agentwallet-mcp 1.10.5 → 1.10.7

package/README.md

@@ -328,6 +328,14 @@ resolve public for the check and private for the connection. The hostname is
 still used for the `Host` header and for TLS SNI and certificate validation, so
 pinning is invisible to legitimate endpoints.
 
+Credentials stay with the origin they were given to. If an endpoint redirects
+`pay_x402` to a different origin, the caller-supplied `Authorization`, `Cookie`
+and `X-PAYMENT` headers, and every other custom header, are dropped before the
+next hop; only content-negotiation headers (`Accept`, `Accept-Language`,
+`Accept-Encoding`, `User-Agent`, `Content-Type`) are carried. A redirect that
+turns a POST into a GET also sheds the body headers. Same-origin redirects keep
+everything, as a browser would.
+
 Report security issues privately to security@hifriendbot.com.
 
 ## License

package/build/index.js

@@ -424,82 +424,82 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.10.4',
+    version: '1.10.7',
 }, {
-    instructions: `AgentWallet gives AI agents their own blockchain wallets. Private keys are encrypted server-side and never exposed — agents sign and broadcast transactions without ever touching raw keys.
-
-## Getting Started
-1. Call list_wallets to see existing wallets, or create_wallet to make a new one.
-2. Fund the wallet by sending tokens to its address from an external source.
-3. Use transfer (native tokens) or transfer_token (ERC-20/SPL tokens) to send funds.
-
-## Supported Chains
-- **EVM chains:** Ethereum (1), Base (8453), Arbitrum (42161), Optimism (10), Polygon (137), Avalanche (43114), BSC (56), Zora (7777777), PulseChain (369)
-- **Solana:** Mainnet (900), Devnet (901)
-- Call get_chains for the full list with native tokens and stablecoin contract addresses.
-
-## EVM vs Solana
-- **Addresses:** EVM uses 0x-prefixed hex (42 chars). Solana uses Base58 (32-44 chars).
-- **Native tokens:** EVM = ETH/POL/BNB/etc (18 decimals, wei). Solana = SOL (9 decimals, lamports).
-- **Token standards:** EVM uses ERC-20. Solana uses SPL tokens.
-- **EVM-only tools:** approve_token, get_allowance, wrap_eth, unwrap_eth, call_contract, get_token_info. These do not work on Solana.
-- **Works on both:** create_wallet, transfer, transfer_token, send_transaction, sign_transaction, get_balance, get_token_balance.
-
-## Common Workflows
-
-### Send native tokens (ETH, SOL, etc.)
-Use the transfer tool with a human-readable amount (e.g. "0.1" ETH). It auto-converts to wei/lamports.
-
-### Send ERC-20 or SPL tokens
-Use transfer_token. You need: wallet_id, token contract address, recipient, amount, chain_id, and decimals (6 for USDC, 18 for most ERC-20s). Call get_chains to find stablecoin addresses.
-
-### Interact with DeFi (EVM only)
-1. Check allowance with get_allowance.
-2. If needed, call approve_token to let the DeFi contract spend your tokens.
-3. Use send_transaction with the contract's calldata to execute the interaction.
-
-### Wrap/unwrap native tokens (EVM only)
-Use wrap_eth to convert ETH → WETH (required by many DeFi protocols). Use unwrap_eth to convert back.
-
-### Read on-chain data (EVM only)
-Use call_contract for gas-free read-only calls (eth_call). Provide ABI-encoded calldata.
-
-## x402 Payments — Paying for Resources
-The pay_x402 tool handles the full x402 payment flow automatically:
-1. Fetches the URL.
-2. If the server returns HTTP 402, parses the payment requirements.
-3. Pays on-chain using your wallet.
-4. Retries the request with proof of payment.
-Always set max_payment to prevent overspending (e.g. "1.00" for max 1 USDC).
-
-## x402 Paywalls — Accepting Payments
-Create paywalls to charge other agents for accessing your resources:
-1. create_paywall — set price, token, chain, and the resource URL to protect.
-2. Share the access URL. Clients that pay on-chain get the resource; others get HTTP 402.
-3. list_paywalls and get_paywall_payments to track revenue.
-4. get_x402_revenue for aggregate stats across all paywalls.
-
-## Wallet Security
-- Use pause_wallet to immediately freeze a wallet if compromised. No transactions can be signed while paused.
-- Use unpause_wallet to resume operations.
-- Use delete_wallet to permanently disable a wallet.
-- Wallets have server-enforced spending limits.
-
-## Tool Selection Guide
-| Goal | Tool |
-|------|------|
-| Send ETH/SOL/native tokens | transfer |
-| Send USDC/ERC-20/SPL tokens | transfer_token |
-| Check native balance | get_balance |
-| Check token balance | get_token_balance |
-| Look up token details | get_token_info (EVM only) |
-| Approve DeFi spending | approve_token (EVM only) |
-| Check approval amount | get_allowance (EVM only) |
-| Read smart contract | call_contract (EVM only) |
-| Custom transaction | send_transaction |
-| Sign without broadcasting | sign_transaction |
-| Pay for x402 resource | pay_x402 |
-| Charge for your resource | create_paywall |
