@blanketbyte/wise-mcp 1.0.4 → 1.0.6

package/dist/auth/pages.js

@@ -183,7 +183,7 @@ function layout(title, body) {
   footer .ic { width:14px; height:14px; }
   footer a { color:var(--muted); }
   footer a.gh { display:inline-flex; align-items:center; gap:4px; }
-  footer a.ver { color:var(--faint); text-decoration:none; font-variant-numeric:tabular-nums; }
+  footer a.ver { flex-basis:100%; text-align:center; margin-top:-2px; color:var(--faint); font-size:12px; text-decoration:none; font-variant-numeric:tabular-nums; }
   footer a.ver:hover { text-decoration:underline; }
   .dot { opacity:.5; }
 </style>
@@ -204,7 +204,7 @@ function card(inner, opts) {
     </div>
     ${inner}
   </div>
-  <footer>${icon("lock")}<span>Token encrypted at rest</span><span class="dot">·</span><a href="/sessions">Manage sessions</a><span class="dot">·</span><a class="gh" href="${REPO_URL}" target="_blank" rel="noopener">${icon("github")}Source</a><span class="dot">·</span><a class="ver" href="${REPO_URL}/releases/tag/v${VERSION}" target="_blank" rel="noopener" title="Release notes">v${VERSION}</a></footer>
+  <footer>${icon("lock")}<span>Token encrypted at rest</span><span class="dot">·</span><a href="/sessions">Manage sessions</a><span class="dot">·</span><a class="gh" href="${REPO_URL}" target="_blank" rel="noopener">${icon("github")}Source</a><a class="ver" href="${REPO_URL}/releases/tag/v${VERSION}" target="_blank" rel="noopener" title="Release notes">v${VERSION}</a></footer>
 </main>`;
 }
 /** Red banner shown on every page served over plain HTTP (except localhost). */

package/dist/tools.js

@@ -274,7 +274,15 @@ function registerWriteTools(server, wise, { sessionKey, connectionId }, safe) {
             (sourceCurrency !== recipient.currency ? `, rate ${quote.rate}` : "") +
             (details.reference ? `, reference "${details.reference}"` : "") +
             (quote.delivery ? `, ${stripHtml(quote.delivery)}` : "");
-        const { code, expiresAt } = storePending(sessionKey, { kind: "transfer", profileId: profile.id, quoteId: quote.id, targetAccount: recipient.id, customerTransactionId: randomUUID(), details }, summary);
+        const { code, expiresAt } = storePending(sessionKey, {
+            kind: "transfer",
+            profileId: profile.id,
+            quoteId: quote.id,
+            targetAccount: recipient.id,
+            customerTransactionId: randomUUID(),
+            details,
+            expected: { amount: quote.source.amount, currency: sourceCurrency },
+        }, summary);
         await log("transfer_prepared", { code, summary });
         return ok({
             status: "awaiting_user_confirmation",
@@ -319,6 +327,27 @@ function registerWriteTools(server, wise, { sessionKey, connectionId }, safe) {
         try {
             if (a.kind === "transfer") {
                 const t = await wise.createTransfer({ targetAccount: a.targetAccount, quoteId: a.quoteId, customerTransactionId: a.customerTransactionId, details: a.details });
+                // Wise has been seen creating a transfer for a different amount than its own quote. Never leave the
+                // user with a transfer they didn't approve: it's still unpaid, so cancel it and say what happened.
+                const got = { amount: Number(t.source.amount), currency: String(t.source.currency ?? "").toUpperCase() };
+                if (Math.abs(got.amount - a.expected.amount) > 0.005 || got.currency !== a.expected.currency.toUpperCase()) {
+                    const cancelled = await wise.cancelTransfer(t.id).then((c) => c.status, (err) => `cancel failed: ${err instanceof Error ? err.message : err}`);
+                    await log("transfer_amount_mismatch", {
+                        code: confirmation_code,
+                        summary: p.summary,
+                        transfer_id: t.id,
+                        quote_id: a.quoteId,
+                        expected: a.expected,
+                        got,
+                        cancelled,
+                    });
+                    return fail(`Wise created transfer ${t.id} for ${money(got.amount, got.currency)} instead of the approved ` +
+                        `${money(a.expected.amount, a.expected.currency)} (quote ${a.quoteId}). ` +
+                        (cancelled === "cancelled"
+                            ? "It was cancelled automatically, so nothing will be paid. "
+                            : `Automatic cancellation didn't succeed (${cancelled}): tell the user to cancel it in the Wise app and NOT pay it. `) +
+                        "Don't retry; tell the user this is a Wise-side mismatch.");
+                }
                 await log("transfer_created", { code: confirmation_code, summary: p.summary, transfer_id: t.id, status: t.status });
                 return ok({
                     status: "created_awaiting_payment",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blanketbyte/wise-mcp",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "description": "MCP server for Wise: read balances, card payments, transfers and recipients, and prepare transfers you approve twice. Runs locally (npx, for Claude, Codex, Cursor…) or as a remote connector for Claude and ChatGPT.",
   "mcpName": "io.github.BlanketByte/wise-mcp",
   "keywords": [