agentwallet-mcp 1.10.3 → 1.10.4

package/README.md

@@ -320,8 +320,15 @@ All guards are active by default, no configuration required.
 each redirect hop. IP literals are canonicalized (including IPv4-mapped IPv6
 such as `[::ffff:127.0.0.1]`) and hostnames are resolved, with loopback,
 private, link-local, carrier-grade NAT, multicast and cloud-metadata
-destinations refused. Report security issues privately to
-security@hifriendbot.com.
+destinations refused.
+
+Validation and connection use the same DNS answer. Each hop resolves once, and
+the socket is pinned to an address from that answer, so a hostname cannot
+resolve public for the check and private for the connection. The hostname is
+still used for the `Host` header and for TLS SNI and certificate validation, so
+pinning is invisible to legitimate endpoints.
+
+Report security issues privately to security@hifriendbot.com.
 
 ## License
 

package/build/index.js

@@ -424,7 +424,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.10.1',
+    version: '1.10.4',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. Private keys are encrypted server-side and never exposed — agents sign and broadcast transactions without ever touching raw keys.
 
@@ -965,8 +965,10 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
         }
     }
     // Validate URL: canonicalizes IP literals (including IPv4-mapped IPv6) and
-    // resolves DNS names, rejecting any private/internal destination. Redirect
-    // hops are re-validated by safeFetch below.
+    // resolves DNS names, rejecting any private/internal destination. An early
+    // check here gives a clear error before any request is built; safeFetch
+    // below re-validates every hop and pins each connection to the addresses it
+    // validated, so DNS cannot be rebound between the check and the connect.
     await assertPublicUrl(url);
     // Step 1: Make initial request
     const reqOptions = {

package/build/ssrf-guard.d.ts

@@ -1,8 +1,8 @@
 /**
  * SSRF guard for outbound x402 requests.
  *
- * The previous guard compared `new URL(url).hostname` against literal strings
- * and dotted-decimal prefixes. That misses every alternate spelling of a
+ * The original guard compared `new URL(url).hostname` against literal strings
+ * and dotted-decimal prefixes. That missed every alternate spelling of a
  * private destination: IPv4-mapped IPv6 (`[::ffff:127.0.0.1]` parses to
  * `[::ffff:7f00:1]`), the rest of 127.0.0.0/8, IPv6 unique-local and
  * link-local, the whole 169.254.0.0/16 link-local range rather than only the
@@ -12,7 +12,17 @@
  * against numeric ranges, then resolves DNS names and applies the same test to
  * every answer, so a public name pointing at a private address is refused too.
  *
- * Reported privately by ARC Security Research, 2026-07-31.
+ * Validating a name is not enough on its own. If the request is then handed to
+ * fetch() as a URL, the name is resolved a second time by the HTTP client, and
+ * an attacker who controls the authoritative DNS can answer public for the
+ * check and private for the connection. So `safeFetch` pins the connection to
+ * the exact addresses that were validated: the resolver runs once, and the
+ * socket is only allowed to reach an address from that answer. The hostname is
+ * still used for the Host header and for TLS SNI and certificate validation,
+ * so pinning is invisible to legitimate endpoints.
+ *
+ * Reported privately by ARC Security Research, 2026-07-31 (spelling bypasses)
+ * and by an anonymous researcher, 2026-08-02 (the DNS rebinding race).
  */
 /**
  * Reduce a host to the IP address it actually denotes.
@@ -24,15 +34,45 @@ export declare function canonicalizeHost(hostRaw: string): {
 };
 /** True when the address is loopback, private, link-local, multicast or reserved. */
 export declare function isPrivateAddress(ipRaw: string): boolean;
+/** An address that passed validation and is therefore allowed to be connected to. */
+export type ValidatedAddress = {
+    address: string;
+    family: 4 | 6;
+};
+/**
+ * Validate `url` and return the exact set of addresses a connection to it is
+ * allowed to use. DNS names are resolved once here; that single answer is both
+ * what gets checked and what gets connected to, which is what removes the
+ * time-of-check/time-of-use gap.
+ *
+ * Throws unless the URL is https and every address it denotes is public.
+ */
+export declare function resolvePublicUrl(url: string): Promise<{
+    target: URL;
+    addresses: ValidatedAddress[];
+}>;
 /**
  * Throw unless `url` is an https URL pointing at a public destination.
- * DNS names are resolved and every answer is checked, so a public name that
- * maps to a private address is rejected.
+ * Kept for callers that only want the check and not the resolved addresses.
  */
 export declare function assertPublicUrl(url: string): Promise<void>;
+type LookupCallback = (err: NodeJS.ErrnoException | null, addressOrList?: string | ValidatedAddress[], family?: number) => void;
+/**
+ * A drop-in replacement for dns.lookup that answers only from an already
+ * validated set and never queries a resolver. Handing this to the socket layer
+ * is what pins the connection: whatever the authoritative server says on a
+ * second query cannot reach the socket.
+ */
+export declare function createPinnedLookup(addresses: ValidatedAddress[]): (_hostname: string, options: unknown, callback?: LookupCallback) => void;
 /**
  * fetch() that validates the target, and every redirect hop, against
- * assertPublicUrl. Redirects are followed manually because the automatic
- * follower would happily land on a private address after a public first hop.
+ * resolvePublicUrl, and connects only to the addresses that validation
+ * returned. Redirects are followed manually because the automatic follower
+ * would happily land on a private address after a public first hop, and
+ * because each hop needs its own resolve-then-pin cycle.
+ *
+ * The body is buffered so the pinned connection can be torn down before the
+ * response is handed back.
  */
 export declare function safeFetch(url: string, options?: RequestInit, maxHops?: number): Promise<Response>;
+export {};