+    instructions: `AgentWallet gives AI agents their own blockchain wallets. Private keys are encrypted server-side and never exposed — agents sign and broadcast transactions without ever touching raw keys.
+
+## Getting Started
+1. Call list_wallets to see existing wallets, or create_wallet to make a new one.
+2. Fund the wallet by sending tokens to its address from an external source.
+3. Use transfer (native tokens) or transfer_token (ERC-20/SPL tokens) to send funds.
+
+## Supported Chains
+- **EVM chains:** Ethereum (1), Base (8453), Arbitrum (42161), Optimism (10), Polygon (137), Avalanche (43114), BSC (56), Zora (7777777), PulseChain (369)
+- **Solana:** Mainnet (900), Devnet (901)
+- Call get_chains for the full list with native tokens and stablecoin contract addresses.
+
+## EVM vs Solana
+- **Addresses:** EVM uses 0x-prefixed hex (42 chars). Solana uses Base58 (32-44 chars).
+- **Native tokens:** EVM = ETH/POL/BNB/etc (18 decimals, wei). Solana = SOL (9 decimals, lamports).
+- **Token standards:** EVM uses ERC-20. Solana uses SPL tokens.
+- **EVM-only tools:** approve_token, get_allowance, wrap_eth, unwrap_eth, call_contract, get_token_info. These do not work on Solana.
+- **Works on both:** create_wallet, transfer, transfer_token, send_transaction, sign_transaction, get_balance, get_token_balance.
+
+## Common Workflows
+
+### Send native tokens (ETH, SOL, etc.)
+Use the transfer tool with a human-readable amount (e.g. "0.1" ETH). It auto-converts to wei/lamports.
+
+### Send ERC-20 or SPL tokens
+Use transfer_token. You need: wallet_id, token contract address, recipient, amount, chain_id, and decimals (6 for USDC, 18 for most ERC-20s). Call get_chains to find stablecoin addresses.
+
+### Interact with DeFi (EVM only)
+1. Check allowance with get_allowance.
+2. If needed, call approve_token to let the DeFi contract spend your tokens.
+3. Use send_transaction with the contract's calldata to execute the interaction.
+
+### Wrap/unwrap native tokens (EVM only)
+Use wrap_eth to convert ETH → WETH (required by many DeFi protocols). Use unwrap_eth to convert back.
+
+### Read on-chain data (EVM only)
+Use call_contract for gas-free read-only calls (eth_call). Provide ABI-encoded calldata.
+
+## x402 Payments — Paying for Resources
+The pay_x402 tool handles the full x402 payment flow automatically:
+1. Fetches the URL.
+2. If the server returns HTTP 402, parses the payment requirements.
+3. Pays on-chain using your wallet.
+4. Retries the request with proof of payment.
+Always set max_payment to prevent overspending (e.g. "1.00" for max 1 USDC).
+
+## x402 Paywalls — Accepting Payments
+Create paywalls to charge other agents for accessing your resources:
+1. create_paywall — set price, token, chain, and the resource URL to protect.
+2. Share the access URL. Clients that pay on-chain get the resource; others get HTTP 402.
+3. list_paywalls and get_paywall_payments to track revenue.
+4. get_x402_revenue for aggregate stats across all paywalls.
+
+## Wallet Security
+- Use pause_wallet to immediately freeze a wallet if compromised. No transactions can be signed while paused.
+- Use unpause_wallet to resume operations.
+- Use delete_wallet to permanently disable a wallet.
+- Wallets have server-enforced spending limits.
+
+## Tool Selection Guide
+| Goal | Tool |
+|------|------|
+| Send ETH/SOL/native tokens | transfer |
+| Send USDC/ERC-20/SPL tokens | transfer_token |
+| Check native balance | get_balance |
+| Check token balance | get_token_balance |
+| Look up token details | get_token_info (EVM only) |
+| Approve DeFi spending | approve_token (EVM only) |
+| Check approval amount | get_allowance (EVM only) |
+| Read smart contract | call_contract (EVM only) |
+| Custom transaction | send_transaction |
+| Sign without broadcasting | sign_transaction |
+| Pay for x402 resource | pay_x402 |
+| Charge for your resource | create_paywall |
 | Check usage/billing | get_usage |`,
 });
 // ─── Tool: create_wallet ─────────────────────────────────────────
@@ -944,7 +944,9 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     url: z.string().url().describe('The URL to access (will handle 402 payment if required)'),
     wallet_id: z.number().int().describe('Wallet ID to pay from'),
     method: z.string().default('GET').describe('HTTP method (GET, POST, PUT, DELETE)'),
-    headers: z.string().optional().describe('Optional JSON string of additional request headers'),
+    headers: z.string().optional().describe('Optional JSON string of additional request headers. Credentials placed here ' +
+        '(Authorization, Cookie, API keys) are sent only to the origin in `url`; if the ' +
+        'endpoint redirects to a different origin they are dropped, not forwarded.'),
     body: z.string().optional().describe('Optional request body for POST/PUT requests'),
     max_payment: z.string().optional().describe('Maximum payment in human-readable format (e.g. "1.00" for 1 USDC). ' +
         'Rejects payments above this amount. If omitted, a default cap of ' +

