@aifinpay/mcp 1.5.1 → 2.0.0-rc.3

package/README.md

@@ -1,17 +1,13 @@
 # @aifinpay/mcp
 
-MCP server exposing AiFinPay's autonomous x402 payment loop as
-agent-callable tools. Drop it into Claude Desktop, MCP Inspector, or any
-MCP-aware agent runtime — your agent can now buy services autonomously.
-
-Canonical domain: **aifinpay.io** (the legacy `aifinpay.company` host is
-retired — ignore any docs pointing there). SDK settlement runs on
-**Polygon (default) and Solana**; the underlying Node SDK (≥ 1.3.0) also
-supports direct splitter settlement on Base, Optimism, Unichain, BOT Chain
-and XRPL EVM (native-token path), while the MCP `pay_with_split` /
-`quote_split` tools stay Polygon + Solana (backend invoice flow). The
-protocol itself is live across 13 networks — see
-[aifinpay.io/llms.txt](https://aifinpay.io/llms.txt).
+MCP server exposing AiFinPay payment and quote primitives to MCP-aware
+agent runtimes. Canonical domain: **aifinpay.io**.
+
+AIFP-1 is gross-inclusive: payer total equals the quote, merchant receives 99%,
+AiFinPay receives 1%, creator/referral receives 0%. AIFP-2/x402 currently
+charges 0% at the protocol layer. Fund-moving paths fail closed until the exact
+deployment, runtime hash, governance profile, merchant target, asset and paid
+E2E evidence are verified.
 
 ## Tools
 
@@ -21,8 +17,8 @@ protocol itself is live across 13 networks — see
 | `agent_address()` | Return the agent's funding addresses on **both** chains — Polygon `0x…` (default settlement: io.net, Exa, Venice bridges) and Solana base58 (Seat PDA / leaderboard). One seed, two chains — fund either. |
 | `agent_quote(url)` | Inspect a 402 challenge without paying. Shows the merchant's quoted amount + facilitator flavor. |
 | `agent_call(provider, …)` | Call a live provider from the AiFinPay directory (io.net, Exa, Venice, …) with automatic payment. |
-| `pay_with_split(chain, merchant, amount, …)` | Direct fee-on-top payment to any merchant wallet — merchant receives 100% of the amount, AiFinPay adds 1% on top. |
-| `quote_split(chain, amount)` | Preview the exact on-chain amounts of a `pay_with_split` before paying. |
+| `pay_with_split(…)` | Retired compatibility tool. Returns `legacy_split_route_retired`; never creates an invoice or moves funds. |
+| `quote_split(…)` | Retired compatibility tool. Use a canonical AIFP-1 quote. |
 | `agent_claim_self(magic_link_url)` | Link this agent to your dashboard account via a one-shot magic link from `aifinpay.io/login` — spend history shows up in the dashboard. |
 
 ## Install
@@ -77,7 +73,7 @@ agent identity (and any funded Seat) persists across restarts.
 | `AIFINPAY_AGENT_SECRET` | — | Base58 secret. If absent → ephemeral agent printed to stderr. |
 | `AIFINPAY_BASE_URL` | `https://aifinpay.io` | Backend URL for nonce + funding probes. |
 | `AIFINPAY_TIMEOUT_MS` | `30000` | Request timeout. |
-| `AIFINPAY_MAX_USD` | — | Hard cap per single payment. Strongly recommended. |
+| `AIFINPAY_MAX_USD` | — | Mandatory positive finite operator ceiling for any fund-moving tool. |
 