package/build/ssrf-guard.js

@@ -1,8 +1,8 @@
 /**
  * SSRF guard for outbound x402 requests.
  *
- * The previous guard compared `new URL(url).hostname` against literal strings
- * and dotted-decimal prefixes. That misses every alternate spelling of a
+ * The original guard compared `new URL(url).hostname` against literal strings
+ * and dotted-decimal prefixes. That missed every alternate spelling of a
  * private destination: IPv4-mapped IPv6 (`[::ffff:127.0.0.1]` parses to
  * `[::ffff:7f00:1]`), the rest of 127.0.0.0/8, IPv6 unique-local and
  * link-local, the whole 169.254.0.0/16 link-local range rather than only the
@@ -12,10 +12,21 @@
  * against numeric ranges, then resolves DNS names and applies the same test to
  * every answer, so a public name pointing at a private address is refused too.
  *
- * Reported privately by ARC Security Research, 2026-07-31.
+ * Validating a name is not enough on its own. If the request is then handed to
+ * fetch() as a URL, the name is resolved a second time by the HTTP client, and
+ * an attacker who controls the authoritative DNS can answer public for the
+ * check and private for the connection. So `safeFetch` pins the connection to
+ * the exact addresses that were validated: the resolver runs once, and the
+ * socket is only allowed to reach an address from that answer. The hostname is
+ * still used for the Host header and for TLS SNI and certificate validation,
+ * so pinning is invisible to legitimate endpoints.
+ *
+ * Reported privately by ARC Security Research, 2026-07-31 (spelling bypasses)
+ * and by an anonymous researcher, 2026-08-02 (the DNS rebinding race).
  */
 import { isIP } from 'node:net';
-import { lookup } from 'node:dns/promises';
+import { lookup as dnsLookup } from 'node:dns/promises';
+import { Agent, fetch as undiciFetch } from 'undici';
 /** Hostnames that must never be reached regardless of what they resolve to. */
 const BLOCKED_NAMES = new Set([
     'localhost',
@@ -111,11 +122,14 @@ export function isPrivateAddress(ipRaw) {
     return false;
 }
 /**
- * Throw unless `url` is an https URL pointing at a public destination.
- * DNS names are resolved and every answer is checked, so a public name that
- * maps to a private address is rejected.
+ * Validate `url` and return the exact set of addresses a connection to it is
+ * allowed to use. DNS names are resolved once here; that single answer is both
+ * what gets checked and what gets connected to, which is what removes the
+ * time-of-check/time-of-use gap.
+ *
+ * Throws unless the URL is https and every address it denotes is public.
  */
-export async function assertPublicUrl(url) {
+export async function resolvePublicUrl(url) {
     let u;
     try {
         u = new URL(url);
@@ -136,41 +150,121 @@ export async function assertPublicUrl(url) {
         if (isPrivateAddress(ip)) {
             throw new Error('URL points to a private/internal address. Only public URLs are allowed.');
         }
-        return;
+        // An IP literal is never resolved, so there is nothing to rebind: the
+        // socket layer connects to the literal we just checked.
+        return { target: u, addresses: [{ address: ip, family }] };
     }
     // A name: every address it resolves to must be public.
     let answers;
     try {
-        answers = await lookup(bare, { all: true });
+        answers = await dnsLookup(bare, { all: true });
     }
     catch {
         throw new Error(`Could not resolve host "${bare}".`);
     }
     if (!answers.length)
         throw new Error(`Could not resolve host "${bare}".`);
+    const addresses = [];
     for (const a of answers) {
         if (isPrivateAddress(a.address)) {
             throw new Error('URL resolves to a private/internal address. Only public URLs are allowed.');
         }
+        addresses.push({ address: a.address, family: a.family === 6 ? 6 : 4 });
     }
+    return { target: u, addresses };
+}
+/**
+ * Throw unless `url` is an https URL pointing at a public destination.
+ * Kept for callers that only want the check and not the resolved addresses.
+ */
+export async function assertPublicUrl(url) {
+    await resolvePublicUrl(url);
+}
+/**
+ * A drop-in replacement for dns.lookup that answers only from an already
+ * validated set and never queries a resolver. Handing this to the socket layer
+ * is what pins the connection: whatever the authoritative server says on a
+ * second query cannot reach the socket.
+ */
+export function createPinnedLookup(addresses) {
+    const pinned = addresses.slice();
