agent402-mcp 0.13.14 → 0.13.15

package/README.md

@@ -87,6 +87,7 @@ so set `AGENT402_MAX_PER_CALL` if you want a hard per-call ceiling.
 - **Decide** (`decide.plan`, `decide.execute`, `decide.feedback`): describe a job and get a call-ready plan over the catalog and outside x402 sellers (tools in order, fallbacks, validated params, chained steps), then run it yourself or through Agent402. Listed when the server offers Decide; see https://agent402.tools/decide.
 - The rest of the 500+ tool catalog is reachable via the meta tools `catalog.search` / `catalog.find` + `catalog.call` - keeping your context window small. The same dotted names are listed on the hosted connector; the older snake names (`search_tools`, `find_tool`, `call_tool`, `get_payment_info`, `describe_server`, `list_top_sellers`, and the flagship `search_web` …) remain accepted as CallTool aliases, so existing configs keep working.
 - When a call hits HTTP 402: with a wallet key set (`AGENT_KEY` for the EVM chains, Robinhood Chain included; `SOLANA_AGENT_KEY` for Solana), the server signs an x402 payment on a chain the seller accepts and retries; with only a credits key it sends `Authorization: Bearer a402_…` and the server debits the balance on success; with neither it solves the tool's proof-of-work challenge (~0.2 s of CPU) on the eligible tools. (The service settles USDC on Base, Solana, Polygon, Arbitrum, Monad, Celo, Avalanche, Sei, Optimism, Stellar and Algorand, plus USDG on Robinhood Chain - 12 chains total - for callers using a raw x402 client rather than this package.)
+- Since 0.13.15 the server's requests to the catalog and to sellers (catalog reads, the 402 and the paid retry) refuse a TLS chain through one of the intermediate CAs listed in `networks.js` (keys reported recoverable in Mozilla bug 2083449), keyed on each certificate's SubjectPublicKeyInfo hash, on a dedicated dispatcher. With a proxy or custom dispatcher installed, requests go out through it unchanged.
 - `payment.info` tells the model which mode it's in and what a wallet or a credits key would unlock.
 - `server.describe` returns orientation (flagship-first tools, install one-liners, free vs paid, discovery URLs). Call it first.
 - `sellers.list` returns the live leaderboards - `wire: "x402"` (default) ranks x402 sellers settling the most USDC (primarily on Base) in the last ~24h from on-chain transfers; `wire: "mpp"` ranks live-verified MPP sellers by inbound USDC.e transfers on Tempo. Free to call (no payment, no proof-of-work). Useful for agents discovering the wider x402 / MPP economy beyond this single service's catalog.

package/discovery.js

@@ -5,10 +5,14 @@
 // DISCOVERY_ATTEMPTS tries in all, each wait capped at DISCOVERY_MAX_WAIT_MS.
 // A paid or priced call never goes through here: a repeat of one could settle
 // twice.
+import { distrustFetch } from "./networks.js";
+
 export const DISCOVERY_ATTEMPTS = 3;
 export const DISCOVERY_MAX_WAIT_MS = 5000;
 
 const sleepMs = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+// Discovery reads go through the distrusted-intermediate refusal (networks.js).
+const ownFetch = distrustFetch();
 
 /** The wait (ms) a shed 503 asks for, or null when `r` is not one. */
 export async function shedRetryWaitMs(r, maxWaitMs = DISCOVERY_MAX_WAIT_MS) {
@@ -30,7 +34,7 @@ export async function shedRetryWaitMs(r, maxWaitMs = DISCOVERY_MAX_WAIT_MS) {
  * response (2xx or not) and how many attempts it took; the caller decides how
  * to report a failure, naming the surface and `res.status`.
  */
-export async function fetchDiscovery(url, init, { fetchImpl = globalThis.fetch, sleep = sleepMs, attempts: max = DISCOVERY_ATTEMPTS } = {}) {
+export async function fetchDiscovery(url, init, { fetchImpl = ownFetch, sleep = sleepMs, attempts: max = DISCOVERY_ATTEMPTS } = {}) {
   let res;
   let attempts = 0;
   for (;;) {