 ## Programmatic use
 

package/bin/aifinpay-mcp.js

@@ -4,14 +4,171 @@
  * in stdio mode. Compatible with Claude Desktop, MCP Inspector, and any
  * MCP-aware agent runtime.
  *
- * Configure via env:
- *   AIFINPAY_AGENT_SECRET   base58 secret (load existing identity)
+ * Two commands, and the first one only has to be run once:
+ *
+ *   npx @aifinpay/mcp init     create a persistent wallet, print the config
+ *   npx @aifinpay/mcp          start the server
+ *
+ * WHY `init` EXISTS
+ *
+ * Running the server with nothing configured produced an EPHEMERAL wallet and
+ * a "DO NOT FUND" warning — correct, and a dead end. The warning pointed at
+ * `aifinpay init`, which is not published to npm: `@aifinpay/cli` and
+ * `aifinpay` both 404. So the documented way out of the dead end did not exist,
+ * and the only real path was to write a Node script against the SDK, which is
+ * not something you ask of someone whose goal is "give my agent a wallet".
+ *
+ * The gap was exactly one subcommand. This is it.
+ *
+ * Configure via env (all optional; the secret is read from the keystore below
+ * when the variable is unset):
+ *   AIFINPAY_AGENT_SECRET   base58 secret — overrides the keystore
  *   AIFINPAY_BASE_URL       default https://aifinpay.io
  *   AIFINPAY_TIMEOUT_MS     default 30000
  *   AIFINPAY_MAX_USD        hard cap per single payment (no default)
  */
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { createServer, loadConfigFromEnv } from "../dist/index.js";
+import { readFileSync, writeFileSync, mkdirSync, existsSync, statSync, chmodSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { createRequire } from "node:module";
+
+const HOME = process.env.AIFINPAY_HOME || join(homedir(), ".aifinpay");
+const KEYSTORE = join(HOME, "agent.json");
+
+const require_ = createRequire(import.meta.url);
+const VERSION = (() => {
+  try {
+    return require_("../package.json").version;
+  } catch {
+    return "unknown";
+  }
+})();
+
+const arg = (process.argv[2] || "").toLowerCase();
+
+// ── help / version ────────────────────────────────────────────────────────
+// These used to start the server. `--help` launching a stdio server is not a
+// harmless quirk: the process appears to hang, because it is waiting for MCP
+// framing on stdin that a human is never going to type.
+
+if (arg === "--help" || arg === "-h" || arg === "help") {
+  process.stdout.write(`aifinpay-mcp ${VERSION}
+
+  npx @aifinpay/mcp init     create a persistent wallet and print the config
+  npx @aifinpay/mcp          start the MCP server (stdio)
+
+Run init once. It writes ${KEYSTORE} with mode 600 and the server picks
+it up automatically — you do not have to put the secret in a config file.
+
+Env (all optional):
+  AIFINPAY_AGENT_SECRET   base58 secret; overrides the keystore
+  AIFINPAY_MAX_USD        hard cap per single payment — set this
+  AIFINPAY_BASE_URL       default https://aifinpay.io
+  AIFINPAY_TIMEOUT_MS     default 30000
+  AIFINPAY_HOME           default ~/.aifinpay
+`);
+  process.exit(0);
+}
+
+if (arg === "--version" || arg === "-v" || arg === "version") {
+  process.stdout.write(`${VERSION}\n`);
+  process.exit(0);
+}
+
+// ── init ──────────────────────────────────────────────────────────────────
+
+function readKeystore() {
+  if (!existsSync(KEYSTORE)) return null;
+  try {
+    const parsed = JSON.parse(readFileSync(KEYSTORE, "utf8"));
+    return typeof parsed?.secretB58 === "string" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+if (arg === "init") {
+  const { Agent, AiFinPayAgent } = await import("@aifinpay/agent");
+
+  let store = readKeystore();
+  if (store) {
+    // Never silently overwrite. The file is the only copy of a key that may
+    // already hold funds; a second `init` that regenerated it would destroy a
+    // wallet to save one line of output.
+    process.stdout.write(`Existing wallet found at ${KEYSTORE} — keeping it.\n\n`);
+  } else {
+    mkdirSync(HOME, { recursive: true, mode: 0o700 });
+    store = { secretB58: Agent.new().secretB58, created: new Date().toISOString() };
+    writeFileSync(KEYSTORE, JSON.stringify(store, null, 2) + "\n", { mode: 0o600 });
+    chmodSync(KEYSTORE, 0o600); // writeFileSync honours umask; this does not
+    process.stdout.write(`Created ${KEYSTORE} (mode 600).\n\n`);
+  }
+
+  const agent = await AiFinPayAgent.fromSolanaSecret(store.secretB58);
+
+  process.stdout.write(
+    `Your agent's addresses — the EVM one is the same on every EVM chain:\n\n` +
+      `  EVM     ${agent.evmAddress}\n` +
+      `  Solana  ${agent.solanaAddress}\n` +
+      `  Casper  ${agent.casperAddress}\n\n` +
+      `Add this to your MCP client config and restart it:\n\n` +
+      JSON.stringify(
+        {
+          mcpServers: {
+            aifinpay: {
+              command: "npx",
+              args: ["-y", "@aifinpay/mcp"],
+              env: { AIFINPAY_MAX_USD: "0.10" },
+            },
+          },
+        },
+        null,
+        2,
+      ) +
+      `\n\nThe secret is NOT in that block on purpose — the server reads the\n` +
+      `keystore. Config files get pasted into chats and committed to git.\n\n` +
+      `Back up ${KEYSTORE}. It is the only copy. The derivation is not\n` +
+      `BIP-39, so no standard wallet can recover this from a phrase.\n\n` +
+      `The addresses hold nothing yet. Send POL to the EVM address to let the\n` +
+      `agent pay for calls.\n`,
+  );
+  process.exit(0);
+}
+
+if (arg && !arg.startsWith("-")) {
+  process.stderr.write(`aifinpay-mcp: unknown command "${arg}". Try --help.\n`);
+  process.exit(2);
+}
+
+// ── server ────────────────────────────────────────────────────────────────
+
+// Fall back to the keystore so `init` once is genuinely enough. Env still wins:
+// a caller that sets AIFINPAY_AGENT_SECRET explicitly means it.
+if (!process.env.AIFINPAY_AGENT_SECRET) {
+  const store = readKeystore();
+  if (store) {
+    try {
+      const mode = statSync(KEYSTORE).mode & 0o777;
+      if (mode & 0o077) {
+        process.stderr.write(
+          `[warn] [aifinpay-mcp] ${KEYSTORE} is mode ${mode.toString(8)} — readable beyond your user. ` +
+            `Run: chmod 600 ${KEYSTORE}\n`,
+        );
+      }
+    } catch {
+      /* stat failure is not a reason to refuse to start */
+    }
+    process.env.AIFINPAY_AGENT_SECRET = store.secretB58;
+  } else {
+    process.stderr.write(
+      `[info] [aifinpay-mcp] no wallet configured. Run \`npx @aifinpay/mcp init\` once ` +
+        `for a persistent one; starting with a throwaway identity for now.\n`,
+    );
+  }
+}
+
+const { StdioServerTransport } = await import("@modelcontextprotocol/sdk/server/stdio.js");
+const { createServer, loadConfigFromEnv } = await import("../dist/index.js");
 