+    return function pinnedLookup(_hostname, options, callback) {
+        const cb = (typeof options === 'function' ? options : callback);
+        const opts = (typeof options === 'object' && options !== null ? options : {});
+        let list = pinned;
+        if (opts.family === 4 || opts.family === 6) {
+            list = pinned.filter(a => a.family === opts.family);
+        }
+        queueMicrotask(() => {
+            if (!list.length) {
+                const err = new Error('No validated address is available for this host.');
+                err.code = 'ENOTFOUND';
+                cb(err);
+                return;
+            }
+            if (opts.all) {
+                cb(null, list.map(a => ({ address: a.address, family: a.family })));
+                return;
+            }
+            cb(null, list[0].address, list[0].family);
+        });
+    };
 }
+/** Statuses whose Response must be constructed with a null body. */
+const NULL_BODY_STATUS = new Set([101, 103, 204, 205, 304]);
 /**
  * fetch() that validates the target, and every redirect hop, against
- * assertPublicUrl. Redirects are followed manually because the automatic
- * follower would happily land on a private address after a public first hop.
+ * resolvePublicUrl, and connects only to the addresses that validation
+ * returned. Redirects are followed manually because the automatic follower
+ * would happily land on a private address after a public first hop, and
+ * because each hop needs its own resolve-then-pin cycle.
+ *
+ * The body is buffered so the pinned connection can be torn down before the
+ * response is handed back.
  */
 export async function safeFetch(url, options = {}, maxHops = 3) {
     let current = url;
+    let opts = options;
     for (let hop = 0; hop <= maxHops; hop++) {
-        await assertPublicUrl(current);
-        const res = await fetch(current, { ...options, redirect: 'manual' });
-        const isRedirect = res.status >= 300 && res.status < 400 && res.headers.has('location');
+        const { addresses } = await resolvePublicUrl(current);
+        // One agent per hop, carrying that hop's pinned addresses. The hostname is
+        // untouched, so Host and TLS SNI/certificate validation still use the name.
+        const agent = new Agent({
+            connect: { lookup: createPinnedLookup(addresses) },
+        });
+        let status;
+        let statusText;
+        let headers;
+        let body;
+        try {
+            const res = await undiciFetch(current, {
+                ...opts,
+                redirect: 'manual',
+                dispatcher: agent,
+            });
+            status = res.status;
+            statusText = res.statusText;
+            headers = [];
+            for (const [k, v] of res.headers) {
+                // The body below is already decoded, so the transfer-level description
+                // of it would be wrong if carried over.
+                if (k === 'content-encoding' || k === 'content-length')
+                    continue;
+                headers.push([k, v]);
+            }
+            body = NULL_BODY_STATUS.has(status) ? null : await res.arrayBuffer();
+        }
+        finally {
+            await agent.destroy();
+        }
+        const out = new Response(body, { status, statusText, headers });
+        const isRedirect = status >= 300 && status < 400 && out.headers.has('location');
         if (!isRedirect)
-            return res;
-        const next = new URL(res.headers.get('location'), current).toString();
+            return out;
+        const next = new URL(out.headers.get('location'), current).toString();
         // A redirected request must not replay the body or method blindly.
-        if (res.status === 303 || ((res.status === 301 || res.status === 302) && options.method && options.method !== 'GET')) {
-            options = { ...options, method: 'GET', body: undefined };
+        if (status === 303 || ((status === 301 || status === 302) && opts.method && opts.method !== 'GET')) {
+            opts = { ...opts, method: 'GET', body: undefined };
         }
         current = next;
     }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agentwallet-mcp",
   "mcpName": "io.github.hifriendbot/agentwallet",
-  "version": "1.10.3",
+  "version": "1.10.4",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",
@@ -58,6 +58,7 @@
     "@modelcontextprotocol/sdk": "^1.11.4",
     "@solana/web3.js": "^1.98.4",
     "bs58": "^6.0.0",
+    "undici": "^8.9.0",
     "viem": "^2.55.10",
     "zod": "^3.24.0"
   },