agentwallet-mcp 1.10.2 → 1.10.4

package/README.md

@@ -320,8 +320,15 @@ All guards are active by default, no configuration required.
 each redirect hop. IP literals are canonicalized (including IPv4-mapped IPv6
 such as `[::ffff:127.0.0.1]`) and hostnames are resolved, with loopback,
 private, link-local, carrier-grade NAT, multicast and cloud-metadata
-destinations refused. Report security issues privately to
-security@hifriendbot.com.
+destinations refused.
+
+Validation and connection use the same DNS answer. Each hop resolves once, and
+the socket is pinned to an address from that answer, so a hostname cannot
+resolve public for the check and private for the connection. The hostname is
+still used for the `Host` header and for TLS SNI and certificate validation, so
+pinning is invisible to legitimate endpoints.
+
+Report security issues privately to security@hifriendbot.com.
 
 ## License
 

package/build/index.js

@@ -410,9 +410,21 @@ function resolveChainId(network) {
     return null;
 }
 // ─── Server ──────────────────────────────────────────────────────
+/**
+ * Destination address shape, EVM or Solana.
+ *
+ * The contract-address params were regex-guarded but the DESTINATION on every
+ * transfer tool was a bare z.string(), so a truncated or mistyped address went
+ * straight into a signed transaction. On-chain sends are irreversible, and the
+ * chain will happily accept any well-formed address, so the cheapest place to
+ * catch a malformed one is before it is signed. This does not validate the
+ * EIP-55 checksum, only the shape; a wrong-but-well-formed address is still the
+ * caller's responsibility.
+ */
+const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.10.1',
+    version: '1.10.4',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. Private keys are encrypted server-side and never exposed — agents sign and broadcast transactions without ever touching raw keys.
 
@@ -528,7 +540,7 @@ server.tool('sign_transaction', 'Sign a transaction with a wallet\'s private key
     'For EVM: returns signed raw transaction hex. For Solana: returns base64 signed transaction. ' +
     'Does NOT broadcast — use send_transaction for sign + broadcast.', {
     wallet_id: z.number().int().describe('Wallet ID'),
-    to: z.string().describe('Destination address (0x-prefixed for EVM, Base58 for Solana)'),
+    to: AddressSchema.describe('Destination address (0x-prefixed for EVM, Base58 for Solana)'),
     chain_id: z.number().int().optional().describe('Chain ID (defaults to wallet\'s default)'),
     value: z.string().default('0').describe('Value in wei/lamports (decimal string)'),
     data: z.string().default('').describe('Hex-encoded calldata (0x-prefixed) for EVM contract calls'),
@@ -570,7 +582,7 @@ server.tool('send_transaction', 'Sign and broadcast a transaction. ' +
     'Returns the transaction hash (EVM) or signature (Solana) on success. ' +
     'The transaction is signed server-side and broadcast via RPC.', {
     wallet_id: z.number().int().describe('Wallet ID'),
-    to: z.string().describe('Destination address (0x-prefixed for EVM, Base58 for Solana)'),
+    to: AddressSchema.describe('Destination address (0x-prefixed for EVM, Base58 for Solana)'),
     chain_id: z.number().int().optional().describe('Chain ID (defaults to wallet\'s default)'),
     value: z.string().default('0').describe('Value in wei/lamports (decimal string)'),
     data: z.string().default('').describe('Hex-encoded calldata (0x-prefixed) for EVM contract calls'),
@@ -612,7 +624,7 @@ server.tool('transfer', 'Send native tokens (ETH, AVAX, BNB, POL, PLS, SOL) to a
     'Specify the amount in human-readable format (e.g. "0.1" for 0.1 ETH). ' +
     'The amount is converted to wei/lamports automatically. Signs and broadcasts the transaction.', {
     wallet_id: z.number().int().describe('Wallet ID to send from'),
-    to: z.string().describe('Destination address (0x-prefixed for EVM, Base58 for Solana)'),
+    to: AddressSchema.describe('Destination address (0x-prefixed for EVM, Base58 for Solana)'),
     amount: z.string().describe('Amount to send in human-readable format (e.g. "0.1" for 0.1 ETH)'),
     chain_id: z.number().int().describe('Chain ID (1=Ethereum, 8453=Base, 42161=Arbitrum, 10=Optimism, 137=Polygon, 43114=Avalanche, 56=BSC, 7777777=Zora, 369=PulseChain, 900=Solana, 901=Solana Devnet)'),
 }, async ({ wallet_id, to, amount, chain_id }) => {
@@ -675,7 +687,7 @@ server.tool('transfer_token', 'Send ERC-20 tokens (EVM) or SPL tokens (Solana) t
     'Signs and broadcasts the transaction. Use get_chains to find stablecoin addresses.', {
     wallet_id: z.number().int().describe('Wallet ID to send from'),
     token: z.string().describe('Token address (0x-prefixed ERC-20 contract for EVM, Base58 mint for Solana)'),
-    to: z.string().describe('Recipient address (0x-prefixed for EVM, Base58 for Solana)'),
+    to: AddressSchema.describe('Recipient address (0x-prefixed for EVM, Base58 for Solana)'),
     amount: z.string().describe('Amount in human-readable format (e.g. "100" for 100 USDC)'),
     chain_id: z.number().int().describe('Chain ID'),
     decimals: z.number().int().default(18).describe('Token decimals (6 for USDC, 18 for most tokens)'),
@@ -953,8 +965,10 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
         }
     }
     // Validate URL: canonicalizes IP literals (including IPv4-mapped IPv6) and
-    // resolves DNS names, rejecting any private/internal destination. Redirect
-    // hops are re-validated by safeFetch below.
+    // resolves DNS names, rejecting any private/internal destination. An early
+    // check here gives a clear error before any request is built; safeFetch
+    // below re-validates every hop and pins each connection to the addresses it
+    // validated, so DNS cannot be rebound between the check and the connect.
     await assertPublicUrl(url);
     // Step 1: Make initial request
     const reqOptions = {