 const { server } = await createServer(loadConfigFromEnv());
 const transport = new StdioServerTransport();

package/dist/config.d.ts

@@ -9,6 +9,30 @@ export interface McpConfig {
     timeoutMs?: number;
     /** Hard cap on a single payment to prevent runaway agents. */
     maxAmountUsd?: number;
+    /** Gateway origins this agent may settle against.
+     *
+     *  The SDK has always supported this (parseGatewayUrl in @aifinpay/agent) and
+     *  this wrapper never exposed it, so a self-hosted merchant was unreachable:
+     *  payable_fetch reached the 402 and then refused with "dev.ratersapp.com is
+     *  not a known AiFinPay gateway; allowed: https://gateway.aifinpay.io".
+     *  Observed in an external E2E run on 2026-08-27.
+     *
+     *  Set by the OPERATOR, exact origins only, never a wildcard. The refusal it
+     *  relaxes is not paranoia: a 402 is unauthenticated, so paying an
+     *  unrecognised host means paying whoever answered. Naming a host here is a
+     *  statement that you know who that is. */
+    gatewayOrigins?: string[];
+    /** Hosts whose DNS pre-check is skipped, exact names only.
+     *
+     *  safe-fetch resolves a hostname and refuses if any answer is a private
+     *  address — an SSRF guard. Behind an HTTP proxy the client cannot resolve at
+     *  all (getaddrinfo EAI_AGAIN), so every host is refused for the wrong reason.
+     *
+     *  This is deliberately NOT a proxy-detection switch that disables the check
+     *  globally: that would turn one environment quirk into a blanket SSRF
+     *  bypass. An operator names the hosts they vouch for, one at a time, and the
+     *  guard stays on for everything else. */
+    trustedHosts?: string[];
     /** Optional log destination (defaults to stderr). */
     logFn?: (level: "info" | "warn" | "error", msg: string) => void;
 }

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,MAAM,WAAW,SAAS;IACxB;kFAC8E;IAC9E,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,6BAA6B;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,qDAAqD;IACrD,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACjE;AAED,wBAAgB,iBAAiB,IAAI,SAAS,CAW7C"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,MAAM,WAAW,SAAS;IACxB;kFAC8E;IAC9E,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,6BAA6B;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;;;;;;;;;+CAW2C;IAC3C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAE1B;;;;;;;;;8CAS0C;IAC1C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB,qDAAqD;IACrD,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACjE;AAED,wBAAgB,iBAAiB,IAAI,SAAS,CAa7C"}

