agentic-wallet-mcp 0.2.0 → 0.3.1

package/README.md

@@ -8,14 +8,12 @@ through Wallet BE's HSM.
 
 - **x401** proof → [`x401-zetrix-client`](https://www.npmjs.com/package/x401-zetrix-client) (npm)
 - **x402** payment → [`x402-zetrix-client`](https://www.npmjs.com/package/x402-zetrix-client) (npm)
-- **VC presentation** (BBS+ VP derivation) → MBI RS (`/v1/vp/ext/create` + `/v1/vp/ext/submit`, `includeVp: true` — BT-2357)
+- **VC presentation** (BBS+ VP derivation) → MBI RS (`/v1/vp/ext/create` + `/v1/vp/ext/submit`, `includeVp: true`)
 - **issuer key resolution** (for the OID4VP submit body) → the Zetrix ZID resolver (`https://zid-resolver[-sandbox].zetrix.com`)
 - **holder key custody + signing** → Wallet BE softHSM (`/wallet/hsm/*`)
 - **VC issuance** → MBI RS (`/v1/vc/pay/*`)
 
-[`docs/CONTRACT_RECONCILIATION.md`](docs/CONTRACT_RECONCILIATION.md) has the authoritative
-endpoint/contract map, [`docs/DEVELOPMENT_CHECKLIST.md`](docs/DEVELOPMENT_CHECKLIST.md) has status,
-and [`docs/USAGE_FLOW.md`](docs/USAGE_FLOW.md) has a full end-to-end prompt script (onboarding →
+[`docs/USAGE_FLOW.md`](docs/USAGE_FLOW.md) has a full end-to-end prompt script (onboarding →
 VC issuance → identity proof → pay-per-use).
 
 ## Tools
@@ -51,8 +49,7 @@ VC issuance → identity proof → pay-per-use).
 > resolves the issuer's DID document via the Zetrix ZID resolver, and matches the BBS+
 > (`publicKeyMultibase`) and Ed25519 (`publicKeyHex`) verification methods referenced by the VC's
 > own proofs. `issuerKeys` is still accepted as a manual escape hatch if the resolver is ever
-> unreachable. See `docs/CONTRACT_RECONCILIATION.md §8` for the full trace through the verifier's
-> source that led to this.
+> unreachable.
 
 ## Install
 
@@ -81,10 +78,10 @@ Node ≥ 18 required (built-in `fetch`).
 | `HOLDER_DID` | no | Holder DID. Omit and the MCP derives it automatically — see "Onboarding" below |
 | `WALLET_BE_URL` | no | Wallet BE base URL override (HSM `/wallet/hsm/sign-blob`) — auto-derived from `ZETRIX_NETWORK` when not set |
 | `MBI_BASE_URL` | no | MBI RS base URL override (`/v1/vc/pay/apply`) — auto-derived from `ZETRIX_NETWORK` when not set |
-| `OID4VP_BASE_URL` | no | OID4VP verifier base URL override — auto-derived from `ZETRIX_NETWORK` by the x401 SDK when not set (BT-2368) |
+| `OID4VP_BASE_URL` | no | OID4VP verifier base URL override — auto-derived from `ZETRIX_NETWORK` by the x401 SDK when not set |
 | `ZETRIX_NODE_HOST` / `ZETRIX_NODE_PORT` | no | RPC node override (auto-derived from network) |
 | `ZID_RESOLVER_BASE_URL` | no | ZID resolver override (auto-derived from network: sandbox for testnet, prod for mainnet) |
-| `MAX_PAYMENT_AMOUNT` | no** | Per-asset x402 auto-pay cap — JSON `{ "<asset>": "<maxRawUnits>", "*": "<fallback>" }`, e.g. `{"ZTX":"1000000000","*":"0"}`. Unset = no cap enforced. |
+| `MAX_PAYMENT_AMOUNT` | no** | Per-asset x402 auto-pay cap — JSON `{ "<asset>": "<maxRawUnits>", "*": "<fallback>" }`. `pay_and_fetch`/`subscribe_and_issue` are asset-agnostic: the resource server's 402 challenge may quote the native ZETRIX token (asset code `ZTX`) **or** a ZTP20 token (e.g. `JMYR`) — cap whichever assets you expect, e.g. `{"ZTX":"1000000000","JMYR":"5000000","*":"0"}`. Unset = no cap enforced. |
 
 \* sensitive — never logged.
 
