@aibtc/mcp-server 1.67.0 → 1.69.0

package/dist/tools/ordinals.tools.js

@@ -10,6 +10,7 @@
  *
  * Uses micro-ordinals library to parse and create inscriptions.
  */
+import { createHash } from "node:crypto";
 import { z } from "zod";
 import { NETWORK } from "../config/networks.js";
 import { P2WPKH_INPUT_VBYTES, P2WPKH_OUTPUT_VBYTES, P2TR_OUTPUT_VBYTES, TX_OVERHEAD_VBYTES, DUST_THRESHOLD, P2TR_INPUT_BASE_VBYTES, WITNESS_OVERHEAD_VBYTES, } from "../config/bitcoin-constants.js";
@@ -223,8 +224,10 @@ export function registerOrdinalsTools(server) {
                 feeRate: actualFeeRate,
                 contentType,
                 contentSize: body.length,
+                contentSha256: createHash("sha256").update(body).digest("hex"),
                 nextStep: "After commit confirms, call inscribe_reveal with the same contentType, contentBase64, " +
-                    "plus commitTxid and revealAmount from this response.",
+                    "plus commitTxid and revealAmount from this response. Pass contentSha256 back to inscribe_reveal " +
+                    "to have the server abort before the reveal fee is spent if the decoded body differs by even one byte.",
             });
         }
         catch (error) {
@@ -252,12 +255,20 @@ export function registerOrdinalsTools(server) {
             contentBase64: z
                 .string()
                 .describe("Content as base64-encoded string (must match the commit step)"),
+            contentSha256: z
+                .string()
+                .regex(/^[0-9a-f]{64}$/i)
+                .optional()
+                .describe("Optional: sha256 hex digest of the decoded body from the inscribe commit response. " +
+                "If provided, the server computes sha256 over the locally-decoded body and aborts before " +
+                "broadcasting the reveal if they differ — prevents burning the reveal fee on a witness-hash " +
+                "mismatch when the base64 param drifts between the inscribe and inscribe_reveal calls."),
             feeRate: z
                 .union([z.enum(["fast", "medium", "slow"]), z.number().positive()])
                 .optional()
                 .describe("Fee rate for reveal tx (default: medium)"),
         },
-    }, async ({ commitTxid, revealAmount, contentType, contentBase64, feeRate }) => {
+    }, async ({ commitTxid, revealAmount, contentType, contentBase64, contentSha256, feeRate }) => {
         try {
             // Check wallet session
             const walletManager = getWalletManager();
@@ -277,6 +288,21 @@ export function registerOrdinalsTools(server) {
             const mempoolApi = new MempoolApi(NETWORK);
             // Reconstruct the inscription and reveal script
             const body = Buffer.from(contentBase64, "base64");
+            // If the caller supplied the sha256 digest from the commit response, verify the
+            // decoded body matches BEFORE we spend the reveal fee. Silent byte drift between
+            // the two calls would otherwise commit a tapscript hash that Bitcoin Core rejects
+            // as witness-hash-mismatch, burning the reveal-address sats permanently.
+            if (contentSha256) {
+                const localSha256 = createHash("sha256").update(body).digest("hex");
+                if (localSha256.toLowerCase() !== contentSha256.toLowerCase()) {
+                    return createErrorResponse(new Error(`contentSha256 mismatch: the decoded body's sha256 (${localSha256}) does not match ` +
+                        `the digest from the inscribe commit response (${contentSha256}). This means the ` +
+                        `base64 payload passed to inscribe_reveal is not the exact bytes committed on-chain. ` +
+                        `Aborting BEFORE broadcasting the reveal so the reveal-address sats are not burned. ` +
+                        `Re-send the exact base64 from the successful inscribe call (or fix the transport / ` +
+                        `serialization layer that mutated it).`));
+                }
+            }
             const inscription = {
                 contentType,
                 body,

package/dist/transactions/builder.js

@@ -3,7 +3,7 @@ import { hexToBytes } from "@stacks/common";
 import { getStacksNetwork, getApiBaseUrl } from "../config/networks.js";
 import { getHiroApi } from "../services/hiro-api.js";
 import { resolveDefaultFee } from "../utils/fee.js";
-import { getSpendLimiter } from "../services/spend-limiter.js";
+import { getSpendLimiter, totalBoundedSpends } from "../services/spend-limiter.js";
 import { getTrackedNonce, recordNonceUsed, resetTrackedNonce, reconcileWithChain, } from "../services/nonce-tracker.js";
 // ---------------------------------------------------------------------------
 // Pending nonce tracking (unified via SharedNonceTracker, issue #413)
@@ -117,6 +117,16 @@ export async function transferStx(account, recipient, amount, memo, fee) {
  * Call a smart contract function
  */
 export async function callContract(account, options) {
+    // Safety rail. Swaps, lending and pot entries all funnel through here, and
+    // their amounts are denominated in whatever token the call moves — there is no
+    // ledger to bill 1,000 ALEX against. The post conditions are the way in: they
+    // already bound, in native units, how much of each asset may leave this
+    // address. Meter the ones this rail has a ledger for and ignore the rest.
+    // Deliberately before makeContractCall, so an over-cap call never signs.
+    const meteredSpends = totalBoundedSpends(options.postConditions, account.address);
+    for (const spend of meteredSpends) {
+        await getSpendLimiter().check(spend.unit, spend.amount, account.address);
+    }
     const networkName = getStacksNetwork(account.network);
     const nonce = await getNextNonce(account.address, account.network);
     // Always resolve a clamped fee — prevents @stacks/transactions from over-estimating.
@@ -141,6 +151,9 @@ export async function callContract(account, options) {
         throw new Error(`Broadcast failed: ${broadcastResponse.error} - ${broadcastResponse.reason}`);
     }
     advancePendingNonce(account.address, nonce, broadcastResponse.txid);
+    for (const spend of meteredSpends) {
+        await getSpendLimiter().record(spend.unit, spend.amount, account.address);
+    }
     return {
         txid: broadcastResponse.txid,
         rawTx: transaction.serialize(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aibtc/mcp-server",
-  "version": "1.67.0",
+  "version": "1.69.0",
   "description": "Bitcoin-native MCP server for AI agents: BTC/STX wallets, DeFi yield, sBTC peg, NFTs, and x402 payments.",
   "mcpName": "io.github.aibtcdev/mcp-server",
   "type": "module",

package/skill/SKILL.md

@@ -4,7 +4,7 @@ description: Bitcoin L1 wallet for agents - check balances, send BTC, manage UTX
 license: MIT
 metadata:
   author: aibtcdev
-  version: 1.67.0 # x-release-please-version
+  version: 1.69.0 # x-release-please-version
   npm: "@aibtc/mcp-server"
   github: https://github.com/aibtcdev/aibtc-mcp-server
 ---