io.github.lonniev/roastify-mcp

Generate a patron's account statement at this operator. Returns the patron's purchase history, active credit tranches, per-tool usage breakdown, and recent daily usage logs. This is the patron's spending account — not the operator's Authority tax balance. Free — no credits consumed. Proof of npub ownership is required to prevent statement-scraping of arbitrary patrons.

Generate a visual SVG infographic of your account statement. Returns the same data as account_statement, rendered as a dark-themed SVG graphic with balance hero, metrics cards, health gauge, tranche table, and tool usage breakdown. Costs 1 api_sat per call. Proof is verified by ``debit_or_deny`` before any cost is incurred.

Add a new element (text or image) to a design and commit a new version of it. The store is configuration management: the element is committed back to the SAME design_id (git tracks the diff). The new element's id comes back, so you can immediately edit a text element by id with update_design_text, or move/reorder either kind with move_elements. Placement is validated server-side and REFUSED, not warned: the element must fall inside the named panel (with a default margin — the dieline carries no real safe area) — or, when the product has no panels (Tubes / continuous wrap), inside the design sheet — and must not overlap any existing element (the collider's id is named). Typography is inherited for text, so a new text element matches the template. Image creation reuses a src already present in the design (no new asset upload) — pass `kind="image"` with `src_from` (an existing image id) or `src` that already appears on an image.

Check this operator's adoption-request status at a chosen Authority. Free. Polls the Authority MCP-to-MCP for the status of this operator's request (pending / approved / rejected / provisioned).

Check a Roastify artwork job. Free — polling never costs anything. A finished job carries ``artwork_url``; a failed one carries ``error``.

Browse the Roastify catalog: products and coffee blends together. Plan-gated items are returned with their tier marked, not hidden. Note that Roastify's catalog carries no origin, altitude, processing, or varietal data — those live only in the Merchant App UI. Roast level and decaf status come from the blend.

Check this operator's tax balance at the Authority. Returns the sats available for certifying patron credit purchases. When this balance reaches zero, patron top-ups cannot be certified and the operator must call purchase_credits on the Authority. This is the operator's own funding — not a patron balance. Free.

Check a patron's credit balance at this operator. This is the patron's spending balance — credits purchased via Lightning for tool calls at this operator. For the operator's own balance at the Authority (needed to certify patron purchases), use authority_check_balance instead. Free — no credits required. Proof of npub ownership is required to prevent anyone-with-the-registry from enumerating balances.

Check the payment status of a Lightning invoice. Call after paying the invoice from purchase_credits. Free — no credits required. Proof of npub ownership is required to prevent credit-grant front-running by an observer of the invoice ID.

Preview the effective cost of a tool call. Shows the base cost and any constraint effects (discounts, free trials, surge pricing). Free — no credits required.

Check whether a previously-cached dpop_token is still valid. Mirrors ``check_oauth_status`` for the npub-proof flow: a calling agent can ask "will my next paid call accept this dpop_token?" before burning credits on a guaranteed failure. Free, no side effects — does not evict the cache or touch relays.

Check Roastify stock for one SKU, or the whole stock list.

Delete a coupon. Cascades to all patron redemptions. Any chain step referencing the deleted coupon_id becomes a no-op (the constraint returns neutral on unknown ids) — the Studio surfaces orphan references as warnings. RESTRICTED to operator — requires proof.

Delete one of your stored designs.

Remove a single operator secret field. Deletes one key from the operator's encrypted credential blob without touching the others — the field-level counterpart to ``forget_credentials``, which wipes the whole row. Use it to retire a leftover after an SDK cutover (a Prefect key after Modal, or a stored but untemplated orphan like ``anthropic_api_key``) without taking the operator down for a full re-delivery. Stored-but-untemplated fields are first-class: the delete is keyed on what is vaulted, not on what the current template declares. Idempotent — already-absent fields report ``removed: false`` without rewriting the vault. RESTRICTED to the operator — requires proof (nsec-signed kind-27235 or a cached dpop_token phrase); patron proofs are rejected. A deletion is as destructive as a write.

Remove a single patron credential field. Deletes one field from stored credentials without affecting other fields. Free. Proof of npub ownership is required — this is a write to the patron's sensitive credential vault.

Fetch one of your stored designs in full, with its images re-inlined.

Remove a coupon from this patron's redemption list. Cosmetic only — the coupon itself still exists at the operator, and the patron can re-redeem the same code later while the window allows. Free — requires proof of ``npub``.

Delete vaulted credentials for a specific service and npub. For operator credentials, pass the operator's own npub. For patron credentials, pass the patron's npub. Always requires proof of npub ownership — a deletion is as destructive as a write.