@@ -133,7 +130,7 @@ default one — an explicit value always wins over the network default. The `*.m
 troubleshooting" below if any of them time out.
 
 That's the complete list — no VC-MCP subprocess, no BaaS gateway key, no manually-configured
-BBS+ key to set up (BT-2357 replaced that whole path — see `docs/CONTRACT_RECONCILIATION.md §8`).
+BBS+ key to set up.
 
 ## Configuring in Claude Desktop / Claude Code
 
@@ -202,12 +199,12 @@ either way, restart the server afterward (env vars load once, at process start).
 `heldCredentials`; the response tells you whether the agent-identity credential you need is
 already there. Skip to Phase 3 if so.
 
-**Phase 2 — `subscribe_and_issue` — VC issuance (✅ live-verified).**
+**Phase 2 — `subscribe_and_issue` — VC issuance.**
 `{ templateId, attributes }` → holder-signs the payload via Wallet BE → MBI's x402 `402` →
 self-pay → MBI settles **and** issues the VC in one call. **Hold onto the returned `vc`** — it's
 what you pass into every future `prove_identity` call.
 
-**Phase 3 — `prove_identity` — x401 identity proof (✅ live-verified, `VERIFIED`).**
+**Phase 3 — `prove_identity` — x401 identity proof.**
 `{ proofRequest, vc }` (omit `revealAttribute`/`issuerKeys` — both now resolve automatically).
 Internally: fetch the OID4VP presentation definition → derive the BBS+ selective-disclosure VP
 via MBI (`/vp/ext/create` + `/vp/ext/submit`, `includeVp: true`) → resolve the issuer's
@@ -217,7 +214,7 @@ resource server happens outside this MCP, in whatever drove the conversation. Se
 `PROOF-REQUEST` header" section in [`docs/USAGE_FLOW.md`](docs/USAGE_FLOW.md) for the exact wire
 structure and field semantics.
 
-**Phase 4 — `pay_and_fetch` — pay-per-use (✅ live-verified).**
+**Phase 4 — `pay_and_fetch` — pay-per-use.**
 `{ url, method?, headers?, body? }` → fetch → on `402`, self-pay → retry with `X-PAYMENT`.
 Independent of Phases 2/3 — no VC or identity proof involved, just a fresh payment per call.
 
