io.github.lonniev/excalibur-mcp

Generate a patron's account statement at this operator. Returns the patron's purchase history, active credit tranches, per-tool usage breakdown, and recent daily usage logs. This is the patron's spending account — not the operator's Authority tax balance. Free — no credits consumed. Proof of npub ownership is required to prevent statement-scraping of arbitrary patrons.

Generate a visual SVG infographic of your account statement. Returns the same data as account_statement, rendered as a dark-themed SVG graphic with balance hero, metrics cards, health gauge, tranche table, and tool usage breakdown. Costs 1 api_sat per call. Proof is verified by ``debit_or_deny`` before any cost is incurred.

Check this operator's adoption-request status at a chosen Authority. Free. Polls the Authority MCP-to-MCP for the status of this operator's request (pending / approved / rejected / provisioned).

Start the OAuth2 authorization flow. Returns an authorization URL. Open it in a browser to log in and authorize. Then call ``check_oauth_status`` with the same npub to complete. Free. Proof of npub ownership is required so an observer cannot DOS your account by initiating OAuth flows in your name. Do NOT call this pre-emptively. If a session may still be valid, attempt the live tool call first and only begin OAuth when it fails with ``upstream_auth_refresh_needed``. A 'pending' ``check_oauth_status`` is not evidence that an existing session has lapsed.

Check this operator's tax balance at the Authority. Returns the sats available for certifying patron credit purchases. When this balance reaches zero, patron top-ups cannot be certified and the operator must call purchase_credits on the Authority. This is the operator's own funding — not a patron balance. Free.

Check a patron's credit balance at this operator. This is the patron's spending balance — credits purchased via Lightning for tool calls at this operator. For the operator's own balance at the Authority (needed to certify patron purchases), use authority_check_balance instead. Free — no credits required. Proof of npub ownership is required to prevent anyone-with-the-registry from enumerating balances.

Check whether the OAuth2 authorization flow has completed. Call after opening the authorization URL from ``begin_oauth`` and completing the login in your browser. Free. Proof of npub ownership is required: OAuth status exposes which upstream services a patron has connected. A 'pending' result here does NOT prove an existing session has lapsed — it only reports this authorization attempt. To find out whether a session still works, attempt the live call; fall back to ``begin_oauth`` only on an explicit ``upstream_auth_refresh_needed`` error.

Check the payment status of a Lightning invoice. Call after paying the invoice from purchase_credits. Free — no credits required. Proof of npub ownership is required to prevent credit-grant front-running by an observer of the invoice ID.

Preview the effective cost of a tool call. Shows the base cost and any constraint effects (discounts, free trials, surge pricing). Free — no credits required.

Check whether a previously-cached dpop_token is still valid. Mirrors ``check_oauth_status`` for the npub-proof flow: a calling agent can ask "will my next paid call accept this dpop_token?" before burning credits on a guaranteed failure. Free, no side effects — does not evict the cache or touch relays.

Store a new post (draft or scheduled). Returns its ``post_id``.

Delete a coupon. Cascades to all patron redemptions. Any chain step referencing the deleted coupon_id becomes a no-op (the constraint returns neutral on unknown ids) — the Studio surfaces orphan references as warnings. RESTRICTED to operator — requires proof.

Remove a single operator secret field. Deletes one key from the operator's encrypted credential blob without touching the others — the field-level counterpart to ``forget_credentials``, which wipes the whole row. Use it to retire a leftover after an SDK cutover (a Prefect key after Modal, or a stored but untemplated orphan like ``anthropic_api_key``) without taking the operator down for a full re-delivery. Stored-but-untemplated fields are first-class: the delete is keyed on what is vaulted, not on what the current template declares. Idempotent — already-absent fields report ``removed: false`` without rewriting the vault. RESTRICTED to the operator — requires proof (nsec-signed kind-27235 or a cached dpop_token phrase); patron proofs are rejected. A deletion is as destructive as a write.

Remove a single patron credential field. Deletes one field from stored credentials without affecting other fields. Free. Proof of npub ownership is required — this is a write to the patron's sensitive credential vault.

Delete a stored post. Default is a soft delete (``status='archived'``); pass ``hard=True`` to remove the row permanently.

Delete one of your saved snippets by id. Free and owner-scoped.

Redeem a ``resolve_dynamic_block`` claim check (free, proof-gated). Poll this with the ``claim_check`` from ``resolve_dynamic_block`` until ``status == "done"`` (the resolved fragment is ``result.text``). While the job runs it returns ``{"status": "running", "poll_after_seconds": N}``; on failure ``{"status": "error", ...}`` (the start fare is refunded); an unknown or aged-out claim returns ``{"status": "expired", ...}``. Owner-scoped — only the npub that started the job can redeem it. Also acts as the watchdog: a stalled job is re-kicked when polled.

