MCP Server

claude mcp add --transport http lootrush https://mcp.lootrush.com/mcp \
  --header "Authorization: Bearer YOUR_API_KEY"

{
  "mcpServers": {
    "lootrush": {
      "url": "https://mcp.lootrush.com/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }
    }
  }
}

import crypto from "node:crypto";

// Fetch once from the getCardRevealPublicKey tool (result.publicKey), then cache.
const ISSUER_PUBLIC_KEY = await fetchRevealPublicKey(); // PEM

// Step 1 — build the sessionId (keep secretKeyHex; you need it to decrypt).
const secretKeyHex = crypto.randomBytes(16).toString("hex"); // AES-128 key
const wrappedKey = crypto.publicEncrypt(
  {
    key: ISSUER_PUBLIC_KEY,
    padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,
    oaepHash: "sha1",
  },
  // The issuer expects the base64 of the raw key bytes, RSA-wrapped.
  Buffer.from(Buffer.from(secretKeyHex, "hex").toString("base64"), "utf8")
);
const sessionId = wrappedKey.toString("base64");

// Step 2 — call getUserCards with includeCardSecrets + sessionId (omitted here).
// Step 3 — decrypt the returned ciphertext locally.
function decryptSecret({ base64Secret, base64Iv }, secretKeyHex) {
  const key = Buffer.from(secretKeyHex, "hex");
  const iv = Buffer.from(base64Iv, "base64");
  const blob = Buffer.from(base64Secret, "base64");
  // WebCrypto AES-GCM appends the 16-byte auth tag to the ciphertext.
  const tag = blob.subarray(blob.length - 16);
  const data = blob.subarray(0, blob.length - 16);
  const decipher = crypto.createDecipheriv("aes-128-gcm", key, iv);
  decipher.setAuthTag(tag);
  return Buffer.concat([decipher.update(data), decipher.final()]).toString("utf8");
}

// const pan = decryptSecret(cardSecrets.encryptedPan, secretKeyHex);
// const cvv = decryptSecret(cardSecrets.encryptedCvc, secretKeyHex);

{
  "jsonrpc": "2.0",
  "error": { "code": -32005, "message": "Rate limit exceeded" },
  "id": null
}