@@ -230,10 +227,10 @@ observed so far, the code was correct and the network/edge state had changed.
 | Symptom | Cause | Fix / status |
 |---|---|---|
 | `Wallet BE /wallet/hsm/sign-blob request failed <- fetch failed <- UND_ERR_CONNECT_TIMEOUT` (or same for `mbi-vc.myegdev.com`) | `*.myegdev.com` hosts are internal — unreachable without VPN | Connect/reconnect your VPN, then retry. Verify first: `curl -I https://wallet-api.myegdev.com/server` |
-| `VP derivation failed <- ZID resolver HTTP 403 ... cf-mitigated: challenge` | ZID resolver (`zid-resolver-sandbox.zetrix.com`) was behind a Cloudflare **managed challenge** that blocked plain server-to-server `fetch` | **Fixed 2026-07-17** — DevOps allowlisted server-to-server access; the resolver now returns `200` directly (verified: `curl https://zid-resolver-sandbox.zetrix.com/1.0/identifiers/<did>` → real DID document, keys byte-identical to a browser-fetched copy). If it ever regresses, `prove_identity`'s `issuerKeys` input is the fallback — fetch the DID document via a real browser (it clears the JS challenge) and pass its `verificationMethod` entries' `publicKeyMultibase` (BBS+) / `publicKeyHex` (Ed25519) directly. |
+| `VP derivation failed <- ZID resolver HTTP 403 ... cf-mitigated: challenge` | ZID resolver (`zid-resolver-sandbox.zetrix.com`) sitting behind a Cloudflare **managed challenge** that blocks plain server-to-server `fetch` | Server-to-server access to the resolver must be allowlisted so it returns `200` directly. If the challenge is active, `prove_identity`'s `issuerKeys` input is the fallback — fetch the DID document via a real browser (it clears the JS challenge) and pass its `verificationMethod` entries' `publicKeyMultibase` (BBS+) / `publicKeyHex` (Ed25519) directly. |
 | `OID4VP backend returned a malformed presentation definition` | Historical SDK bug: the live sandbox's `GET /v1/presentation/{id}` response has no `expires_at` field, but the SDK guard required one | **Fixed** in `x401-zetrix-client` — `expiresAt` is now optional on `PresentationDefinition`. If you see this, you're on a stale cached `npx` install — clear it (`npx clear-npx-cache` or bump the version) to pick up the current published `agentic-wallet-mcp`. |
 | `SUBMIT_FAILED: OID4VP backend returned 401 ... Missing X-Wallet-Public-Key header` | Historical SDK gap: `POST /v1/presentation/submit` requires wallet-auth headers (`X-Wallet-Public-Key` / `X-Wallet-Signed-Data`, holder signs their own address) that the SDK didn't send | **Fixed** — `X401Wallet` now accepts an injected `submitAuth` provider and the wallet wires it automatically; nothing to configure. |
-| `MBI /vp/ext/submit did not return vp` | MBI's `includeVp` opt-in (BT-2357) not deployed on the target instance | Confirmed deployed on the sandbox (`mbi-vc.myegdev.com`). If you see this against a different MBI instance, that instance needs the same rollout. |
+| `MBI /vp/ext/submit did not return vp` | MBI's `includeVp` opt-in not deployed on the target instance | Deployed on the sandbox (`mbi-vc.myegdev.com`). If you see this against a different MBI instance, that instance needs the same rollout. |
 
 ## Security notes
 
@@ -241,8 +238,7 @@ observed so far, the code was correct and the network/edge state had changed.
   Wallet BE's HSM (`/wallet/hsm/*`); `walletCfg.privateKey` is always `''`.
 - **`MAX_PAYMENT_AMOUNT` is the real control against unbounded auto-spend** — see Environment
   above. Without it, `pay_and_fetch`/`subscribe_and_issue` will pay whatever a server's `402`
-  challenge demands, up to the HSM account's balance. This was raised in code review (finding
-  AWL-M01) specifically because an agent-side "confirm before paying" step is not a real security
-  boundary: the same prompt injection or bad instruction that drove the call in the first place
-  could just as easily drive the confirmation.
+  challenge demands, up to the HSM account's balance. An agent-side "confirm before paying" step
+  is not a real security boundary: the same prompt injection or bad instruction that drove the
+  call in the first place could just as easily drive the confirmation.
 

package/dist/server-bundle.cjs

@@ -12541,6 +12541,54 @@ __export(index_exports, {
 });
 module.exports = __toCommonJS(index_exports);
 