Remove a coupon from this patron's redemption list. Cosmetic only — the coupon itself still exists at the operator, and the patron can re-redeem the same code later while the window allows. Free — requires proof of ``npub``.

Delete vaulted credentials for a specific service and npub. For operator credentials, pass the operator's own npub. For patron credentials, pass the patron's npub. Always requires proof of npub ownership — a deletion is as destructive as a write.

Read an npub's public Nostr profile (NIP-01 kind-0 metadata). Free, no proof — the data is already public on relays. Returns the latest metadata fields (name, display_name, about, picture, banner, nip05, website, lud16) or an empty profile if none is published.

Generate a Merkle inclusion proof that a patron's balance was included in a Bitcoin-notarized snapshot.

Report this operator's configuration readiness. Shows which operator settings are configured, which are missing, and how to deliver each missing value. For patron-level credential status, use get_patron_onboarding_status instead. Free.

List stored patron credential field names (not values). Returns the names of fields stored for a patron, plus each field's ``delivered_at`` ISO-8601 timestamp when known (null for secrets vaulted before timestamps were recorded). Values are never exposed — use this to verify which fields are configured and how old each one is. Free. Proof of npub ownership is required: the list of configured fields is itself sensitive (reveals which integrations a patron has set up).

Report a patron's credential readiness for this operator. For set-once services (eXcalibur, TheBrain), shows which patron secrets are configured and which are missing. For dynamic/OAuth2 services (Schwab), reports that no patron credentials are needed. Free. Proof of npub ownership is required because credential presence is sensitive information about the patron's setup.

Read one stored post by id (owner-scoped).

Patron: raw metrics snapshot series for one owned post. Returns the append-only ``post_metrics_snapshot`` rows (impressions, likes, clicks, cadence_key, t_offset, link_placement, snippet_ids) ordered by capture time. Empty when the post has not been harvested yet.

Get the active pricing model for this operator. Free. If no model exists, self-initializes a scaffold with all registered tools at 0 sats. No economic data from code.

Read recent scheduler-tick outcomes. Each ``process_scheduled_posts`` run — fired by the Cloudflare cron Worker or a manual trigger — records its summary. This surfaces them so the FE debug log can show what the Worker is doing: the per-tick heartbeat (proof it ran) and per-post outcomes (posted / skip+error reasons like ``insufficient_balance`` or ``oauth_token_expired``). Owner-scoped: the operator sees every tick in full; any other proven patron sees the global heartbeat (``processed`` count + ``run_at``) plus only the per-post entries for THEIR OWN posts. Free; npub proof required. Returns ``{runs:[{run_at, summary}], scope}``.

Read one of your saved snippets by id (full row incl. ``doc`` block document). Free and owner-scoped. Returns ``{"success": true, "snippet": …}`` or ``snippet_not_found``.

Read your saved writing Voice — a profile blurb plus a list of "banned construction" chips (``{text, on}``) the editor passes to ``refine_post_region``. Owner-scoped; priced by the operator's pricing model (use ``check_price``). When you have not saved a Voice yet this returns an empty one (``{"voice": {"profile": "", "bans": []}}``) so the editor can seed its own defaults, not an error.

Fetch the connected X account's handle and name for this patron (free). Uses the patron's vaulted X OAuth token to call X's ``/users/me``. Returns ``{connected: true, username, name, profile_image_url}`` when connected, or the OAuth situation (``connected`` absent) when X isn't linked yet. Used to show the real @handle on the editor's tweet-card preview.

Operator-only: one cadence-aware metrics harvest sweep. Drains due ``metrics_harvest_job`` rows (t+15m … t+28d), fetches X ``non_public_metrics`` / ``organic_metrics`` under each patron's OAuth context, and appends ``post_metrics_snapshot`` rows. A missed cadence is permanent data loss — failed jobs retry up to 5 attempts then land in the dead-letter queue; pass ``requeue_dead_id`` to retry one. Also runs as phase 3 of every ``process_scheduled_posts`` tick.

Return canonical (tool_id, mcp_name, …) for every tool the wheel exposes. The authoritative source for any client (Studio, agents, FE) that needs to know how this MCP identifies its tools. Reconcile uses this output to UUID-join against the stored pricing model — no name-based UUID derivation, no guessing. Includes both ToolIdentity-seeded tools and any UUID recorded by ``@paid_tool`` that is missing from the registry. The latter appear with ``registered: false`` (and in the top-level ``unregistered`` array) so Reconcile can flag deploy drift instead of silently reporting clean when a live tool was never seeded (#174). If the operator renames a function or rebrands a slug, the mcp_name in this output changes but tool_id stays. That's the whole point of the canonical-UUID design. Also diffs the live FastMCP wire surface against the registry. Tools exposed on the wire but absent from the registry appear in ``unregistered`` so Reconcile can flag deploy drift instead of silently under-reporting (issue #175). Free, no side effects.