package/index.js

@@ -24,7 +24,7 @@
 //                         Robinhood Chain, "base,solana", or a raw CAIP-2 like eip155:4663), optional
 import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
-import { parseNetworkPrefs, withNetworkPreference } from "./networks.js";
+import { parseNetworkPrefs, withNetworkPreference, distrustFetch } from "./networks.js";
 import { fetchDiscovery, discoveryFailure, getDiscoveryJson } from "./discovery.js";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -51,6 +51,10 @@ import {
 } from "./output-schemas.js";
 
 const BASE = (process.env.AGENT402_URL || "https://agent402.tools").replace(/\/$/, "");
+// Catalog and seller requests (the 402 and the paid retry included) go through
+// a dedicated dispatcher that refuses a TLS chain through a distrusted
+// intermediate CA (networks.js).
+const ownFetch = distrustFetch();
 const AGENT_KEY = process.env.AGENT_KEY || "";
 // Solana secret key: base58 string (Phantom/solana-keygen export) or a JSON
 // byte array. Either key alone enables paid calls; with both, the buyer can
@@ -165,7 +169,7 @@ function getPayFetch() {
     // Without it the client effectively always picks Base on multi-chain
     // sellers, leaving non-default rails unreachable.
     withNetworkPreference(client, parseNetworkPrefs(process.env.AGENT402_NETWORKS));
-    return wrapFetchWithPayment(fetch, client);
+    return wrapFetchWithPayment(ownFetch, client);
   })();
   return payFetchPromise;
 }
@@ -265,7 +269,7 @@ function usdFromAccepts(accepts) {
 async function quotedUsd(url, init, listUsd) {
   if (!CAPS_CONFIGURED) return listUsd;
   try {
-    const pre = await fetch(url, init);
+    const pre = await ownFetch(url, init);
     if (pre.status !== 402) return listUsd;
     let quoted = null;
     const header = pre.headers.get("payment-required");
@@ -321,7 +325,7 @@ async function callEndpoint(tool, args = {}) {
     if (spentUsd + price > BUDGET) {
       return { content: [{ type: "text", text: `Refused: session budget exhausted ($${spentUsd.toFixed(4)} of $${BUDGET} spent; "${tool.slug}" is quoted $${price} for this request).` }], isError: true };
     }
-    res = await fetch(url, { ...init, headers: { ...init.headers, Authorization: `Bearer ${CREDITS_KEY}` } });
+    res = await ownFetch(url, { ...init, headers: { ...init.headers, Authorization: `Bearer ${CREDITS_KEY}` } });
     if (res.ok) spentUsd += price;
     if (res.status === 402) {
       let body = {}; try { body = await res.clone().json(); } catch { /* plain */ }
@@ -355,7 +359,7 @@ async function callEndpoint(tool, args = {}) {
     // 402 round-trip entirely (challenges are single-use and tool-scoped).
     const challenge = await getDiscoveryJson(`proof-of-work challenge for "${tool.slug}"`, `${BASE}/api/pow/challenge?slug=${encodeURIComponent(tool.slug)}`);
     const nonce = solvePow(challenge);
-    res = await fetch(url, { ...init, headers: { ...init.headers, "X-Pow-Solution": `${challenge.token}:${nonce}` } });
+    res = await ownFetch(url, { ...init, headers: { ...init.headers, "X-Pow-Solution": `${challenge.token}:${nonce}` } });
   } else {
     return { content: [{ type: "text", text: walletRequiredText(tool) }], isError: true };
   }

package/networks.js

@@ -1,4 +1,6 @@
-// Network preference for the x402 buyer, pure helpers, no side effects.
+// Network preference for the x402 buyer, pure helpers, no side effects; and
+// the TLS refusal at the end of the file (its only load-time step is a data:
+// URL fetch that makes no connection).
 //
 // AGENT402_NETWORKS (comma-separated, e.g. "robinhood" or "base,solana" or a
 // raw CAIP-2 like "eip155:4663") restricts AND orders which payment options
@@ -6,6 +8,8 @@
 // underlying @x402 client picks whichever registered scheme matches first,
 // which on a multi-chain seller is effectively always Base, making rails like
 // USDG on Robinhood Chain unreachable no matter what the wallet holds.
+import tls from "node:tls";
+import { createHash, X509Certificate } from "node:crypto";
 