package/build/ssrf-guard.d.ts

@@ -21,8 +21,14 @@
  * still used for the Host header and for TLS SNI and certificate validation,
  * so pinning is invisible to legitimate endpoints.
  *
- * Reported privately by ARC Security Research, 2026-07-31 (spelling bypasses)
- * and by an anonymous researcher, 2026-08-02 (the DNS rebinding race).
+ * Redirects are followed by hand, and a redirect to a different origin drops
+ * every caller-supplied header except a short content-negotiation list. A
+ * bearer token meant for api.example.com must not be replayed to whatever
+ * host api.example.com chooses to redirect to.
+ *
+ * Reported privately by ARC Security Research, 2026-07-31 (spelling bypasses),
+ * by an anonymous researcher, 2026-08-02 (the DNS rebinding race), and by
+ * Arthur Kijkrittaya, 2026-09-08 (credentials surviving cross-origin redirects).
  */
 /**
  * Reduce a host to the IP address it actually denotes.
@@ -64,6 +70,17 @@ type LookupCallback = (err: NodeJS.ErrnoException | null, addressOrList?: string
  * second query cannot reach the socket.
  */
 export declare function createPinnedLookup(addresses: ValidatedAddress[]): (_hostname: string, options: unknown, callback?: LookupCallback) => void;
+/** True when two URLs share scheme, host and port (the web origin). */
+export declare function sameOrigin(a: string, b: string): boolean;
+/**
+ * Decide which request headers follow a redirect from `from` to `to`.
+ *
+ * Same origin: everything is kept, as a browser would. Different origin: only
+ * CROSS_ORIGIN_SAFE_HEADERS survive. When the redirect also turned the request
+ * into a body-less GET (`bodyDropped`), the entity headers go too, on either
+ * kind of hop.
+ */
+export declare function headersForRedirect(headers: HeadersInit | undefined, from: string, to: string, bodyDropped: boolean): Record<string, string>;
 /**
  * fetch() that validates the target, and every redirect hop, against
  * resolvePublicUrl, and connects only to the addresses that validation
@@ -71,6 +88,9 @@ export declare function createPinnedLookup(addresses: ValidatedAddress[]): (_hos
  * would happily land on a private address after a public first hop, and
  * because each hop needs its own resolve-then-pin cycle.
  *
+ * Headers are re-derived on every redirect (see headersForRedirect): a hop to
+ * another origin carries no credential the caller attached for the first one.
+ *
  * The body is buffered so the pinned connection can be torn down before the
  * response is handed back.
  */