+// package.json
+var package_default = {
+  name: "agentic-wallet-mcp",
+  version: "0.3.1",
+  description: "Agent-facing MCP wallet for Zetrix \u2014 orchestrates x401 identity proof, x402 payment, and MBI VC issuance",
+  keywords: ["mcp", "model-context-protocol", "zetrix", "wallet", "x401", "x402", "blockchain"],
+  license: "MIT",
+  author: "MyEG Services Berhad",
+  homepage: "https://github.com/Zetrix-Chain/zetrix-agentic-wallet",
+  repository: {
+    type: "git",
+    url: "https://github.com/Zetrix-Chain/zetrix-agentic-wallet.git"
+  },
+  bugs: {
+    url: "https://github.com/Zetrix-Chain/zetrix-agentic-wallet/issues"
+  },
+  type: "module",
+  engines: {
+    node: ">=18"
+  },
+  bin: {
+    "agentic-wallet-mcp": "dist/server-bundle.cjs"
+  },
+  files: [
+    "dist/server-bundle.cjs",
+    "README.md",
+    "LICENSE"
+  ],
+  scripts: {
+    build: "tsc --noEmit && esbuild src/index.ts --bundle --platform=node --target=node18 --format=cjs --external:zetrix-sdk-nodejs --outfile=dist/server-bundle.cjs",
+    test: "vitest run",
+    "test:watch": "vitest",
+    typecheck: "tsc --noEmit"
+  },
+  dependencies: {
+    "@modelcontextprotocol/sdk": "^1.0.0",
+    "x401-zetrix-client": "^0.2.1",
+    "x402-zetrix-client": "^0.2.2",
+    "zetrix-sdk-nodejs": "^1.0.3"
+  },
+  devDependencies: {
+    "@types/node": "^20.0.0",
+    esbuild: "^0.24.0",
+    typescript: "^5.9.0",
+    vitest: "^1.6.0"
+  }
+};
+
 // node_modules/zod/v4/core/core.js
 var _a;
 // @__NO_SIDE_EFFECTS__
@@ -21426,6 +21474,9 @@ var X401Wallet = class {
   }
 };
 
+// src/index.ts
+var import_zetrix_sdk_nodejs = __toESM(require("zetrix-sdk-nodejs"), 1);
+
 // src/payment-guard.ts
 var PaymentCapError = class extends Error {
   constructor(message) {
@@ -21490,6 +21541,9 @@ function deriveWalletBeUrl(network) {
 function deriveMbiBaseUrl(network) {
   return network.includes("testnet") ? "https://mbi-vc.myegdev.com" : "https://mbi-vc.zetrix.com";
 }
+function deriveTemplateRegistryAddress(network) {
+  return network.includes("testnet") ? "ZTX3JszqPgRUx743SAp7q7zURfjvkWuH2FMEz" : "ZTX3GqJM1U6ifMPonwD4fGvrgoTKJua7b2cKX";
+}
 function loadConfig(env) {
   const req = (key, hint) => {
     const v = env[key];
@@ -21515,11 +21569,67 @@ function loadConfig(env) {
     ),
     nodeHost: opt("ZETRIX_NODE_HOST") ?? deriveNodeHost(network),
     nodePort: opt("ZETRIX_NODE_PORT") ?? "",
+    templateRegistryAddress: opt("ZETRIX_TEMPLATE_REGISTRY_ADDRESS") ?? deriveTemplateRegistryAddress(network),
     zidResolverBaseUrl: stripTrailingSlash(opt("ZID_RESOLVER_BASE_URL") ?? deriveZidResolverBaseUrl(network)),
     maxPaymentAmount: parsePaymentCaps(opt("MAX_PAYMENT_AMOUNT"))
   };
 }
 
