@true402.dev/mcp-server 0.6.0 → 0.7.0

package/dist/index.js

@@ -22,7 +22,7 @@ const SERVER_URL = process.env.SERVER_URL ?? "https://true402.dev/api";
 const WALLET_PRIVATE_KEY = process.env.WALLET_PRIVATE_KEY;
 const server = new McpServer({
     name: "true402",
-    version: "0.6.0",
+    version: "0.7.0",
 });
 // Start server with stdio transport
 async function main() {

package/dist/x402-pay.d.ts

@@ -54,6 +54,12 @@ export interface EVMPaymentRequirement {
  * - asset must be the canonical USDC on a supported chain (no arbitrary token/verifyingContract).
  */
 export declare function assessRequirement(req: EVMPaymentRequirement, maxUsdc: number): string | null;
+/**
+ * Parse the MAX_PAYMENT_USDC ceiling FAIL-CLOSED: unset → the 0.10 default; a non-numeric or negative
+ * value (e.g. the European comma-decimal "0,10" → NaN) clamps to 0 = refuse ALL auto-pay, never
+ * disables the only wallet-drain guard.
+ */
+export declare function parseMaxUsdc(raw: string | undefined): number;
 /** Refuse to send a signed payment over cleartext (the X-PAYMENT header would be interceptable).
  *  Returns a refusal string, or null if the URL is https (or localhost for dev). */
 export declare function requireSecureUrl(url: string): string | null;

package/dist/x402-pay.js

@@ -91,7 +91,9 @@ export function assessRequirement(req, maxUsdc) {
     }
     if (!Number.isFinite(amountUsdc) || amountUsdc < 0)
         return "the 402 amount is invalid; refusing to sign.";
-    if (Number.isFinite(maxUsdc) && amountUsdc > maxUsdc) {
+    // `maxUsdc` is a finite, non-negative invariant (see parseMaxUsdc) — the comparison ALWAYS runs, so
+    // a misconfigured ceiling can never silently disable the cap (maxUsdc=0 refuses everything).
+    if (amountUsdc > maxUsdc) {
         return `refusing to auto-pay $${amountUsdc} USDC — it exceeds the MAX_PAYMENT_USDC ceiling of $${maxUsdc}. Raise MAX_PAYMENT_USDC if this is intended.`;
     }
     const usdc = USDC_BY_CHAIN[resolveChainId(req.network)];
@@ -100,6 +102,20 @@ export function assessRequirement(req, maxUsdc) {
     }
     return null;
 }
+/**
+ * Parse the MAX_PAYMENT_USDC ceiling FAIL-CLOSED: unset → the 0.10 default; a non-numeric or negative
+ * value (e.g. the European comma-decimal "0,10" → NaN) clamps to 0 = refuse ALL auto-pay, never
+ * disables the only wallet-drain guard.
+ */
+export function parseMaxUsdc(raw) {
+    if (raw === undefined)
+        return 0.1;
+    const n = Number(raw);
+    if (Number.isFinite(n) && n >= 0)
+        return n;
+    console.error(`true402 MCP: MAX_PAYMENT_USDC='${raw}' is not a valid number — refusing ALL auto-pay. Set a numeric value like 0.10.`);
+    return 0;
+}
 /** Refuse to send a signed payment over cleartext (the X-PAYMENT header would be interceptable).
  *  Returns a refusal string, or null if the URL is https (or localhost for dev). */
 export function requireSecureUrl(url) {
@@ -129,7 +145,14 @@ export async function signEIP3009Payment(privateKey, requirement) {
     const account = privateKeyToAccount(key);
     const now = Math.floor(Date.now() / 1000);
     const validAfter = BigInt(now - 60); // valid 60s in the past (clock skew tolerance)
-    const validBefore = BigInt(now + requirement.maxTimeoutSeconds);
+    // Validate + bound the signed window: maxTimeoutSeconds arrives via JSON and may be a string
+    // (`now + "999"` would string-concat); a hostile 402 must not keep the authorization broadcastable
+    // far into the future. Coerce, reject garbage, cap at 10 minutes.
+    const timeout = Number(requirement.maxTimeoutSeconds);
+    if (!Number.isInteger(timeout) || timeout <= 0) {
+        throw new Error("Payment requirement has an invalid maxTimeoutSeconds");
+    }
+    const validBefore = BigInt(now + Math.min(timeout, 600));
     // Generate a random nonce (bytes32)
     const randomBytes = new Uint8Array(32);
     crypto.getRandomValues(randomBytes);
@@ -267,7 +290,7 @@ export async function payAndFetch(baseUrl, path, body, walletPrivateKey) {
     }
     // Spend ceiling + asset/network pin: a hostile server must not make our wallet sign a draining
     // amount or a payment to an arbitrary token/chain. Refuse BEFORE signing.
-    const maxUsdc = Number(process.env.MAX_PAYMENT_USDC ?? "0.10");
+    const maxUsdc = parseMaxUsdc(process.env.MAX_PAYMENT_USDC);
     const refusal = assessRequirement(evmRequirement, maxUsdc);
     if (refusal) {
         return { ok: false, paymentRequired: true, message: refusal };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@true402.dev/mcp-server",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "mcpName": "dev.true402/mcp-server",
   "description": "MCP server for the true402 machine-native marketplace — pay-per-call AI + web + Base on-chain tools over x402 (USDC on Base): LLM inference, SEO/GEO audit, web extract, link preview, robots/AI-crawler check, security headers, and on-chain DeFi trading signals (token rug/honeypot safety, new token pairs, liquidity-pull/rug alerts, whale swaps).",
   "type": "module",