package/build/ssrf-guard.js

@@ -21,8 +21,14 @@
  * still used for the Host header and for TLS SNI and certificate validation,
  * so pinning is invisible to legitimate endpoints.
  *
- * Reported privately by ARC Security Research, 2026-07-31 (spelling bypasses)
- * and by an anonymous researcher, 2026-08-02 (the DNS rebinding race).
+ * Redirects are followed by hand, and a redirect to a different origin drops
+ * every caller-supplied header except a short content-negotiation list. A
+ * bearer token meant for api.example.com must not be replayed to whatever
+ * host api.example.com chooses to redirect to.
+ *
+ * Reported privately by ARC Security Research, 2026-07-31 (spelling bypasses),
+ * by an anonymous researcher, 2026-08-02 (the DNS rebinding race), and by
+ * Arthur Kijkrittaya, 2026-09-08 (credentials surviving cross-origin redirects).
  */
 import { isIP } from 'node:net';
 import { lookup as dnsLookup } from 'node:dns/promises';
@@ -212,6 +218,66 @@ export function createPinnedLookup(addresses) {
 }
 /** Statuses whose Response must be constructed with a null body. */
 const NULL_BODY_STATUS = new Set([101, 103, 204, 205, 304]);
+/**
+ * The only request headers that may travel to a different origin on a
+ * redirect. Everything else the caller supplied (Authorization, Cookie,
+ * X-PAYMENT, API keys under any custom name) is bound to the origin the caller
+ * addressed and is dropped. An allow list is used rather than a deny list so a
+ * secret under an unanticipated header name cannot slip through.
+ */
+const CROSS_ORIGIN_SAFE_HEADERS = new Set([
+    'accept',
+    'accept-language',
+    'accept-encoding',
+    'user-agent',
+    'content-type',
+]);
+/** Headers that describe a request body and are wrong once the body is gone. */
+const ENTITY_HEADERS = new Set(['content-type', 'content-length', 'content-encoding', 'transfer-encoding']);
+/** True when two URLs share scheme, host and port (the web origin). */
+export function sameOrigin(a, b) {
+    const ua = new URL(a);
+    const ub = new URL(b);
+    return ua.protocol === ub.protocol && ua.host === ub.host;
+}
+function headersToRecord(headers) {
+    const out = {};
+    if (!headers)
+        return out;
+    if (typeof headers.forEach === 'function' && !Array.isArray(headers)) {
+        headers.forEach((v, k) => { out[k] = v; });
+        return out;
+    }
+    if (Array.isArray(headers)) {
+        for (const [k, v] of headers)
+            out[k] = v;
+        return out;
+    }
+    for (const [k, v] of Object.entries(headers))
+        out[k] = v;
+    return out;
+}
+/**
+ * Decide which request headers follow a redirect from `from` to `to`.
+ *
+ * Same origin: everything is kept, as a browser would. Different origin: only
+ * CROSS_ORIGIN_SAFE_HEADERS survive. When the redirect also turned the request
+ * into a body-less GET (`bodyDropped`), the entity headers go too, on either
+ * kind of hop.
+ */
+export function headersForRedirect(headers, from, to, bodyDropped) {
+    const crossOrigin = !sameOrigin(from, to);
+    const out = {};
+    for (const [k, v] of Object.entries(headersToRecord(headers))) {
+        const name = k.toLowerCase();
+        if (bodyDropped && ENTITY_HEADERS.has(name))
+            continue;
+        if (crossOrigin && !CROSS_ORIGIN_SAFE_HEADERS.has(name))
+            continue;
+        out[k] = v;
+    }
+    return out;
+}
 /**
  * fetch() that validates the target, and every redirect hop, against
  * resolvePublicUrl, and connects only to the addresses that validation
@@ -219,6 +285,9 @@ const NULL_BODY_STATUS = new Set([101, 103, 204, 205, 304]);
  * would happily land on a private address after a public first hop, and
  * because each hop needs its own resolve-then-pin cycle.
  *
+ * Headers are re-derived on every redirect (see headersForRedirect): a hop to
+ * another origin carries no credential the caller attached for the first one.
+ *
  * The body is buffered so the pinned connection can be torn down before the
  * response is handed back.
  */
@@ -262,8 +331,12 @@ export async function safeFetch(url, options = {}, maxHops = 3) {
         if (!isRedirect)
             return out;
         const next = new URL(out.headers.get('location'), current).toString();
-        // A redirected request must not replay the body or method blindly.
-        if (status === 303 || ((status === 301 || status === 302) && opts.method && opts.method !== 'GET')) {
+        // A redirected request must not replay the body or method blindly, and it
+        // must not replay the caller's credentials to a different origin at all.
+        const bodyDropped = status === 303
+            || ((status === 301 || status === 302) && !!opts.method && opts.method !== 'GET');
+        opts = { ...opts, headers: headersForRedirect(opts.headers, current, next, bodyDropped) };
+        if (bodyDropped) {
             opts = { ...opts, method: 'GET', body: undefined };
         }
         current = next;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agentwallet-mcp",
   "mcpName": "io.github.hifriendbot/agentwallet",
-  "version": "1.10.5",
+  "version": "1.10.7",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",