+// src/clients/token-info-client.ts
+async function fetchTokenInfo(contractAddress, query) {
+  let result;
+  try {
+    result = await query({
+      contractAddress,
+      input: JSON.stringify({ method: "contractInfo", params: {} }),
+      optType: 2
+    });
+  } catch {
+    return null;
+  }
+  if (result?.errorCode !== 0) return null;
+  const raw = result.result?.query_rets?.[0]?.result?.value;
+  if (!raw) return null;
+  try {
+    const parsed = JSON.parse(raw);
+    const info = parsed.contractInfo ?? parsed;
+    if (typeof info.symbol !== "string" || info.symbol === "") return null;
+    const decimals = Number(info.decimals);
+    return { symbol: info.symbol, decimals: Number.isFinite(decimals) ? decimals : 0 };
+  } catch {
+    return null;
+  }
+}
+async function resolveAssetSymbol(asset, query) {
+  if (asset === "" || asset === "ZTX") return asset;
+  const info = await fetchTokenInfo(asset, query);
+  return info?.symbol ?? asset;
+}
+
+// src/clients/template-info-client.ts
+async function fetchTemplateRequiredFields(templateId, registryAddress, nodeBaseUrl, query) {
+  const key = `template__${templateId}`;
+  const url = `${nodeBaseUrl.replace(/\/+$/, "")}/getAccountMetaData?address=${encodeURIComponent(registryAddress)}&key=${encodeURIComponent(key)}`;
+  let res;
+  try {
+    res = await query(url);
+  } catch {
+    return null;
+  }
+  if (res?.error_code !== 0) return null;
+  const value = res.result?.[key]?.value;
+  if (!value) return null;
+  try {
+    const parsed = JSON.parse(value);
+    if (parsed.applyFormat === void 0 || parsed.applyFormat === null) return [];
+    const format = typeof parsed.applyFormat === "string" ? JSON.parse(parsed.applyFormat) : parsed.applyFormat;
+    if (!Array.isArray(format)) return null;
+    return format.filter((e) => e && e.mandatory === 1 && typeof e.key === "string" && e.key !== "").map((e) => e.key);
+  } catch {
+    return null;
+  }
+}
+
 // src/clients/wallet-be-client.ts
 var WalletBeError = class extends Error {
   errorCode;
@@ -21717,7 +21827,7 @@ var MbiClient = class {
     if (!res.ok) throw await this.error(res, "vp/ext/create failed");
     return this.unwrap(res);
   }
-  /** POST /v1/vp/ext/submit — submit the signed VP blob; `includeVp: true` returns the finished VP too (BT-2357). */
+  /** POST /v1/vp/ext/submit — submit the signed VP blob; `includeVp: true` returns the finished VP too. */
   async submitVp(body, auth) {
     const res = await this.fetch("POST", "/v1/vp/ext/submit", body, { signedData: auth.signedData, publicKey: auth.publicKey });
     if (!res.ok) throw await this.error(res, "vp/ext/submit failed");
@@ -21842,7 +21952,23 @@ function zetrixHexStringToBytes(s) {
 
 // src/orchestrator/subscribe.ts
 async function subscribeAndIssue(deps, opts) {
-  const data = JSON.stringify([{ templateId: opts.templateId, metadata: opts.attributes }]);
+  if (!/^did:zid:/.test(opts.templateId)) {
+    return { issued: false, reason: `templateId must be a did:zid:... credential-definition id, got "${opts.templateId}"` };
+  }
+  const { agentDid, ...rest } = opts.attributes ?? {};
+  const attributes = agentDid ? opts.attributes : { agentDid: deps.holderDid, ...rest };
+  const required2 = deps.resolveRequiredFields ? await deps.resolveRequiredFields(opts.templateId) : null;
+  if (!opts.dryRun && required2) {
+    const attrs = attributes;
+    const missing = required2.filter((k) => attrs[k] === void 0 || attrs[k] === null || attrs[k] === "");
+    if (missing.length > 0) {
+      return {
+        issued: false,
+        reason: `template requires attribute(s) not supplied: ${missing.join(", ")} \u2014 no payment made`
+      };
+    }
+  }
+  const data = JSON.stringify([{ templateId: opts.templateId, metadata: attributes }]);
   const blob = zetrixHexStringToBytes(data).toString("hex");
   const { signBlob: signData, publicKey } = await deps.sign(blob);
   const body = { data, signData, publicKey };
@@ -21850,9 +21976,32 @@ async function subscribeAndIssue(deps, opts) {
   const challenge = await deps.mbi.applyChallenge(body);
   const accept = challenge.accepts[0];
   if (!accept) return { issued: false, reason: "MBI 402 returned no payment options" };
+  if (opts.dryRun) {
+    const quotedRaw = String(accept.asset ?? "");
+    const quotedAsset = deps.resolveSymbol ? await deps.resolveSymbol(quotedRaw) : quotedRaw;
+    return {
+      issued: false,
+      reason: "dry run \u2014 quoted only, no payment made",
+      quote: {
+        asset: quotedAsset,
+        maxAmountRequired: accept.maxAmountRequired,
+        payTo: accept.payTo,
+        ...required2 ? { requiredAttributes: required2 } : {}
+      }
+    };
+  }
   const xPayment = await deps.pay(accept);
   const issued = await deps.mbi.applySettle({ ...body, paymentId: challenge.paymentId }, xPayment);
-  return { issued: true, vcId: issued.vcId, vc: issued.verifiableCredential, txHash: issued.txHash };
+  const rawAsset = String(accept.asset ?? "");
+  const paidAsset = deps.resolveSymbol ? await deps.resolveSymbol(rawAsset) : rawAsset;
+  return {
+    issued: true,
+    vcId: issued.vcId,
+    vc: issued.verifiableCredential,
+    txHash: issued.txHash,
+    paidAsset,
+    amountPaid: String(accept.maxAmountRequired ?? "")
+  };
 }
 
