@kaditang/402sentinel-mcp 0.3.0 → 0.4.0

package/dist/index.js

@@ -113,7 +113,7 @@ const TOOLS = [
     },
     {
         name: "firewall",
-        description: "Buyer-side payment firewall: should YOUR agent make THIS payment now? Where assess_counterparty vets the seller, this vets the payment instruction in the context of your agent's own history + provenance. Returns allow/hold/block + signals: routing_anomaly (payTo swapped vs the address you usually pay for this resource = fraudulent routing), velocity_anomaly (drain), amount_anomaly (overcharge), provenance_flag (injection/untrusted source), counterparty_risk. Pass your payer wallet as agent_id. Costs $0.002. Seed history free with firewall_record.",
+        description: "Buyer-side payment firewall: should YOUR agent make THIS payment now? Where assess_counterparty vets the seller, this vets the payment instruction in the context of your agent's own history + provenance. Returns allow/hold/block + signals: routing_anomaly (payTo swapped vs the address you usually pay = fraudulent routing), velocity_anomaly (drain), amount_anomaly (overcharge), provenance_flag, counterparty_risk, injection_destination (if the payTo appears in the untrusted page/tool-output you're acting on, the destination was injected — pass it as context.untrusted_text), intent_mismatch (pass context.intended={payto,max_amount} so a mid-flight redirect is caught), new_counterparty_burst, recurring_flagged (poisoned-memory loop). STRONGLY recommended: pass untrusted_text + intended to catch prompt-injection payments. Pass your payer wallet as agent_id. Costs $0.002. Seed history free with firewall_record.",
         inputSchema: {
             type: "object",
             required: ["agent_id", "payment"],
@@ -135,6 +135,8 @@ const TOOLS = [
                         source: { type: "string", enum: ["tool_output", "web_content", "user", "unknown"], description: "where the payTo/instruction came from" },
                         metadata: { type: "object", description: "x402 description/reason strings (scanned for injection)" },
                         expected_payto: { type: "string", description: "known-good address for this resource (optional)" },
+                        untrusted_text: { type: "string", description: "the page/tool-output content you're acting on — if the payTo appears in it, the destination was injected (hard block)" },
+                        intended: { type: "object", description: "what you meant to do: { payto, max_amount } — any deviation = mid-flight redirect (hard block)", properties: { payto: { type: "string" }, max_amount: { type: "number" } } },
                     },
                 },
                 policy: {
@@ -183,7 +185,7 @@ function clientOrNull() {
     return new GatewayClient({ chain: "base", privateKey: pk });
 }
 async function main() {
-    const server = new Server({ name: "402sentinel", version: "0.3.0" }, { capabilities: { tools: {} } });
+    const server = new Server({ name: "402sentinel", version: "0.4.0" }, { capabilities: { tools: {} } });
     server.setRequestHandler(ListToolsRequestSchema, async () => ({
         tools: TOOLS.map(({ name, description, inputSchema }) => ({ name, description, inputSchema })),
     }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kaditang/402sentinel-mcp",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "MCP tools for x402 payment safety — vet the counterparty (risk score, allow/review/block, spending policy) AND vet the payment itself (buyer-side firewall: routing/drain/injection). Thin client for 402sentinel.com.",
   "type": "module",
   "bin": { "402sentinel-mcp": "./dist/index.js" },