 export const NETWORK_CAIP2 = {
   base: "eip155:8453",
@@ -56,3 +60,110 @@ export function withNetworkPreference(client, prefs) {
     orig({ ...paymentRequired, accepts: filterAcceptsByNetworks(paymentRequired?.accepts, prefs) });
   return client;
 }
+
+// ---------------------------------------------------------------------------
+// Transport: refuse TLS chains through a distrusted intermediate CA, for this
+// server's own requests (a dedicated dispatcher, nothing global).
+//
+// The private keys of the intermediate CAs below are recoverable (Mozilla bug
+// 2083449). A cross-signed path makes them validate against "emSign ECC Root
+// CA - G3" in Node's bundled store, and Node checks no revocation by default,
+// so a certificate minted with one of these keys for a seller's host would be
+// accepted, and a forged 402 could name a different payTo. Keyed on the
+// SubjectPublicKeyInfo sha256 of every certificate in the presented chain.
+// The same code as agent402-client's tls-distrust.js (the parent repo's
+// scripts/test-tls-distrust.js holds the copies equal); it lives in this file
+// because the images copy an explicit file list. It applies only when the
+// process-wide dispatcher is still Node's own default (a dispatcher the
+// caller installed, with its proxy, CA or timeouts, is left in charge). It can be removed once the
+// Node releases this package supports ship a CA store that no longer builds
+// the path.
+export const DISTRUSTED_SPKI_SHA256 = Object.freeze({
+  "ebed6475c2c2d80fcb199f3fe8dd6e6b3ce60b77eb15d4e42c3dec0c6f5b5105": "EM DV TLS CA - G3B",
+  "43bffa19d6ef651451f6841e019931e96f6f2eaeff28ab4b6f1ce4576de2717b": "EM OV TLS CA - G3B",
+  "e0254c7fcdc265e2f0f8a428dabb75ab4ae039b4872d62f5ee57f0877d5a8a41": "EM EV TLS CA - G3B",
+  "49dd353dc2b919a3770645117d0e60c16115e7d1bc259eefe734b00ea434fe5f": "EM DV TLS CA - G3C",
+  "63ecefee431d49523bc1136c4e72d0206a477086caf606cd5cf025686c109cf8": "EM OV TLS CA - G3C",
+  "5c0660a2b164910d8ff589c18e14552e9e0ec237dcefe2cb736d41a4811f81a0": "EM EV TLS CA - G3C",
+  "ec4ffa1ad0ac88081314b7aaffef6a91f97cd57291bb5ba686c5415f5eb4f6b6": "EM OV CS CA - G3B",
+  "92c063d67e8f14db71d288e11266ffdaf69cbf115f7bab14f3bc2f68d25e0e30": "EM OV CS CA - G3C",
+});
+
+/** checkServerIdentity that refuses a chain through a listed key (plus any
+ *  `extraSpki` hex hashes), else defers to Node's hostname check. */
+export function distrustCheckServerIdentity(extraSpki = []) {
+  const extra = new Set([...extraSpki].map((h) => String(h).toLowerCase()));
+  const nodeCheck = tls.checkServerIdentity;
+  return (host, cert) => {
+    const seen = [];
+    for (let c = cert; c && typeof c === "object" && !seen.includes(c) && seen.length < 16; c = c.issuerCertificate === c ? null : c.issuerCertificate) {
+      seen.push(c);
+      if (!c.raw) continue;
+      let spki;
+      try {
+        spki = createHash("sha256").update(new X509Certificate(c.raw).publicKey.export({ type: "spki", format: "der" })).digest("hex");
+      } catch {
+        return Object.assign(new Error(`Refusing the TLS certificate for ${host}: distrusted intermediate check could not read the certificate chain`), { code: "ERR_TLS_DISTRUSTED_INTERMEDIATE" });
+      }
+      const name = DISTRUSTED_SPKI_SHA256[spki] || (extra.has(spki) ? "listed key" : null);
+      if (name) return Object.assign(new Error(`Refusing the TLS certificate for ${host}: distrusted intermediate (${name}) in the certificate chain`), { code: "ERR_TLS_DISTRUSTED_INTERMEDIATE" });
