**
+ * Verify a receipt UUID against zambo.dev.
+ * Returns { verified, id, tool, sha256, created, audit }.
+ * `verified` is true only when zambo.dev serves the receipt page for that UUID
+ * and the page's structured receipt data matches.
+ */
+async function verifyReceipt(uuid) {
+  if (!uuid || typeof uuid !== "string") throw new Error("verifyReceipt: a receipt UUID is required");
+  const id = uuid.trim();
+  const uuidRe = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  if (!uuidRe.test(id)) throw new Error(`verifyReceipt: not a UUID: ${id}`);
+  const audit = `${RECEIPT_BASE}/${id}`;
+  let lastErr = null;
+  for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
+    try {
+      const res = await fetch(audit, {
+        headers: { "User-Agent": "zambo-agent-cli/1.0.0 (+https://zambo.dev)" },
+        signal: AbortSignal.timeout(TIMEOUT_MS),
+      });
+      if (res.status === 404) {
+        return { verified: false, id, audit, reason: "receipt page not found on zambo.dev" };
+      }
+      if (!res.ok) {
+        if ((res.status === 502 || res.status === 503 || res.status === 504) && attempt < MAX_ATTEMPTS) {
+          await sleep(600 * attempt);
+          continue;
+        }
+        throw new Error(`HTTP ${res.status} from ${audit}`);
+      }
+      const html = await res.text();
+      const ld = extractJsonLd(html);
+      const props = {};
+      for (const p of (ld && ld.additionalProperty) || []) props[p.name] = p.value;
+      const titleOk = /Verifiable Receipt/i.test(html);
+      const verified = titleOk && !!props.tool && !!props.sha256 && ld["@id"] === audit;
+      return {
+        verified,
+        id,
+        tool: props.tool || null,
+        sha256: props.sha256 || null,
+        created: (ld && ld.dateCreated) || null,
+        audit,
+        reason: verified ? null : "receipt page served but structured receipt data was missing or mismatched",
+      };
+    } catch (err) {
+      lastErr = err;
+      if (!isTransient(err) || attempt === MAX_ATTEMPTS) break;
+      await sleep(600 * attempt);
+    }
+  }
+  throw new Error(`Could not reach ${audit}: ${lastErr && lastErr.message}`);
+}
+
+function extractJsonLd(html) {
+  const m = html.match(/<script type="application\/ld\+json">([\s\S]*?)<\/script>/);
+  if (!m) return null;
+  try { return JSON.parse(m[1]); } catch { return null; }
+}
+
+function randomId(n) {
+  const chars = "abcdefghijklmnopqrstuvwxyz0123456789";
+  let s = "";
+  for (let i = 0; i < n; i++) s += chars[Math.floor(Math.random() * chars.length)];
+  return s;
+}
+
+module.exports = {
+  ENDPOINT,
+  RECEIPT_BASE,
+  callTool,
+  universal,
+  search,
+  listTools,
+  verifyReceipt,
+  resultText,
+};

package/package.json

@@ -0,0 +1 @@
+{"author":"Brennan Zambo <brennanzambo@zambo.dev>","bin":{"zambo":"bin/zambo.js","zambo-agent-cli":"bin/zambo.js"},"bugs":{"url":"https://zambo.dev"},"description":"Zambo — the cross-AI execution layer on the command line. One command to get anything done: live crypto prices, site audits, web research, data tools, multi-step agent jobs. 100+ native MCP tools, free 20 calls/tool/day, no account or API key. Every call returns a verifiable receipt (UUID + timestamp + sha256 of the result) you can check at zambo.dev/run/<id>.","engines":{"node":">=18"},"files":["bin/","index.js","README.md","LICENSE","SELF-REVIEW.md"],"homepage":"https://zambo.dev","keywords":["mcp","model-context-protocol","ai-agents","ai-tools","execution","verifiable-receipt","automation","crypto-prices","site-audit","web-research","cli","zambo"],"license":"MIT","main":"index.js","name":"zambo-agent-cli","repository":{"type":"git","url":"https://zambo.dev"},"version":"1.0.0"}