package/build/local-solana.js

@@ -14,6 +14,7 @@
 import { readFileSync } from 'node:fs';
 import { Connection, Keypair, PublicKey, SystemProgram, Transaction, TransactionInstruction, sendAndConfirmTransaction, LAMPORTS_PER_SOL, } from '@solana/web3.js';
 import bs58 from 'bs58';
+import { lookupTrustedDecimals } from './x402-payment.js';
 /* ── Program IDs ─────────────────────────────────────────────────── */
 const TOKEN_PROGRAM = new PublicKey('TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA');
 const TOKEN_2022_PROGRAM = new PublicKey('TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb');
@@ -114,6 +115,34 @@ function assertWithinSolCap(lamports) {
         throw new Error(`Blocked by local guard: amount exceeds AGENTWALLET_MAX_TX_SOL (${cap} SOL).`);
     }
 }
+/**
+ * Bound SPL movement. AGENTWALLET_MAX_TX_SOL only ever covered native SOL, so
+ * an SPL transfer, which is how USDC moves on Solana and the whole point of the
+ * x402 rail here, went out with no local ceiling at all. Mirrors
+ * AGENTWALLET_MAX_TX_TOKEN on the EVM side and uses the same variable so an
+ * operator sets one token cap, not one per chain family.
+ *
+ * Decimals for the cap come from the trusted table when the mint is known.
+ * The caller-supplied value is not used for the ceiling: an inflated one would
+ * inflate the cap exactly like the x402 bypass. When the mint is unknown we
+ * assume 6, the tightest common value, so it fails closed.
+ */
+function assertWithinSplCap(mint, rawAmount) {
+    const cap = (process.env.AGENTWALLET_MAX_TX_TOKEN || '').trim();
+    if (!cap)
+        return;
+    if (!/^\d+(\.\d+)?$/.test(cap)) {
+        throw new Error(`AGENTWALLET_MAX_TX_TOKEN must be a decimal number, got "${cap}".`);
+    }
+    const decimals = lookupTrustedDecimals(900, mint) ?? 6;
+    const [whole, frac = ''] = cap.split('.');
+    const capRaw = BigInt(whole + frac.padEnd(decimals, '0').slice(0, decimals));
+    if (rawAmount > capRaw) {
+        throw new Error(`Blocked by local guard: SPL transfer of ${rawAmount} base units exceeds ` +
+            `AGENTWALLET_MAX_TX_TOKEN (${cap}, evaluated at ${decimals} decimals). ` +
+            `Raise the cap deliberately if this is intended.`);
+    }
+}
 /* ── Reads ───────────────────────────────────────────────────────── */
 export async function localSolBalance(chainId = 900) {
     const conn = connection(chainId);
@@ -161,6 +190,11 @@ export async function localSplBalance(mintStr, chainId = 900) {
 export async function localSolTransfer(to, lamports, chainId = 900) {
     const amount = BigInt(lamports);
     assertWithinSolCap(amount);
+    // Number() silently loses precision past 2**53 lamports. Refuse rather than
+    // sign a transaction for an amount other than the one that was requested.
+    if (amount > BigInt(Number.MAX_SAFE_INTEGER)) {
+        throw new Error(`Amount ${lamports} lamports exceeds safe integer range and was refused.`);
+    }
     const conn = connection(chainId);
     const payer = getSolanaKeypair();
     const tx = new Transaction().add(SystemProgram.transfer({
@@ -216,6 +250,9 @@ function createAtaIdempotentIx(payer, ata, owner, mint, tokenProgram) {
  * not exist, using the idempotent instruction so a race cannot fail the send.
  */
 export async function localSplTransfer(mintStr, to, rawAmount, decimals, chainId = 900) {
+    // Checked before any RPC round trip: a blocked transfer should cost nothing
+    // and should not announce itself to the RPC provider first.
+    assertWithinSplCap(mintStr, BigInt(rawAmount));
     const conn = connection(chainId);
     const payer = getSolanaKeypair();
     const mint = new PublicKey(mintStr);