package/dist/config.js

@@ -8,6 +8,52 @@ export function loadConfigFromEnv() {
         maxAmountUsd: process.env.AIFINPAY_MAX_USD
             ? Number(process.env.AIFINPAY_MAX_USD)
             : undefined,
+        gatewayOrigins: splitOrigins(process.env.AIFINPAY_GATEWAY_ORIGINS),
+        trustedHosts: splitList(process.env.AIFINPAY_TRUSTED_HOSTS),
     };
 }
+/** Comma-separated list → trimmed entries, or undefined when unset/empty.
+ *  Undefined and [] mean different things downstream: undefined keeps the SDK
+ *  default, [] would mean "no origin is payable". An operator who sets the
+ *  variable to an empty string means the former. */
+function splitList(raw) {
+    if (!raw)
+        return undefined;
+    const out = raw.split(",").map((s) => s.trim()).filter(Boolean);
+    return out.length ? out : undefined;
+}
+/** Same, but each entry must be a bare https origin.
+ *  A path or a wildcard here would read as allowed and match nothing, which is
+ *  the failure that looks like the feature is broken rather than misconfigured. */
+function splitOrigins(raw) {
+    const list = splitList(raw);
+    if (!list)
+        return undefined;
+    for (const entry of list) {
+        let u;
+        try {
+            u = new URL(entry);
+        }
+        catch {
+            throw new Error(`AIFINPAY_GATEWAY_ORIGINS: "${entry}" is not a URL`);
+        }
+        if (u.origin !== entry.replace(/\/+$/, "")) {
+            throw new Error(`AIFINPAY_GATEWAY_ORIGINS: "${entry}" must be a bare origin like https://dev.example.com `
+                + `(got path/query "${u.pathname}${u.search}")`);
+        }
+        // WHATWG URL accepts "*" in a hostname, so new URL("https://*.example.com")
+        // parses and its origin round-trips — the entry would be stored, matched
+        // against nothing, and read as "I allowed this host". Rejecting it here is
+        // the difference between a misconfiguration that says so and one that looks
+        // like the feature is broken.
+        if (!/^[a-z0-9.-]+$/i.test(u.hostname) || u.hostname.startsWith("-") || u.hostname.includes("..")) {
+            throw new Error(`AIFINPAY_GATEWAY_ORIGINS: "${entry}" is not a plain hostname. `
+                + `Wildcards are not supported — name each origin you settle against.`);
+        }
+        if (u.protocol !== "https:" && u.hostname !== "localhost" && u.hostname !== "127.0.0.1") {
+            throw new Error(`AIFINPAY_GATEWAY_ORIGINS: "${entry}" is not https — refusing to settle over plaintext`);
+        }
+    }
+    return list;
+}
 //# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAmBA,MAAM,UAAU,iBAAiB;IAC/B,OAAO;QACL,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,SAAS;QAC9D,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,SAAS;QACnD,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;YACxC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;YACzC,CAAC,CAAC,SAAS;QACb,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACxC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;YACtC,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AA6CA,MAAM,UAAU,iBAAiB;IAC/B,OAAO;QACL,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,SAAS;QAC9D,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,SAAS;QACnD,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;YACxC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;YACzC,CAAC,CAAC,SAAS;QACb,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACxC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;YACtC,CAAC,CAAC,SAAS;QACb,cAAc,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QAClE,YAAY,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED;;;oDAGoD;AACpD,SAAS,SAAS,CAAC,GAAuB;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC;AAED;;mFAEmF;AACnF,SAAS,YAAY,CAAC,GAAuB;IAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,CAAM,CAAC;QACX,IAAI,CAAC;YAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAC3B,MAAM,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,8BAA8B,KAAK,gBAAgB,CAAC,CAAC;QAAC,CAAC;QAC/E,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CACb,8BAA8B,KAAK,uDAAuD;kBACxF,oBAAoB,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,MAAM,IAAI,CAChD,CAAC;QACJ,CAAC;QACD,4EAA4E;QAC5E,yEAAyE;QACzE,2EAA2E;QAC3E,4EAA4E;QAC5E,8BAA8B;QAC9B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAClG,MAAM,IAAI,KAAK,CACb,8BAA8B,KAAK,6BAA6B;kBAC9D,oEAAoE,CACvE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YACxF,MAAM,IAAI,KAAK,CAAC,8BAA8B,KAAK,oDAAoD,CAAC,CAAC;QAC3G,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/safe-fetch.d.ts

@@ -12,6 +12,7 @@ export declare class BlockedRequestError extends Error {
  */
 export declare function assertRequestAllowed(rawUrl: string, opts?: {
     allowPrivate?: boolean;
+    trustedHosts?: string[];
 }): Promise<URL>;
 /**
  * A `fetch` that validates the target, and every redirect target, before going.
@@ -21,5 +22,6 @@ export declare function assertRequestAllowed(rawUrl: string, opts?: {
  */
 export declare function makeSafeFetch(opts?: {
     allowPrivate?: boolean;
+    trustedHosts?: string[];
 }): typeof fetch;
 //# sourceMappingURL=safe-fetch.d.ts.map

package/dist/safe-fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"safe-fetch.d.ts","sourceRoot":"","sources":["../src/safe-fetch.ts"],"names":[],"mappings":"AA4DA,oDAAoD;AACpD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAmBtD;AAED,qBAAa,mBAAoB,SAAQ,KAAK;CAAG;AAEjD;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAO,GACpC,OAAO,CAAC,GAAG,CAAC,CAkDd;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,KAAK,CA4BjF"}
+{"version":3,"file":"safe-fetch.d.ts","sourceRoot":"","sources":["../src/safe-fetch.ts"],"names":[],"mappings":"AA4DA,oDAAoD;AACpD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAmBtD;AAED,qBAAa,mBAAoB,SAAQ,KAAK;CAAG;AAEjD;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GAC7D,OAAO,CAAC,GAAG,CAAC,CAyEd;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GAAG,OAAO,KAAK,CA4B1G"}