+    }
+    return nodeCheck(host, cert);
+  };
+}
+
+const GLOBAL_DISPATCHER = Symbol.for("undici.globalDispatcher.1");
+
+// Node's own default dispatcher, observed when this module loads. Node fills
+// the slot when fetch is first called (synchronously, before any connection),
+// so when the slot is still empty here a data: URL fetch fills it with Node's
+// instance and nothing else can have put it there. When the slot is already
+// filled at load, whoever filled it is unknown and it is treated as the
+// caller's (no dedicated dispatcher), unless another copy of this code (the
+// client and the MCP server share it) observed that same instance as Node's.
+const OBSERVED = Symbol.for("agent402.tlsDistrust.nodeDefaultDispatcher");
+function observeNodeDefault() {
+  if (typeof process !== "object" || !process?.versions?.node || process.versions.bun) return null;
+  const current = globalThis[GLOBAL_DISPATCHER];
+  if (current) return globalThis[OBSERVED] === current ? current : null;
+  if (typeof globalThis.fetch !== "function") return null;
+  try { globalThis.fetch("data:,").catch(() => {}); } catch { return null; }
+  const observed = globalThis[GLOBAL_DISPATCHER] || null;
+  if (observed) Object.defineProperty(globalThis, OBSERVED, { value: observed, configurable: false, enumerable: false, writable: false });
+  return observed;
+}
+const NODE_DEFAULT_DISPATCHER = observeNodeDefault();
+
+/** True when the process-wide dispatcher is not Node's own default: the
+ *  caller installed one, or its origin is unknown. */
+export function callerDispatcherInstalled() {
+  return !NODE_DEFAULT_DISPATCHER || globalThis[GLOBAL_DISPATCHER] !== NODE_DEFAULT_DISPATCHER;
+}
+
+/** A dedicated undici Agent carrying the refusal, or null when this platform
+ *  cannot take one or the caller installed their own global dispatcher (see
+ *  the header). */
+export async function distrustDispatcher({ extraSpki = [] } = {}) {
+  if (callerDispatcherInstalled()) return null;
+  const AgentClass = NODE_DEFAULT_DISPATCHER.constructor;
+  if (typeof AgentClass !== "function") return null;
+  return new AgentClass({ connect: { checkServerIdentity: distrustCheckServerIdentity(extraSpki) } });
+}
+
+/** Wrap a fetch so every request it makes goes through distrustDispatcher().
+ *  With no baseFetch it calls globalThis.fetch as it is at request time. A
+ *  caller's own init.dispatcher, or a global dispatcher the caller installed
+ *  (checked on every request), is left alone. Pass the result as the base
+ *  fetch of a payment wrapper (wrapFetchWithPayment(distrustFetch(), client))
+ *  so the 402 and the paid retry both go through it. */
+export function distrustFetch(baseFetch, opts = {}) {
+  if (baseFetch !== undefined && typeof baseFetch !== "function") throw new Error("distrustFetch needs a fetch function");
+  let pending = null;
+  return async (input, init = {}) => {
+    const f = baseFetch || globalThis.fetch;
+    if (callerDispatcherInstalled() || init?.dispatcher !== undefined) return f(input, init);
+    pending ||= distrustDispatcher(opts).catch(() => null);
+    const dispatcher = await pending;
+    return f(input, dispatcher ? { ...init, dispatcher } : init);
+  };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent402-mcp",
-  "version": "0.13.14",
+  "version": "0.13.15",
   "mcpName": "io.github.MikeyPetrillo/agent402",
   "author": "Havok Holdings LLC <mike@agent402.tools> (https://agent402.tools)",
   "homepage": "https://agent402.tools",