0.7.4: favicons and Open Graph tags on the hosted MCP

CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.7.4
+- The hosted server now serves favicons and an apple-touch icon, and the landing page declares them (plus Open Graph tags), so directory listings (Smithery, Glama) show the Wicked icon instead of a generic one.
+- README carries the Smithery badge (npm page included).
+
 ## 0.7.3
 - Fix: the eight `paywall_*` tenant tools pointed at the paywall gateway host and returned 404. They now use the tenant API (`paywall-admin.wickedapi.com`; override with `PAYWALL_BASE_URL`).
 - New tool `paywall_demo_weather`: shows a real x402 challenge from the paywall gateway's demo route (`PAYWALL_GATEWAY_URL` to override).

manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": "0.3",
   "name": "wickedapi-mcp",
   "display_name": "WickedAPI",
-  "version": "0.7.3",
+  "version": "0.7.4",
   "description": "The whole Wicked suite in one MCP server — trading data, DeFi protocol health, token safety, brokerage sync, agent identity, reputation, tool registry, hallucination checks, persistent memory, and x402 paywalls. No signup: pay per call in USDC via x402, or use a partner API key.",
   "long_description": "WickedAPI turns your agent's wallet into its API key.\n\nMost APIs make you sign up, generate a key, and manage a subscription before your agent can ask a single question. This one skips all of that: point this server at a funded Base-mainnet wallet (`wickedapi_payer_private_key`) and every tool call auto-pays a fraction of a cent in USDC via x402 — no account, no dashboard, no monthly bill.\n\nDon't have a wallet handy? It still works. Call any priced tool with no credentials and you'll get back the real x402 payment challenge (price, network, payTo address) instead of a dead end — and the Token Risk Oracle tool is free no matter what.\n\n90 tools across the Wicked suite. The first four services are generated live from each service's own OpenAPI spec:\n- **Trading Data API** (28, unprefixed, including on-chain reads: balances, token balances, nonces, blocks, ENS, transactions): spot prices & OHLCV, Wilder ATR, Fair Value Gaps, ICT liquidity levels, perp funding/OI, long/short ratios, order-book depth, spot-vs-perp basis, Hyperliquid, Kalshi prediction markets, DeFi TVL, crypto Fear & Greed, a verified FOMC/CPI/jobs macro calendar, an earnings calendar, Ethereum gas, US Treasury yields, market clock, global crypto stats, and an AI momentum score.\n- **Protocol Health Oracle** (6, `protocol_health_*`): live-scored DeFi protocol health across the full DefiLlama universe.\n- **Token Risk Oracle** (1, `token_risk`, always free): real on-chain scam/rug-check signals for any EVM or Solana token.\n- **Broker Sync API** (6, `broker_sync_*`): real positions, balances, and transactions across 30+ brokerages.\n- **Filings Oracle** (7, `filings_*`): real-time SEC EDGAR alerts - 8-K events classified by item, Form 4 insider trades parsed per transaction, 13D/13G, 10-K, 10-Q.\n- **Wallet Oracle** (2, `wallet_*`): free OFAC sanctions lookup plus a full counterparty check (OFAC, malicious-address flags, on-chain profile) with a go/no-go recommendation.\n- **Wicked Reputation** (5, `reputation_*`, free): on-chain agent staking, tiers and reputation.\n- **Wicked Registry** (6, `registry_*`): real uptime/latency/schema scores for x402 and MCP tools.\n- **Wicked Identity** (6, `identity_*`): reverse-CAPTCHA / Know-Your-Agent verification with signed assertions.\n- **Wicked Sanity** (2, `sanity_check*`): hallucination / eval check of a claim against your context or live web evidence.\n- **Wicked Memory** (8, `memory_*`): persistent, wallet-scoped agent memory with semantic search and versioned history.\n- **x402 Paywall** (8, `paywall_*`): put any HTTP endpoint behind pay-per-call USDC on Base.\n\nIdentity, Registry registration and Memory never sign anything or hold a key: you supply the wallet signature yourself.\n\nPlus 6 resources (the platform directory, llms.txt, and each service's live catalog) and 7 prompts (`rug_check`, `vet_dependency`, `morning_briefing`, `fact_check`, `verify_agent`, `find_reliable_tool`, `agent_memory_guide`) that chain tools together into one-click workflows.\n\nNo fabricated data, ever — upstream failures return a real error, never a made-up number.",
   "author": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wickedlabs/wicked-mcp",
-  "version": "0.7.3",
+  "version": "0.7.4",
   "description": "MCP server for the whole Wicked suite — trading data, DeFi protocol health, token safety, SEC filings alerts, wallet and sanctions checks, brokerage sync, agent identity, reputation, tool registry, hallucination checks, persistent memory, and x402 paywalls. 100+ tools, 6 resources, 3 prompts. No signup required: pay per call in USDC via x402, or use a partner API key.",
   "type": "module",
   "bin": {

server.json

@@ -3,7 +3,7 @@
   "name": "io.github.WickedAPI/wicked-mcp",
   "title": "Wicked MCP",
   "description": "Whole Wicked suite for agents: market data, SEC filings, wallet checks, risk, identity, memory.",
-  "version": "1.6.3",
+  "version": "1.6.4",
   "websiteUrl": "https://mcp.wickedapi.com",
   "repository": {
     "url": "https://github.com/WickedAPI/wicked-mcp",
@@ -13,7 +13,7 @@
     {
       "registryType": "npm",
       "identifier": "@wickedlabs/wicked-mcp",
-      "version": "0.7.3",
+      "version": "0.7.4",
       "transport": {
         "type": "stdio"
       },

shim/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wickedapi-mcp",
-  "version": "0.7.3",
+  "version": "0.7.4",
   "description": "MOVED: this package is now @wickedlabs/wicked-mcp. This release forwards to it, so existing `npx wickedapi-mcp` setups keep working.",
   "type": "module",
   "bin": {

src/http.ts

@@ -9,6 +9,7 @@ import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/
 import { clientKey } from "./clientIp.js";
 import { fairSnapshot, withClient } from "./fair.js";
 import { rateLimited } from "./rateLimit.js";
+import { ICONS } from "./icons.js";
 import { landingHtml, llmsTxt, serverCard } from "./landing.js";
 import { knownTools, usageHooks, usageSnapshot } from "./usage.js";
 import { buildServer, loadWorld, SERVER_VERSION } from "./server.js";
@@ -65,6 +66,11 @@ async function main() {
     const host = (req.headers.host || "").toLowerCase();
     if (!ALLOWED_HOSTS.includes(host)) return send(res, 421, { error: "Invalid Host header" });
     if (req.method === "GET" || req.method === "HEAD") {
+      const icon = ICONS[url.pathname];
+      if (icon) {
+        res.writeHead(200, { "content-type": icon.type, "cache-control": "public, max-age=86400", "content-length": icon.data.length });
+        return res.end(req.method === "HEAD" ? undefined : icon.data);
+      }
       if (url.pathname === "/") return sendText(res, "text/html", landingHtml(tools, SERVER_VERSION));
       if (url.pathname === "/llms.txt") return sendText(res, "text/plain", llmsTxt(tools, SERVER_VERSION));
       if (url.pathname === "/.well-known/mcp/server-card.json" || url.pathname === "/.well-known/mcp.json") {