package/dist/safe-fetch.js

@@ -116,12 +116,32 @@ export async function assertRequestAllowed(rawUrl, opts = {}) {
         }
         return url;
     }
+    // An operator naming this exact host has vouched for it, so the resolution
+    // step is skipped for it and only for it.
+    //
+    // Why this exists: behind an HTTP proxy the client does not resolve at all —
+    // the proxy does — so lookup() fails with getaddrinfo EAI_AGAIN and every
+    // host is refused as "cannot resolve". That is the guard misfiring on the
+    // environment rather than on a threat, and it made the MCP server unusable in
+    // proxied setups (external E2E, 2026-08-27).
+    //
+    // Deliberately per-host and not a proxy-detection switch. "We seem to be
+    // behind a proxy, disable the SSRF check" turns one environment quirk into a
+    // blanket bypass, which is the shape of the vulnerability this file exists to
+    // prevent. Exact hostnames only — no suffix matching, because "example.com"
+    // trusting "evil-example.com" is the classic way an allowlist stops meaning
+    // anything.
+    if (opts.trustedHosts?.some((h) => h.toLowerCase() === host.toLowerCase())) {
+        return url;
+    }
     let addresses;
     try {
         addresses = await lookup(host, { all: true });
     }
     catch (e) {
-        throw new BlockedRequestError(`cannot resolve ${host}: ${e.message}`);
+        throw new BlockedRequestError(`cannot resolve ${host}: ${e.message}. `
+            + `If this host is reachable only through a proxy, name it in `
+            + `AIFINPAY_TRUSTED_HOSTS to skip the DNS pre-check for it alone.`);
     }
     if (!addresses.length) {
         throw new BlockedRequestError(`${host} resolved to nothing`);