Generate packaging artwork from one of your saved Design Studio designs. This personalizes a template you already authored: it rewrites that design's named text and image placeholders. It cannot author a design from scratch, and the artwork it produces is NOT attached to a product — Roastify's API has no product-create or storefront-sync surface. You get an artwork URL and carry it onward yourself. Roastify renders asynchronously, so this returns a job id straight away. Check it with roastify_artwork_status, which is free.

Get one coffee blend: roast level, decaf status, and its variants.

Get one catalog product with its variants, sizes, prices, and dieline.

List the editable text layers of a stored design — the fields you can change. Returns each text layer's id, current text, `chars` (its length), font, `align`, box geometry (`fontSize`, `width`, `height`), and `z` (paint-order index in the top-level `elements` array) — but NOT the design's images, so it stays small enough to reason over in a conversation. Each layer's current text is its own label: infer its role (product name, tagline, story, recipe, tasting notes, …) from the words it holds. The same name often appears in several layers and inside longer blurbs; change every id that should carry it. Also returns `sheet` (the overall design extent), `panels` (the box's panel columns — front/back/left/right — recovered from the dieline, each with bounds; empty for single-face products like Tubes, where placement uses `sheet` instead), and a real `face` per layer/element (which panel its x-centre sits on, not the constant "sheet"; when panels is empty, layers keep their native faceId such as "wrap"). And `elements` — the NON-text elements (images, shapes, rules), each with id, type, name, bounds, `z`, and its `fill`/`stroke` colours — so a roast scale can be audited (a filled dot has a dark `fill`, an empty one none) and set with roastify_move_elements. `fonts` lists the families loaded on the design plus any family a layer already uses — pick from it when setting `fontFamily` via move_elements. Read those before judging the design: a header with no text value beneath it is NOT necessarily a defect — the value may be a graphic in `elements` (e.g. a five-dot roast scale under a ROAST header), and it tells you where NOT to place new text. Roastify's migrated format carries no visibility flag, so a layer that exists may still not print — do not report a missing value as a production error. Geometry: each layer's `x`/`y` is its top-left corner in design units (the sheet origin is its top-left). `width`/`height` are MEASURED text bounds, not fixed frames — text does no…

Get one of your saved product designs in full, with all its variants. The coffee's IDENTITY (which blend) is not a named field — it is encoded in the variant SKU, e.g. `COF-WHB-12O-HGL-BOX` → `HGL` → the High Lakes blend. Decode the SKU before writing origin/roast copy: a product's title can say one thing while its SKU is really a different blend.

Read an npub's public Nostr profile (NIP-01 kind-0 metadata). Free, no proof — the data is already public on relays. Returns the latest metadata fields (name, display_name, about, picture, banner, nip05, website, lud16) or an empty profile if none is published.

Generate a Merkle inclusion proof that a patron's balance was included in a Bitcoin-notarized snapshot.

Report this operator's configuration readiness. Shows which operator settings are configured, which are missing, and how to deliver each missing value. For patron-level credential status, use get_patron_onboarding_status instead. Free.

List stored patron credential field names (not values). Returns the names of fields stored for a patron, plus each field's ``delivered_at`` ISO-8601 timestamp when known (null for secrets vaulted before timestamps were recorded). Values are never exposed — use this to verify which fields are configured and how old each one is. Free. Proof of npub ownership is required: the list of configured fields is itself sensitive (reveals which integrations a patron has set up).

Report a patron's credential readiness for this operator. For set-once services (eXcalibur, TheBrain), shows which patron secrets are configured and which are missing. For dynamic/OAuth2 services (Schwab), reports that no patron credentials are needed. Free. Proof of npub ownership is required because credential presence is sensitive information about the patron's setup.

Get the active pricing model for this operator. Free. If no model exists, self-initializes a scaffold with all registered tools at 0 sats. No economic data from code.

Return canonical (tool_id, mcp_name, …) for every tool the wheel exposes. The authoritative source for any client (Studio, agents, FE) that needs to know how this MCP identifies its tools. Reconcile uses this output to UUID-join against the stored pricing model — no name-based UUID derivation, no guessing. Includes both ToolIdentity-seeded tools and any UUID recorded by ``@paid_tool`` that is missing from the registry. The latter appear with ``registered: false`` (and in the top-level ``unregistered`` array) so Reconcile can flag deploy drift instead of silently reporting clean when a live tool was never seeded (#174). If the operator renames a function or rebrands a slug, the mcp_name in this output changes but tool_id stays. That's the whole point of the canonical-UUID design. Also diffs the live FastMCP wire surface against the registry. Tools exposed on the wire but absent from the registry appear in ``unregistered`` so Reconcile can flag deploy drift instead of silently under-reporting (issue #175). Free, no side effects.