package/build/ssrf-guard.d.ts

@@ -1,8 +1,8 @@
 /**
  * SSRF guard for outbound x402 requests.
  *
- * The previous guard compared `new URL(url).hostname` against literal strings
- * and dotted-decimal prefixes. That misses every alternate spelling of a
+ * The original guard compared `new URL(url).hostname` against literal strings
+ * and dotted-decimal prefixes. That missed every alternate spelling of a
  * private destination: IPv4-mapped IPv6 (`[::ffff:127.0.0.1]` parses to
  * `[::ffff:7f00:1]`), the rest of 127.0.0.0/8, IPv6 unique-local and
  * link-local, the whole 169.254.0.0/16 link-local range rather than only the
@@ -12,7 +12,17 @@
  * against numeric ranges, then resolves DNS names and applies the same test to
  * every answer, so a public name pointing at a private address is refused too.
  *
- * Reported privately by ARC Security Research, 2026-07-31.
+ * Validating a name is not enough on its own. If the request is then handed to
+ * fetch() as a URL, the name is resolved a second time by the HTTP client, and
+ * an attacker who controls the authoritative DNS can answer public for the
+ * check and private for the connection. So `safeFetch` pins the connection to
+ * the exact addresses that were validated: the resolver runs once, and the
+ * socket is only allowed to reach an address from that answer. The hostname is
+ * still used for the Host header and for TLS SNI and certificate validation,
+ * so pinning is invisible to legitimate endpoints.
+ *
+ * Reported privately by ARC Security Research, 2026-07-31 (spelling bypasses)
+ * and by an anonymous researcher, 2026-08-02 (the DNS rebinding race).
  */
 /**
  * Reduce a host to the IP address it actually denotes.
@@ -24,15 +34,45 @@ export declare function canonicalizeHost(hostRaw: string): {
 };
 /** True when the address is loopback, private, link-local, multicast or reserved. */
 export declare function isPrivateAddress(ipRaw: string): boolean;
+/** An address that passed validation and is therefore allowed to be connected to. */
+export type ValidatedAddress = {
+    address: string;
+    family: 4 | 6;
+};
+/**
+ * Validate `url` and return the exact set of addresses a connection to it is
+ * allowed to use. DNS names are resolved once here; that single answer is both
+ * what gets checked and what gets connected to, which is what removes the
+ * time-of-check/time-of-use gap.
+ *
+ * Throws unless the URL is https and every address it denotes is public.
+ */
+export declare function resolvePublicUrl(url: string): Promise<{
+    target: URL;
+    addresses: ValidatedAddress[];
+}>;
 /**
  * Throw unless `url` is an https URL pointing at a public destination.
- * DNS names are resolved and every answer is checked, so a public name that
- * maps to a private address is rejected.
+ * Kept for callers that only want the check and not the resolved addresses.
  */
 export declare function assertPublicUrl(url: string): Promise<void>;
+type LookupCallback = (err: NodeJS.ErrnoException | null, addressOrList?: string | ValidatedAddress[], family?: number) => void;
+/**
+ * A drop-in replacement for dns.lookup that answers only from an already
+ * validated set and never queries a resolver. Handing this to the socket layer
+ * is what pins the connection: whatever the authoritative server says on a
+ * second query cannot reach the socket.
+ */
+export declare function createPinnedLookup(addresses: ValidatedAddress[]): (_hostname: string, options: unknown, callback?: LookupCallback) => void;
 /**
  * fetch() that validates the target, and every redirect hop, against
- * assertPublicUrl. Redirects are followed manually because the automatic
- * follower would happily land on a private address after a public first hop.
+ * resolvePublicUrl, and connects only to the addresses that validation
+ * returned. Redirects are followed manually because the automatic follower
+ * would happily land on a private address after a public first hop, and
+ * because each hop needs its own resolve-then-pin cycle.
+ *
+ * The body is buffered so the pinned connection can be torn down before the
+ * response is handed back.
  */
 export declare function safeFetch(url: string, options?: RequestInit, maxHops?: number): Promise<Response>;
+export {};