 // src/orchestrator/onboard.ts
@@ -21915,6 +22064,7 @@ async function resolveHolder(deps, input) {
 }
 
 // src/index.ts
+var packageVersion = package_default.version;
 function buildToolList() {
   return [
     {
@@ -21950,7 +22100,7 @@ function buildToolList() {
     },
     {
       name: "pay_and_fetch",
-      description: "Fetch a URL, auto-paying with x402 (self-pay via Wallet BE) if the server returns 402.",
+      description: "Fetch a URL, auto-paying with x402 (self-pay via Wallet BE) if the server returns 402. The asset charged is whatever the server's 402 challenge demands \u2014 the native ZETRIX token or a ZTP20 token (e.g. JMYR) \u2014 never assume it's ZETRIX; the result's `asset` field reports what was actually paid.",
       inputSchema: {
         type: "object",
         properties: {
@@ -21964,13 +22114,23 @@ function buildToolList() {
     },
     {
       name: "subscribe_and_issue",
-      description: "Obtain a VC from MBI: build the signed payload, pay x402, and return the issued credential.",
+      description: "Obtain a VC from MBI: build the signed payload, pay x402, and return the issued credential. Payment is asset-agnostic \u2014 MBI's 402 challenge may quote the native ZETRIX token or a ZTP20 token (e.g. JMYR); pass dryRun:true first to see the quoted asset/amount for free before committing to pay.",
       inputSchema: {
         type: "object",
         properties: {
-          templateId: { type: "string" },
-          attributes: { type: "object" },
-          expirationDate: { type: "string" }
+          templateId: {
+            type: "string",
+            description: `The MBI credential-definition id to issue, e.g. "did:zid:...". Take this from the x401 challenge's credential_requirements.query.credentials[].id \u2014 NOT from requirementsId (that's just a label for the requirement set, e.g. "agent-identity").`
+          },
+          attributes: {
+            type: "object",
+            description: `Claim values for the credential (schema varies by template \u2014 check what the issuer requires before guessing). "agentDid" does not need to be supplied: it is auto-filled with this wallet's own holder DID (the credential's self-referential subject) unless you explicitly override it.`
+          },
+          expirationDate: { type: "string" },
+          dryRun: {
+            type: "boolean",
+            description: "Stop after MBI's free phase-1 quote and return { quote: { asset, maxAmountRequired, payTo, requiredAttributes? } } without paying or issuing \u2014 use this to check the payment requirement AND the template's required attributes (read from chain) before spending funds."
+          }
         },
         required: ["templateId", "attributes"]
       }
@@ -22021,6 +22181,12 @@ async function main() {
   const walletBeSignerFn = (blob) => be.signBlob(blob, zetrixAddress, hsmPassword);
   const walletCfg = { privateKey: "", address: zetrixAddress, network: config2.network };
   const node = { host: config2.nodeHost, port: config2.nodePort };
+  const sdk = new import_zetrix_sdk_nodejs.default({ host: config2.nodeHost, port: config2.nodePort });
+  const contractQuery = (a) => sdk.contract.call(a);
+  const resolveSymbol = (asset) => resolveAssetSymbol(asset, contractQuery);
+  const nodeBaseUrl = `https://${config2.nodeHost}${config2.nodePort ? `:${config2.nodePort}` : ""}`;
+  const nodeMetaQuery = (url) => fetch(url, { headers: { Accept: "application/json" } }).then((r) => r.json());
+  const resolveRequiredFields = (templateId) => fetchTemplateRequiredFields(templateId, config2.templateRegistryAddress, nodeBaseUrl, nodeMetaQuery);
   const pay = (accept) => {
     assertWithinPaymentCap(accept, config2.maxPaymentAmount);
     return import_x402_zetrix_client.PaymentEngine.pay(asPayRequest(accept), walletCfg, node, {}, walletBeSignerFn);
@@ -22036,13 +22202,14 @@ async function main() {
     if (!accept) throw new Error("pay_and_fetch: 402 had no accepts[]");
     const xPayment = await pay(accept);
     const retry = await fetch(req.url, { ...init, headers: { ...req.headers ?? {}, "x-payment": xPayment } });
+    const asset = await resolveSymbol(String(accept.asset ?? ""));
     return {
       status: retry.status,
       body: await retry.text(),
       paymentMade: true,
       amountPaid: String(accept.maxAmountRequired ?? ""),
       amountPaidHuman: "",
-      asset: String(accept.asset ?? "")
+      asset
     };
   };
   const subscribeSign = (blob) => be.signBlob(blob, zetrixAddress, hsmPassword);
@@ -22062,11 +22229,11 @@ async function main() {
     config: { holderDid, zetrixAddress, network: config2.network },
     makeWallet,
     payer,
-    subscribeDeps: { mbi, sign: subscribeSign, pay },
+    subscribeDeps: { mbi, sign: subscribeSign, pay, resolveSymbol, holderDid, resolveRequiredFields },
     createAccount: (password, label, purpose) => be.createAccount(password, label, purpose)
   };
   const tools = createTools(deps);
-  const server = new Server({ name: "agentic-wallet-mcp", version: "0.1.0" }, { capabilities: { tools: {} } });
+  const server = new Server({ name: "agentic-wallet-mcp", version: packageVersion }, { capabilities: { tools: {} } });
   server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: buildToolList() }));
   server.setRequestHandler(CallToolRequestSchema, async (request) => {
     const { name, arguments: args } = request.params;

