@priors/mcp 0.1.4 → 0.1.5

package/README.md

@@ -62,7 +62,7 @@ Settings → Developer → Edit Config (`claude_desktop_config.json`), then rest
   "mcpServers": {
     "priors": {
       "command": "npx",
-      "args": ["-y", "@priors/mcp@0.1.4"],
+      "args": ["-y", "@priors/mcp@0.1.5"],
       "env": {
         "PRIORS_KEY": "0xYOUR_AGENT_WALLET_KEY",
         "PRIORS_AGENT_ID": "1234"
@@ -84,7 +84,7 @@ A project `.mcp.json` that reads the key from your shell's environment, so the f
   "mcpServers": {
     "priors": {
       "command": "npx",
-      "args": ["-y", "@priors/mcp@0.1.4"],
+      "args": ["-y", "@priors/mcp@0.1.5"],
       "env": {
         "PRIORS_KEY": "${PRIORS_KEY}",
         "PRIORS_AGENT_ID": "${PRIORS_AGENT_ID:-}"
@@ -94,7 +94,7 @@ A project `.mcp.json` that reads the key from your shell's environment, so the f
 }
 ```
 
-or, for your user only: `claude mcp add priors --scope user -e PRIORS_KEY="$PRIORS_KEY" -- npx -y @priors/mcp@0.1.4`
+or, for your user only: `claude mcp add priors --scope user -e PRIORS_KEY="$PRIORS_KEY" -- npx -y @priors/mcp@0.1.5`
 (the key is expanded by your shell from the environment; do not paste it on the command line).
 
 ## Try it

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@priors/mcp",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "private": false,
   "description": "MCP server for Priors on Robinhood Chain: pay x402 URLs in USDG, read balances, credit lines and scores, borrow and repay. Key from PRIORS_KEY only.",
   "type": "module",
@@ -44,6 +44,7 @@
     "@modelcontextprotocol/sdk": "^1.30.1",
     "@priors/x402": "0.1.3",
     "ethers": "^6.13.4",
+    "undici": "6.29.0",
     "zod": "^4.6.5"
   }
 }

package/src/server.mjs

@@ -19,6 +19,8 @@ import { readFileSync } from "node:fs";
 import { randomBytes } from "node:crypto";
 import { lookup as dnsLookup } from "node:dns/promises";
 import { isIP } from "node:net";
+import { lookup as dnsLookupCb } from "node:dns";
+import { fetch as undiciFetch, Agent } from "undici";
 import { ethers } from "ethers";
 import { z } from "zod";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -79,6 +81,27 @@ export function isPrivateAddress(ip) {
   return (x[0] & 0xfe) === 0xfc || (x[0] === 0xfe && (x[1] & 0xc0) === 0x80) || x[0] === 0xff; // fc00::/7, fe80::/10, ff00::/8
 }
 
+/**
+ * fetch whose every connection re-checks the address it resolved: a hostname that answered a public address to the
+ * pre-check and a private one at connect time (DNS rebinding) is refused there. IP literals skip DNS; the pre-check
+ * (checkTarget) refuses the private ones. `resolve` is dns.lookup-shaped (tests swap it).
+ */
+export function guardedFetch(resolve = dnsLookupCb) {
+  const lookup = (hostname, options, cb) => resolve(hostname, { ...(options || {}), all: true }, (err, addrs) => {
+    if (err) return cb(err);
+    const list = Array.isArray(addrs) ? addrs : [{ address: addrs, family: isIP(addrs) }];
+    const bad = list.find((a) => isPrivateAddress(a.address));
+    if (bad || list.length === 0) return cb(Object.assign(new Error(`refused: ${hostname} resolves to a private or local address (${bad?.address ?? "none"})`), { code: "EPRIVATE" }));
+    return options?.all ? cb(null, list) : cb(null, list[0].address, list[0].family);
+  });
+  const dispatcher = new Agent({ connect: { lookup } });
+  return async (input, init) => {
+    const r = input instanceof Request ? input : new Request(input, init);
+    const body = r.body ? await r.arrayBuffer() : undefined;
+    return undiciFetch(r.url, { method: r.method, headers: [...r.headers], body, redirect: r.redirect, signal: r.signal, dispatcher });
+  };
+}
+
 const usd = (units) => `${X.formatUsdg(units)} USDG`;
 const when = (t) => new Date(Number(t) * 1000).toISOString().replace(".000Z", "Z");
 const short = (s, n) => (s.length > n ? `${s.slice(0, n)}… (${s.length - n} more characters cut)` : s);
@@ -125,6 +148,12 @@ export async function createPriorsMcpServer({ env = process.env, fetchImpl = glo
   // Payments signed and not (yet) counted as paid, by "METHOD url": until validBefore the merchant can still cash
   // them, so another pay_url for the same purchase resends that payment instead of signing a second one.