package/build/ssrf-guard.js

@@ -1,8 +1,8 @@
 /**
  * SSRF guard for outbound x402 requests.
  *
- * The previous guard compared `new URL(url).hostname` against literal strings
- * and dotted-decimal prefixes. That misses every alternate spelling of a
+ * The original guard compared `new URL(url).hostname` against literal strings
+ * and dotted-decimal prefixes. That missed every alternate spelling of a
  * private destination: IPv4-mapped IPv6 (`[::ffff:127.0.0.1]` parses to
  * `[::ffff:7f00:1]`), the rest of 127.0.0.0/8, IPv6 unique-local and
  * link-local, the whole 169.254.0.0/16 link-local range rather than only the
@@ -12,10 +12,21 @@
  * against numeric ranges, then resolves DNS names and applies the same test to
  * every answer, so a public name pointing at a private address is refused too.
  *
- * Reported privately by ARC Security Research, 2026-07-31.
+ * Validating a name is not enough on its own. If the request is then handed to
+ * fetch() as a URL, the name is resolved a second time by the HTTP client, and
+ * an attacker who controls the authoritative DNS can answer public for the
+ * check and private for the connection. So `safeFetch` pins the connection to
+ * the exact addresses that were validated: the resolver runs once, and the
+ * socket is only allowed to reach an address from that answer. The hostname is
+ * still used for the Host header and for TLS SNI and certificate validation,
+ * so pinning is invisible to legitimate endpoints.
+ *
+ * Reported privately by ARC Security Research, 2026-07-31 (spelling bypasses)
+ * and by an anonymous researcher, 2026-08-02 (the DNS rebinding race).
  */
 import { isIP } from 'node:net';
-import { lookup } from 'node:dns/promises';
+import { lookup as dnsLookup } from 'node:dns/promises';
+import { Agent, fetch as undiciFetch } from 'undici';
 /** Hostnames that must never be reached regardless of what they resolve to. */
 const BLOCKED_NAMES = new Set([
     'localhost',
@@ -111,11 +122,14 @@ export function isPrivateAddress(ipRaw) {
     return false;
 }
 /**
- * Throw unless `url` is an https URL pointing at a public destination.
- * DNS names are resolved and every answer is checked, so a public name that
- * maps to a private address is rejected.
+ * Validate `url` and return the exact set of addresses a connection to it is
+ * allowed to use. DNS names are resolved once here; that single answer is both
+ * what gets checked and what gets connected to, which is what removes the
+ * time-of-check/time-of-use gap.
+ *
+ * Throws unless the URL is https and every address it denotes is public.
  */
-export async function assertPublicUrl(url) {
+export async function resolvePublicUrl(url) {
     let u;
     try {
         u = new URL(url);
@@ -136,41 +150,121 @@ export async function assertPublicUrl(url) {
         if (isPrivateAddress(ip)) {
             throw new Error('URL points to a private/internal address. Only public URLs are allowed.');
         }
-        return;
+        // An IP literal is never resolved, so there is nothing to rebind: the
+        // socket layer connects to the literal we just checked.
+        return { target: u, addresses: [{ address: ip, family }] };
     }
     // A name: every address it resolves to must be public.
     let answers;
     try {
-        answers = await lookup(bare, { all: true });
+        answers = await dnsLookup(bare, { all: true });
     }
     catch {
         throw new Error(`Could not resolve host "${bare}".`);
     }
     if (!answers.length)
         throw new Error(`Could not resolve host "${bare}".`);
+    const addresses = [];
     for (const a of answers) {
         if (isPrivateAddress(a.address)) {
             throw new Error('URL resolves to a private/internal address. Only public URLs are allowed.');
         }
+        addresses.push({ address: a.address, family: a.family === 6 ? 6 : 4 });
     }
+    return { target: u, addresses };
+}
+/**
+ * Throw unless `url` is an https URL pointing at a public destination.
+ * Kept for callers that only want the check and not the resolved addresses.
+ */
+export async function assertPublicUrl(url) {
+    await resolvePublicUrl(url);
+}
+/**
+ * A drop-in replacement for dns.lookup that answers only from an already
+ * validated set and never queries a resolver. Handing this to the socket layer
+ * is what pins the connection: whatever the authoritative server says on a
+ * second query cannot reach the socket.
+ */
+export function createPinnedLookup(addresses) {
+    const pinned = addresses.slice();
+    return function pinnedLookup(_hostname, options, callback) {
+        const cb = (typeof options === 'function' ? options : callback);
+        const opts = (typeof options === 'object' && options !== null ? options : {});