package/package.json

@@ -1,17 +1,17 @@
 {
   "name": "agentic-wallet-mcp",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "description": "Agent-facing MCP wallet for Zetrix — orchestrates x401 identity proof, x402 payment, and MBI VC issuance",
   "keywords": ["mcp", "model-context-protocol", "zetrix", "wallet", "x401", "x402", "blockchain"],
   "license": "MIT",
   "author": "MyEG Services Berhad",
-  "homepage": "https://git.myeg.com.my/genesis/zetrix-agentic-wallet",
+  "homepage": "https://github.com/Zetrix-Chain/zetrix-agentic-wallet",
   "repository": {
     "type": "git",
-    "url": "https://git.myeg.com.my/genesis/zetrix-agentic-wallet.git"
+    "url": "https://github.com/Zetrix-Chain/zetrix-agentic-wallet.git"
   },
   "bugs": {
-    "url": "https://git.myeg.com.my/genesis/zetrix-agentic-wallet/-/issues"
+    "url": "https://github.com/Zetrix-Chain/zetrix-agentic-wallet/issues"
   },
   "type": "module",
   "engines": {
@@ -34,7 +34,8 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
     "x401-zetrix-client": "^0.2.1",
-    "x402-zetrix-client": "^0.2.2"
+    "x402-zetrix-client": "^0.2.2",
+    "zetrix-sdk-nodejs": "^1.0.3"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",