package/dist/safe-fetch.js.map

@@ -1 +1 @@
-{"version":3,"file":"safe-fetch.js","sourceRoot":"","sources":["../src/safe-fetch.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,wEAAwE;AACxE,8EAA8E;AAC9E,+EAA+E;AAC/E,uEAAuE;AACvE,EAAE;AACF,gFAAgF;AAChF,mEAAmE;AACnE,sEAAsE;AACtE,6EAA6E;AAC7E,4EAA4E;AAC5E,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,uDAAuD;AAEvD,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,qDAAqD;AACrD,MAAM,aAAa,GAAG,CAAC,CAAC;AAExB;;;;;;;;GAQG;AACH,MAAM,UAAU,GAAuB;IACrC,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,YAAY;IACtC,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,aAAa;IACvC,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,4BAA4B;IACtD,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,uBAAuB;IACjD,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,uCAAuC;IACjE,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,gBAAgB;IAC1C,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,eAAe;IACzC,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,iBAAiB;IAC3C,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,6BAA6B;IACvD,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,wBAAwB;IAClD,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,mCAAmC;CAC9D,CAAC;AAEF,SAAS,OAAO,CAAC,EAAU;IACzB,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;QAC1D,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC,4CAA4C;QACzE,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACzD,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC5D,IAAI,MAAM;YAAE,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACnD,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;QAC3E,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,uBAAuB;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,wBAAwB;AACvC,CAAC;AAED,MAAM,OAAO,mBAAoB,SAAQ,KAAK;CAAG;AAEjD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAc,EACd,OAAmC,EAAE;IAErC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,IAAI,CAAC,YAAY;QAAE,OAAO,GAAG,CAAC,CAAC,wCAAwC;IAE3E,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,mBAAmB,CAC3B,YAAY,GAAG,CAAC,QAAQ,qDAAqD,CAC9E,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC7B,2EAA2E;QAC3E,6CAA6C;QAC7C,MAAM,IAAI,mBAAmB,CAC3B,mBAAmB,GAAG,CAAC,IAAI,mCAAmC,CAC/D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACf,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,mBAAmB,CAAC,YAAY,IAAI,wBAAwB,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,SAAgC,CAAC;IACrC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,IAAI,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,mBAAmB,CAAC,GAAG,IAAI,sBAAsB,CAAC,CAAC;IAC/D,CAAC;IACD,2EAA2E;IAC3E,mDAAmD;IACnD,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,SAAS,EAAE,CAAC;QACpC,IAAI,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,mBAAmB,CAC3B,YAAY,IAAI,oBAAoB,OAAO,iCAAiC,CAC7E,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,OAAmC,EAAE;IACjE,MAAM,SAAS,GAAG,KAAK,EACrB,KAAkC,EAClC,IAAkC,EACf,EAAE;QACrB,IAAI,MAAM,GACR,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK;YACjC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;gBACzC,CAAC,CAAE,KAAiB,CAAC,GAAG,CAAC;QAC3B,IAAI,OAAO,GAAG,IAAI,CAAC;QAEnB,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC;YAC9C,MAAM,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;YAE/E,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5F,IAAI,CAAC,QAAQ;gBAAE,OAAO,GAAG,CAAC;YAE1B,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC9C,sEAAsE;YACtE,mEAAmE;YACnE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACnE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC3D,CAAC;QACH,CAAC;QACD,MAAM,IAAI,mBAAmB,CAAC,iCAAiC,aAAa,GAAG,CAAC,CAAC;IACnF,CAAC,CAAC;IACF,OAAO,SAAyB,CAAC;AACnC,CAAC"}
+{"version":3,"file":"safe-fetch.js","sourceRoot":"","sources":["../src/safe-fetch.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,wEAAwE;AACxE,8EAA8E;AAC9E,+EAA+E;AAC/E,uEAAuE;AACvE,EAAE;AACF,gFAAgF;AAChF,mEAAmE;AACnE,sEAAsE;AACtE,6EAA6E;AAC7E,4EAA4E;AAC5E,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,uDAAuD;AAEvD,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,qDAAqD;AACrD,MAAM,aAAa,GAAG,CAAC,CAAC;AAExB;;;;;;;;GAQG;AACH,MAAM,UAAU,GAAuB;IACrC,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,YAAY;IACtC,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,aAAa;IACvC,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,4BAA4B;IACtD,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,uBAAuB;IACjD,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,uCAAuC;IACjE,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,gBAAgB;IAC1C,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,eAAe;IACzC,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,iBAAiB;IAC3C,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,6BAA6B;IACvD,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,wBAAwB;IAClD,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,mCAAmC;CAC9D,CAAC;AAEF,SAAS,OAAO,CAAC,EAAU;IACzB,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;QAC1D,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC,4CAA4C;QACzE,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACzD,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC5D,IAAI,MAAM;YAAE,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACnD,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;QAC3E,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,uBAAuB;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,wBAAwB;AACvC,CAAC;AAED,MAAM,OAAO,mBAAoB,SAAQ,KAAK;CAAG;AAEjD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAc,EACd,OAA4D,EAAE;IAE9D,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,IAAI,CAAC,YAAY;QAAE,OAAO,GAAG,CAAC,CAAC,wCAAwC;IAE3E,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,mBAAmB,CAC3B,YAAY,GAAG,CAAC,QAAQ,qDAAqD,CAC9E,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC7B,2EAA2E;QAC3E,6CAA6C;QAC7C,MAAM,IAAI,mBAAmB,CAC3B,mBAAmB,GAAG,CAAC,IAAI,mCAAmC,CAC/D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACf,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,mBAAmB,CAAC,YAAY,IAAI,wBAAwB,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,2EAA2E;IAC3E,0CAA0C;IAC1C,EAAE;IACF,6EAA6E;IAC7E,0EAA0E;IAC1E,0EAA0E;IAC1E,8EAA8E;IAC9E,6CAA6C;IAC7C,EAAE;IACF,yEAAyE;IACzE,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,YAAY;IACZ,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC3E,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,SAAgC,CAAC;IACrC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,mBAAmB,CAC3B,kBAAkB,IAAI,KAAM,CAAW,CAAC,OAAO,IAAI;cACjD,6DAA6D;cAC7D,gEAAgE,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,mBAAmB,CAAC,GAAG,IAAI,sBAAsB,CAAC,CAAC;IAC/D,CAAC;IACD,2EAA2E;IAC3E,mDAAmD;IACnD,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,SAAS,EAAE,CAAC;QACpC,IAAI,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,mBAAmB,CAC3B,YAAY,IAAI,oBAAoB,OAAO,iCAAiC,CAC7E,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,OAA4D,EAAE;IAC1F,MAAM,SAAS,GAAG,KAAK,EACrB,KAAkC,EAClC,IAAkC,EACf,EAAE;QACrB,IAAI,MAAM,GACR,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK;YACjC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;gBACzC,CAAC,CAAE,KAAiB,CAAC,GAAG,CAAC;QAC3B,IAAI,OAAO,GAAG,IAAI,CAAC;QAEnB,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC;YAC9C,MAAM,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;YAE/E,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5F,IAAI,CAAC,QAAQ;gBAAE,OAAO,GAAG,CAAC;YAE1B,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC9C,sEAAsE;YACtE,mEAAmE;YACnE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACnE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC3D,CAAC;QACH,CAAC;QACD,MAAM,IAAI,mBAAmB,CAAC,iCAAiC,aAAa,GAAG,CAAC,CAAC;IACnF,CAAC,CAAC;IACF,OAAO,SAAyB,CAAC;AACnC,CAAC"}

package/dist/server.d.ts

@@ -2,15 +2,18 @@ import { AiFinPayAgent } from "@aifinpay/agent";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import type { McpConfig } from "./config.js";
 /**
- * Build an MCP server that wraps the AiFinPay agent SDK as MCP tools.
+ * Production-RC MCP surface.
  *
- * Returned server is unstarted — caller wires up a transport (stdio, SSE,
- * etc.) via the official `@modelcontextprotocol/sdk` package.
+ * IMPORTANT: the old agent_call, payable_fetch, pay_with_split, quote_split,
+ * agent_claim_self and agent_quote tools are deliberately NOT registered.
+ * They depend on @aifinpay/agent 1.x legacy splitter/x402 semantics and must not
+ * be available to a model after the 0% AIFP-2 / gross-inclusive AIFP-1 change.
  *
- * As of 0.1.0-alpha.3 the wrapped identity is `AiFinPayAgent` — dual-chain
- * (Solana base58 pubkey AND Polygon EVM address from one secret). Tools
- * that previously called legacy `Agent` methods now reach them via
- * `agent.inner.*`.
+ * This server remains useful before the SDK 2.0 package is published: it can
+ * expose the wallet address, resolve Agent Passport identity, read verified
+ * v1.3 routes, and construct a non-signing settlement invoice. Signing/moving
+ * value returns only after MCP depends on the published v2 executor and its E2E
+ * release gate has passed.
  */
 export declare function createServer(config?: McpConfig): Promise<{
     server: Server<{