List all available constraint types and their parameter schemas. Returns the type, category, description, and parameter specs for every constraint that can be used in a pricing pipeline. Free — no credits required.

List every coupon this operator has minted (newest first). Each row carries the current ``times_redeemed`` counter — the Studio renders a progress bar from this against ``total_uses``. RESTRICTED to operator — requires proof.

List a stored design's committed versions, newest first — the git history. Each version carries its `sha`, `short_sha`, `date`, commit `message`, `tag` (the version tag if one was set at Commit), and `commit_url`. Pass a version's `sha` (or `tag`) as the `ref` to roastify_fetch_design to fetch that exact version.

List your stored designs — metadata only, newest first.

List the coupons this patron has redeemed on this operator. Returns both active and exhausted redemptions with a per-row ``status`` (``active`` / ``window_closed`` / ``patron_limit`` / ``total_limit``). Free — requires proof of ``npub``.

List your own saved Roastify product designs, one page at a time. Returns has_next_page and end_cursor so you can tell a page from a complete list.

List recent Bitcoin notarization records.

Create a new operator-owned discount coupon.

Move a group of elements together and/or resize elements; commit a new version. The Designer can move only one layer at a time, so a block of layered content (a spec panel, a logo lockup) drifts out of alignment when its backing shape is moved alone. This relocks that block: name the ids and shift them as one rigid object, and separately re-centre or resize individual rectangles. The store is configuration management: the edit is committed back to the SAME design_id (git tracks the diff). Apply it onto the product with the browser courier. Nothing is validated against panel bounds here (unlike add_design_element): you are re-aligning existing, deliberately-placed content, so the caller owns the coordinates. The heavy background image is never moved unless you name its id.

Build a Merkle tree of all patron balances and submit the root to Bitcoin via OpenTimestamps. Operator-only background task. Bitcoin confirmation takes 1-6 hours. Free — no credits required.

Describe the DPYC ecosystem via the Oracle. Free.

Get the current DPYC certification tax rate. Free.

Get DPYC onboarding instructions from the Oracle. Free.

Look up a DPYC community member by npub. Free.

Get active network advisories from the Oracle. Free.

Publish a CLIENT-SIGNED kind-0 profile to relays for an npub. The wheel never holds a patron nsec. The frontend signs the kind-0 metadata event with the patron's session key or a NIP-07 extension and passes the signed event (JSON) here; the wheel verifies the signature matches the npub, then relays it to public relays. The signature is the authorization — no proof token, no key custody. Free.

Buy credits via Bitcoin Lightning. Creates a Lightning invoice. Pay it with any Lightning wallet, then call check_payment to confirm. Proof of npub ownership is required so credits land in the correct ledger. Free — no credits required to call.

Pick up credentials from the Secure Courier. Completes the CREDENTIAL-DELIVERY flow (the ownership-proof counterpart is ``receive_npub_proof``). **Call this only after the user confirms they have replied.** Deterministic, one-shot retrieval: name the response you want with ``(sender_npub, service, dpop_token)`` and the tool drains ONLY the rendezvous relay that channel was pinned to. Every popped DM with the wrong session phrase is deleted and its sender is NACK'd; the first DM with the matching phrase is accepted (ACK'd) and the scan stops. If none match, the queue is drained and a ``courier_not_found`` result is returned. Do NOT poll, loop, or retry. If a credential_card (ncred1...) is provided, it is redeemed directly without any relay access (dpop_token not required for that path). On success, the payment processor client is reinitialized from the new credentials — no server restart needed.

Receive npub ownership confirmation from a patron. Completes the npub-OWNERSHIP-PROOF flow (the credential-delivery counterpart is ``receive_credentials``). **Call this only after the user confirms they have replied.** Deterministic, one-shot retrieval: name the response with ``(patron_npub, dpop_token)`` — the ``dpop_token`` being the value returned by ``request_npub_proof``. The tool drains ONLY the pinned rendezvous relay that challenge was published on, stopping at the DM whose phrase matches. Mismatched DMs are deleted and NACK'd (without revealing the expected phrase). If called before the user replies, their message will never be found. Do NOT poll, loop, or retry. The signed DM itself proves npub ownership (the patron's nsec signed it). On success, returns the ``dpop_token`` — the same token. The calling application MUST remember it and pass it as the ``dpop_token`` parameter on every subsequent paid tool call. The proof (a hash of the token) is stored in the vault keyed by that hash — the MCP never stores the raw token itself. Free.