List all available constraint types and their parameter schemas. Returns the type, category, description, and parameter specs for every constraint that can be used in a pricing pipeline. Free — no credits required.

List every coupon this operator has minted (newest first). Each row carries the current ``times_redeemed`` counter — the Studio renders a progress bar from this against ``total_uses``. RESTRICTED to operator — requires proof.

List the coupons this patron has redeemed on this operator. Returns both active and exhausted redemptions with a per-row ``status`` (``active`` / ``window_closed`` / ``patron_limit`` / ``total_limit``). Free — requires proof of ``npub``.

List recent Bitcoin notarization records.

List your stored posts, server-side sorted, filtered, and offset-paginated. Optional ``status`` filter — a single status or a comma-separated set (e.g. ``draft,scheduled``), matched as set membership. ``sort_col`` is one of ``created|updated|status|scheduled`` (default ``created``); ``sort_dir`` is ``asc|desc``. ``search`` is a case-insensitive regular expression matched against the post text. ``date_from``/``date_to`` accept bare ``YYYY-MM-DD`` (UTC-calendar day, end-inclusive) or an ISO instant (patron-local midnight from the FE — exclusive upper bound when instant). Bound the ``date_field`` column, one of ``created|updated|scheduled|sent`` (default ``created``). ``template_id`` filters to the sent occurrences a recurring template fired. ``sent_hour`` (0–23) with ``time_zone`` (IANA) keeps only posts whose ``last_sent_at`` local wall hour in that zone matches — used by the Performance time-of-day chart deep-link. ``page`` is 0-indexed; ``page_size`` is 1..100. Each row carries ``is_recurring``, ``has_dynamic``, and ``template_id`` (set on sent occurrences). Returns ``{posts:[…], total, page, page_size}`` reflecting the filtered set.

List your saved post snippets, server-side sorted, filtered, and offset-paginated. ``sort_col`` is one of ``favorite|created|updated|name`` (default ``favorite``); ``sort_dir`` is ``asc|desc``. ``search`` is a case-insensitive regular expression matched against the snippet name or body. ``date_from``/``date_to`` accept bare ``YYYY-MM-DD`` (UTC-calendar day, end-inclusive) or an ISO instant (patron-local midnight from the FE). Bound the ``date_field`` column, one of ``created|updated`` (default ``created``). ``page`` is 0-indexed; ``page_size`` is 1..200. Free, owner-scoped. Returns ``{snippets:[…], total, page, page_size}`` reflecting the filtered set.

Create a new operator-owned discount coupon.

Build a Merkle tree of all patron balances and submit the root to Bitcoin via OpenTimestamps. Operator-only background task. Bitcoin confirmation takes 1-6 hours. Free — no credits required.

Describe the DPYC ecosystem via the Oracle. Free.

Get the current DPYC certification tax rate. Free.

Get DPYC onboarding instructions from the Oracle. Free.

Look up a DPYC community member by npub. Free.

Get active network advisories from the Oracle. Free.

Publish a public Nostr note (kind 1) authored by your proven npub. eXcalibur cannot sign a note *as* you — a Nostr event must be signed by the key it claims to come from, and eXcalibur never holds your nsec. So for this one note it mints a fresh, ephemeral "scribe" keypair, signs with it, and ``p``-tags YOUR npub as the author. The p-tag renders the note as a real mention and places it in your own Nostr mentions, so you can see — and disown — anything published in your name. The author is always your **proven** npub from this session (the same npub you pass for billing); it is never a free-form argument, so no caller can scribe as anyone else. The note publishes to the DPYC relay set. The call **succeeds if at least one** relay accepts it; the response lists every relay's accept/reject and the accepted/attempted counts so you can see the note's real reach — a one-relay publish never reads as a clean broadcast.

Patron: derived reach scores across your harvested post corpus. Computes escape velocity (t+15m vs rolling median), breakout ratio (final reach ÷ rolling-median final reach; suppressed below 5 posts), link-placement cohort medians, and snippet/voice attribution from the durable snapshot store — signals that come from owning the curve, not proxying a single X endpoint.

Patron: SVG infographic of post performance (gold-steel theme). Mirrors ``account_statement_infographic`` — a dark-themed SVG of corpus size, median t+15m impressions, top posts, and link-placement cohorts.

Post a text tweet with markdown formatting converted to Unicode rich text. Accepts standard markdown inline formatting and converts it to Unicode Mathematical Alphanumeric Symbols that render as styled text on X: **bold** -> bold *italic* -> italic ***bold italic*** -> bold italic `monospace` -> monospace