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAS,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAKnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AA4B7C;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAAC,MAAM,GAAE,SAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiHxD;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,SAAS,CAAC;IAClB,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9D"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAKnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAwB7C;;;;;;;;;;;;;GAaG;AACH,wBAAsB,YAAY,CAAC,MAAM,GAAE,SAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiFxD;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,SAAS,CAAC;IAClB,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9D"}

package/dist/server.js

@@ -1,41 +1,36 @@
 import { AiFinPayAgent } from "@aifinpay/agent";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
-import { payableFetchTool, runPayableFetch } from "./tools/payable-fetch.js";
 import { agentAddressTool, runAgentAddress } from "./tools/agent-address.js";
-import { agentQuoteTool, runAgentQuote } from "./tools/agent-quote.js";
-import { agentCallTool, runAgentCall } from "./tools/agent-call.js";
-import { agentClaimSelfTool, runAgentClaimSelf } from "./tools/agent-claim-self.js";
+import { agentQuotaTool, runAgentQuota } from "./tools/agent-quota.js";
 import { makeSafeFetch } from "./safe-fetch.js";
-import { payWithSplitTool, runPayWithSplit, quoteSplitTool, runQuoteSplit, } from "./tools/pay-with-split.js";
-// Every request the agent makes goes through this, including redirects.
-//
-// payable_fetch hands a caller-supplied URL to the agent, which requests it
-// and, on a 402, pays and requests it again. Nothing checked the URL, so a
-// caller — or a prompt injection reaching the tool — could name
-// http://127.0.0.1:4001 or http://169.254.169.254/latest/meta-data/ and read
-// the answer. It is the tool exposed over HTTP today.
-//
-// Set AIFINPAY_ALLOW_PRIVATE_FETCH=1 to lift it, which is what a local bridge
-// on localhost needs and what a public deployment must never have.
+import { loadConfigFromEnv } from "./config.js";
+import { agentPassportResolveTool, runAgentPassportResolve, settlementRoutesTool, runSettlementRoutes, settlementInvoiceTool, runSettlementInvoice, } from "./tools/production-control.js";
+// Every backend/public request made by this server goes through safeFetch.
+// Public deployments never lift private-network protection; local development
+// may explicitly use AIFINPAY_ALLOW_PRIVATE_FETCH=1.
 const safeFetch = makeSafeFetch({
     allowPrivate: process.env.AIFINPAY_ALLOW_PRIVATE_FETCH === "1",
+    // Exact hosts an operator vouches for. Skips only the DNS pre-check, and only
+    // for those names — see safe-fetch.ts for why this is not a proxy switch.
+    trustedHosts: loadConfigFromEnv().trustedHosts,
 });
 /**
- * Build an MCP server that wraps the AiFinPay agent SDK as MCP tools.
+ * Production-RC MCP surface.
  *
- * Returned server is unstarted — caller wires up a transport (stdio, SSE,
- * etc.) via the official `@modelcontextprotocol/sdk` package.
+ * IMPORTANT: the old agent_call, payable_fetch, pay_with_split, quote_split,
+ * agent_claim_self and agent_quote tools are deliberately NOT registered.
+ * They depend on @aifinpay/agent 1.x legacy splitter/x402 semantics and must not
+ * be available to a model after the 0% AIFP-2 / gross-inclusive AIFP-1 change.
  *
- * As of 0.1.0-alpha.3 the wrapped identity is `AiFinPayAgent` — dual-chain
- * (Solana base58 pubkey AND Polygon EVM address from one secret). Tools
- * that previously called legacy `Agent` methods now reach them via
- * `agent.inner.*`.
+ * This server remains useful before the SDK 2.0 package is published: it can
+ * expose the wallet address, resolve Agent Passport identity, read verified
+ * v1.3 routes, and construct a non-signing settlement invoice. Signing/moving
+ * value returns only after MCP depends on the published v2 executor and its E2E
+ * release gate has passed.
  */
 export async function createServer(config = {}) {
     const log = config.logFn ?? defaultLog;
-    // Agent identity: load from env secret if provided, else generate one
-    // and print to stderr so the human knows what to fund.
     const agent = config.agentSecretB58
         ? await AiFinPayAgent.fromSolanaSecret(config.agentSecretB58, {
             fetchImpl: safeFetch,
@@ -48,19 +43,6 @@ export async function createServer(config = {}) {
                 baseUrl: config.baseUrl,
                 timeoutMs: config.timeoutMs,
             });
-            // NEVER log private key material. stderr is captured by Docker,
-            // journald, CI logs, support bundles and monitoring, so printing the
-            // secret here leaked it into all of them.
-            //
-            // The warning below stays, but not for the reason it once gave. That