+        let list = pinned;
+        if (opts.family === 4 || opts.family === 6) {
+            list = pinned.filter(a => a.family === opts.family);
+        }
+        queueMicrotask(() => {
+            if (!list.length) {
+                const err = new Error('No validated address is available for this host.');
+                err.code = 'ENOTFOUND';
+                cb(err);
+                return;
+            }
+            if (opts.all) {
+                cb(null, list.map(a => ({ address: a.address, family: a.family })));
+                return;
+            }
+            cb(null, list[0].address, list[0].family);
+        });
+    };
 }
+/** Statuses whose Response must be constructed with a null body. */
+const NULL_BODY_STATUS = new Set([101, 103, 204, 205, 304]);
 /**
  * fetch() that validates the target, and every redirect hop, against
- * assertPublicUrl. Redirects are followed manually because the automatic
- * follower would happily land on a private address after a public first hop.
+ * resolvePublicUrl, and connects only to the addresses that validation
+ * returned. Redirects are followed manually because the automatic follower
+ * would happily land on a private address after a public first hop, and
+ * because each hop needs its own resolve-then-pin cycle.
+ *
+ * The body is buffered so the pinned connection can be torn down before the
+ * response is handed back.
  */
 export async function safeFetch(url, options = {}, maxHops = 3) {
     let current = url;
+    let opts = options;
     for (let hop = 0; hop <= maxHops; hop++) {
-        await assertPublicUrl(current);
-        const res = await fetch(current, { ...options, redirect: 'manual' });
-        const isRedirect = res.status >= 300 && res.status < 400 && res.headers.has('location');
+        const { addresses } = await resolvePublicUrl(current);
+        // One agent per hop, carrying that hop's pinned addresses. The hostname is
+        // untouched, so Host and TLS SNI/certificate validation still use the name.
+        const agent = new Agent({
+            connect: { lookup: createPinnedLookup(addresses) },
+        });
+        let status;
+        let statusText;
+        let headers;
+        let body;
+        try {
+            const res = await undiciFetch(current, {
+                ...opts,
+                redirect: 'manual',
+                dispatcher: agent,
+            });
+            status = res.status;
+            statusText = res.statusText;
+            headers = [];
+            for (const [k, v] of res.headers) {
+                // The body below is already decoded, so the transfer-level description
+                // of it would be wrong if carried over.
+                if (k === 'content-encoding' || k === 'content-length')
+                    continue;
+                headers.push([k, v]);
+            }
+            body = NULL_BODY_STATUS.has(status) ? null : await res.arrayBuffer();
+        }
+        finally {
+            await agent.destroy();
+        }
+        const out = new Response(body, { status, statusText, headers });
+        const isRedirect = status >= 300 && status < 400 && out.headers.has('location');
         if (!isRedirect)
-            return res;
-        const next = new URL(res.headers.get('location'), current).toString();
+            return out;
+        const next = new URL(out.headers.get('location'), current).toString();
         // A redirected request must not replay the body or method blindly.
-        if (res.status === 303 || ((res.status === 301 || res.status === 302) && options.method && options.method !== 'GET')) {
-            options = { ...options, method: 'GET', body: undefined };
+        if (status === 303 || ((status === 301 || status === 302) && opts.method && opts.method !== 'GET')) {
+            opts = { ...opts, method: 'GET', body: undefined };
         }
         current = next;
     }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agentwallet-mcp",
   "mcpName": "io.github.hifriendbot/agentwallet",
-  "version": "1.10.2",
+  "version": "1.10.4",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",
@@ -16,7 +16,7 @@
   "scripts": {
     "build": "tsc",
     "start": "node build/index.js",
-    "test": "node test/x402-payment.test.mjs && node test/token-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs",
+    "test": "node test/x402-payment.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs",
     "prepublishOnly": "npm run build"
   },
   "keywords": [
@@ -58,6 +58,7 @@
     "@modelcontextprotocol/sdk": "^1.11.4",
     "@solana/web3.js": "^1.98.4",
     "bs58": "^6.0.0",
+    "undici": "^8.9.0",
     "viem": "^2.55.10",
     "zod": "^3.24.0"
   },