   const outstanding = new Map();
+  // One money call at a time (pay_url, borrow, repay): MCP clients may send tool calls concurrently, and each check
+  // above (an outstanding payment for this URL, the session totals) must see the previous call's result (Codex review).
+  let moneyQueue = Promise.resolve();
+  const serial = (fn) => (args) => { const run = moneyQueue.then(() => fn(args)); moneyQueue = run.catch(() => {}); return run; };
+  // The real network goes through the rebinding-proof dispatcher; an injected fetchImpl (tests, embedders) is used as given.
+  const payFetch = fetchImpl === globalThis.fetch && !allowLocal ? guardedFetch() : fetchImpl;
 
   /** https only (http://localhost only with PRIORS_ALLOW_LOCAL=1), and never a host that resolves to a private address. */
   async function checkTarget(url) {
@@ -136,9 +165,8 @@ export async function createPriorsMcpServer({ env = process.env, fetchImpl = glo
     }
     if (u.protocol !== "https:") throw new ToolError("pay_url only pays https URLs.");
     if (allowLocal) return u;
-    // SHORTCUT: checked once before the request; a DNS answer that changes between this lookup and the fetch
-    // (rebinding) is not caught. Ceiling: a hostile DNS server. Upgrade trigger: a report of it, or Node's fetch
-    // gaining a per-request lookup hook to pin the address checked here.
+    // A clear refusal before anything is sent; the connection itself re-checks the address it resolves (guardedFetch),
+    // so a DNS answer that turns private in between (rebinding) is refused there too.
     let addrs;
     if (isIP(host)) addrs = [{ address: host }];
     else { try { addrs = await lookup(host); } catch (_) { throw new ToolError(`could not resolve ${host}. Nothing was fetched.`); } }
@@ -242,7 +270,7 @@ export async function createPriorsMcpServer({ env = process.env, fetchImpl = glo
       max_borrow_usd: z.number().nonnegative().optional().describe("Most to borrow from the Priors line if the wallet is short, in US dollars. Default 0: never borrow."),
     },
     annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
-  }, async ({ url, method = "GET", body, max_price_usd, max_borrow_usd }) => {
+  }, serial(async ({ url, method = "GET", body, max_price_usd, max_borrow_usd }) => {
     const signer = needWallet("pay_url");
     const u = await checkTarget(url);
     if (method === "GET" && body !== undefined) throw new ToolError("A GET request cannot carry a body: use POST (or another method) with body.");
@@ -263,7 +291,7 @@ export async function createPriorsMcpServer({ env = process.env, fetchImpl = glo
     let r;
     if (prior) {
       // A payment for this purchase is already out and still cashable: send that same one, never a second.
