@priors/mcp 0.1.2 → 0.1.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@priors/mcp",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "private": false,
   "description": "MCP server for Priors on Robinhood Chain: pay x402 URLs in USDG, read balances, credit lines and scores, borrow and repay. Key from PRIORS_KEY only.",
   "type": "module",

package/src/server.mjs

@@ -284,15 +284,16 @@ export async function createPriorsMcpServer({ env = process.env, fetchImpl = glo
   }, async ({ loan_id, all }) => {
     needWallet("repay");
     if ((loan_id === undefined) === (all !== true)) throw new ToolError("Give exactly one of loan_id or all: true.");
+    // Only the loans of an agent this wallet controls: the pool lets anyone repay any loan, and this wallet's USDG is
+    // not for others. PRIORS_AGENT_ID alone is not proof: a stale or mistyped id would point at someone else's agent.
+    const id = await resolveAgent();
+    await needController(id);
     if (loan_id !== undefined) {
-      // Only the agent's own loans: the pool lets anyone repay any loan, and this wallet's USDG is not for others.
-      const id = await resolveAgent();
       const owner = BigInt(await credit.loanAgent(BigInt(loan_id)));
       if (owner !== id) throw new ToolError(`loan #${loan_id} belongs to agent #${owner}, not to agent #${id}. This tool only repays the configured agent's own loans.`);
       const r = await credit.repay(BigInt(loan_id));
       return `Repaid loan #${r.loanId} of agent #${r.agentId}: ${usd(r.paid)} (principal + fee). Tx ${r.hash}.`;
     }
-    const id = await resolveAgent();
     const s = await credit.status(id);
     if (s.openLoans.length === 0) return `Agent #${id} has no open loan. Nothing was repaid.`;
     const done = [], left = [];