@quackai/q402-mcp 0.8.12 → 0.8.13

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/dist/index.js +6 -1
  2. package/package.json +1 -1
package/dist/index.js CHANGED
@@ -211,7 +211,7 @@ var isValidPrivateKey = (s) => typeof s === "string" && PRIVATE_KEY_RE.test(s);
211
211
 
212
212
  // src/version.ts
213
213
  var PACKAGE_NAME = "@quackai/q402-mcp";
214
- var PACKAGE_VERSION = "0.8.12";
214
+ var PACKAGE_VERSION = "0.8.13";
215
215
 
216
216
  // src/tools/quote.ts
217
217
  import { z } from "zod";
@@ -1002,6 +1002,11 @@ async function runPay(input) {
1002
1002
  maxAmountGuard(input.amount, CONFIG.maxAmountPerCallUsd);
1003
1003
  guardsApplied.push(`max_amount<=${CONFIG.maxAmountPerCallUsd}`);
1004
1004
  recipientGuard(input.to, CONFIG.allowedRecipients);
1005
+ if (input.hookParams?.splits) {
1006
+ for (const leg of input.hookParams.splits) {
1007
+ recipientGuard(leg.recipient, CONFIG.allowedRecipients);
1008
+ }
1009
+ }
1005
1010
  if (CONFIG.allowedRecipients.length > 0) {
1006
1011
  guardsApplied.push(`recipient_allowlist[${CONFIG.allowedRecipients.length}]`);
1007
1012
  }
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@quackai/q402-mcp",
3
- "version": "0.8.12",
3
+ "version": "0.8.13",
4
4
  "description": "MCP server for Q402 — gasless USDC/USDT/RLUSD payments on 10 EVM chains + Chainlink CCIP USDC bridge on the eth/avax/arbitrum triangle, callable from Claude (Desktop / Code), OpenAI Codex CLI, and any other Model Context Protocol client.",
5
5
  "mcpName": "io.github.bitgett/q402-mcp",
6
6
  "keywords": [