-      r = await X.createPayer({ signer, fetchImpl, pendingRetries: 2, maxSleepMs: 10_000, timeoutMs: requestTimeoutMs, signal: AbortSignal.timeout(callBudgetMs), ...(sleep ? { sleep } : {}) }).resend(url, prior.paymentHeaders, init);
+      r = await X.createPayer({ signer, fetchImpl: payFetch, pendingRetries: 2, maxSleepMs: 10_000, timeoutMs: requestTimeoutMs, signal: AbortSignal.timeout(callBudgetMs), ...(sleep ? { sleep } : {}) }).resend(url, prior.paymentHeaders, init);
       r = { ...r, requirement: prior.requirement, paid: r.response.ok ? prior.price : 0n, borrowed: 0n, signed: prior, resent: true, ...(r.response.ok ? { settlement: settlementOf(r.response) } : {}) };
       lines.push("No new payment was signed: the same signed payment was sent again.");
     } else {
@@ -271,7 +299,7 @@ export async function createPriorsMcpServer({ env = process.env, fetchImpl = glo
       if (maxBorrow > 0n && session.borrowed + maxBorrow > borrowTotalCap) throw new ToolError(`this could bring what is borrowed in this session to ${usd(session.borrowed + maxBorrow)}, above ${usd(borrowTotalCap)} (PRIORS_MAX_BORROW_TOTAL_USD).`);
       let agentId;
       if (maxBorrow > 0n) { agentId = await resolveAgent(); await needController(agentId); }
-      const payer = X.createPayer({ signer, maxPrice, maxBorrow, fetchImpl, pendingRetries: 2, maxSleepMs: 10_000, timeoutMs: requestTimeoutMs, signal: AbortSignal.timeout(callBudgetMs), ...(sleep ? { sleep } : {}), ...(maxBorrow > 0n ? { pool: addresses.pool, agentId } : {}) });
+      const payer = X.createPayer({ signer, maxPrice, maxBorrow, fetchImpl: payFetch, pendingRetries: 2, maxSleepMs: 10_000, timeoutMs: requestTimeoutMs, signal: AbortSignal.timeout(callBudgetMs), ...(sleep ? { sleep } : {}), ...(maxBorrow > 0n ? { pool: addresses.pool, agentId } : {}) });
       try { r = await payer.pay(url, init); } catch (e) {
         if (e?.name === "TimeoutError" || e?.name === "AbortError") throw new ToolError(`${method} ${u.href} did not answer in time. Nothing was signed or paid.`);
         throw e;
@@ -300,7 +328,7 @@ export async function createPriorsMcpServer({ env = process.env, fetchImpl = glo
     try { ({ text: bodyText, cut } = await X.readCapped(r.response)); } catch (_) { /* no body */ }
     if (bodyText) lines.push(`Response body${cut ? " (cut at 256 KB)" : ""}:\n${fenced(clean(bodyText, 20_000), "response body")}`);
     return lines.join("\n");
-  });
+  }));
 
   // ---- wallet_balance ------------------------------------------------------------------------------------------
   tool("wallet_balance", {
@@ -364,7 +392,7 @@ export async function createPriorsMcpServer({ env = process.env, fetchImpl = glo
       dry_run: z.boolean().optional().describe("true: only quote the fee and due amount, borrow nothing."),
     },
     annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
-  }, async ({ amount_usd, days, dry_run }) => {
+  }, serial(async ({ amount_usd, days, dry_run }) => {
     needWallet("borrow");
     const amount = dollars(amount_usd, "amount_usd");
     if (amount === 0n) throw new ToolError("amount_usd must be above zero");
@@ -378,7 +406,7 @@ export async function createPriorsMcpServer({ env = process.env, fetchImpl = glo
     const r = await credit.borrow(id, amount, term);
     session.borrowed += r.principal;
     return `Borrowed ${usd(r.principal)} for agent #${id}${r.loanId !== null ? ` as loan #${r.loanId}` : ""}: fee ${usd(r.fee)}, so ${usd(r.principal + r.fee)} is due${r.dueAt ? ` by ${when(r.dueAt)}` : ""}. The USDG is in ${wallet.address}. Tx ${r.hash}.`;
-  });
+  }));
 
   // ---- repay ---------------------------------------------------------------------------------------------------
   tool("repay", {
@@ -389,7 +417,7 @@ export async function createPriorsMcpServer({ env = process.env, fetchImpl = glo
       all: z.boolean().optional().describe("true: repay every open loan of the agent, earliest due first."),
     },
     annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
-  }, async ({ loan_id, all }) => {
+  }, serial(async ({ loan_id, all }) => {
     needWallet("repay");
     if ((loan_id === undefined) === (all !== true)) throw new ToolError("Give exactly one of loan_id or all: true.");
     // Only the loans of an agent this wallet controls: the pool lets anyone repay any loan, and this wallet's USDG is
@@ -413,7 +441,7 @@ export async function createPriorsMcpServer({ env = process.env, fetchImpl = glo
     const out = [done.length ? `Repaid for agent #${id}:\n- ${done.join("\n- ")}` : `Nothing was repaid for agent #${id}.`];
     if (left.length) out.push(`Still open: ${left.map((l) => `#${l.loanId} (${usd(l.due)} due ${when(l.dueAt)})`).join(", ")}.${stop ? ` Stopped because: ${stop}` : ""}`);
     return out.join("\n");
-  });
+  }));
 
   // ---- find_services -------------------------------------------------------------------------------------------
   tool("find_services", {