-            // reason — that new() produced an EVM key independent of the Solana
-            // one, so no backup could restore both — was fixed: everything now
-            // derives from a single random seed. What makes this identity
-            // ephemeral is narrower and still true: the seed is never printed and
-            // never written anywhere, deliberately, because stderr ends up in
-            // Docker, journald, CI logs and support bundles. Recoverable in
-            // principle, unrecoverable in practice, so still not an address to
-            // fund.
             log("warn", `[aifinpay-mcp] no AIFINPAY_AGENT_SECRET set — generated an EPHEMERAL, NON-RECOVERABLE agent.\n` +
                 `  solana_address: ${a.solanaAddress}\n` +
                 `  evm_address:    ${a.evmAddress}\n` +
@@ -69,71 +51,51 @@ export async function createServer(config = {}) {
                 `     (AiFinPayAgent.fromSeed / \`aifinpay init\`) and set AIFINPAY_AGENT_SECRET.`);
             return a;
         })();
-    // AIFINPAY_MAX_USD is the documented "hard cap on a single payment".
-    // payable_fetch enforces it via PayOptions, but agent_call settles through
-    // AiFinPayAgent.call() which only honours the agent's budget caps — wire
-    // the cap there too, otherwise the primary tool has NO runaway protection.
+    // Keep the legacy agent budget configured even though this RC exposes no
+    // signing tool. It remains an additional defence for downstream/private code
+    // and for the subsequent v2 MCP executor integration.
     if (config.maxAmountUsd !== undefined && Number.isFinite(config.maxAmountUsd)) {
         agent.setBudget({ per_call_usd: config.maxAmountUsd });
         log("info", `[aifinpay-mcp] per-call cap: $${config.maxAmountUsd} (AIFINPAY_MAX_USD)`);
     }
-    else {
-        log("warn", "[aifinpay-mcp] AIFINPAY_MAX_USD not set — agent_call/payable_fetch have NO per-payment cap. Strongly recommended.");
-    }
-    log("info", `[aifinpay-mcp] solana: ${agent.solanaAddress} · evm: ${agent.evmAddress}`);
+    log("info", `[aifinpay-mcp] production RC safe surface · solana: ${agent.solanaAddress} · evm: ${agent.evmAddress}`);
     const server = new Server({
         name: "@aifinpay/mcp",
-        version: "1.0.0",
-    }, {
-        capabilities: {
-            tools: {},
-        },
-    });
-    server.setRequestHandler(ListToolsRequestSchema, async () => {
-        return {
-            tools: [
-                agentAddressTool(),
-                agentCallTool(),
-                agentClaimSelfTool(),
-                payableFetchTool(),
-                agentQuoteTool(),
-                payWithSplitTool(),
-                quoteSplitTool(),
-            ],
-        };
-    });
+        version: "2.0.0-rc.1",
+    }, { capabilities: { tools: {} } });
+    server.setRequestHandler(ListToolsRequestSchema, async () => ({
+        tools: [
+            agentAddressTool(),
+            agentQuotaTool(),
+            agentPassportResolveTool(),
+            settlementRoutesTool(),
+            settlementInvoiceTool(),
+        ],
+    }));
     server.setRequestHandler(CallToolRequestSchema, async (request) => {
         const { name, arguments: args } = request.params;
         const ctx = { agent, config, log };
         switch (name) {
             case "agent_address":
                 return runAgentAddress(ctx, args ?? {});
-            case "agent_call":
-                return runAgentCall(ctx, args ?? {});
-            case "agent_claim_self":
-                return runAgentClaimSelf(ctx, args ?? {});
-            case "payable_fetch":
-                return runPayableFetch(ctx, args ?? {});
-            case "agent_quote":
-                return runAgentQuote(ctx, args ?? {});
-            case "pay_with_split":
-                return runPayWithSplit(ctx, args ?? {});
-            case "quote_split":
-                return runQuoteSplit(ctx, args ?? {});
+            case "agent_quota":
+                return runAgentQuota(ctx, args ?? {});
+            case "agent_passport_resolve":
+                return runAgentPassportResolve(ctx, args ?? {});
+            case "settlement_routes":
+                return runSettlementRoutes(ctx, args ?? {});
+            case "settlement_invoice":
+                return runSettlementInvoice(ctx, args ?? {});
             default:
                 return {
                     isError: true,
-                    content: [
-                        { type: "text", text: `unknown tool: ${name}` },
-                    ],
+                    content: [{ type: "text", text: `unknown or retired tool: ${name}` }],
                 };
         }
     });
     return { server, agent };
 }
 function defaultLog(level, msg) {
-    // MCP stdio servers MUST NOT write to stdout — the transport owns it.
-    // stderr is safe.
     process.stderr.write(`[${level}] ${msg}\n`);
 }
 //# sourceMappingURL=server.js.map