agentwallet-mcp 1.10.6 → 1.10.7

package/README.md

@@ -328,6 +328,14 @@ resolve public for the check and private for the connection. The hostname is
 still used for the `Host` header and for TLS SNI and certificate validation, so
 pinning is invisible to legitimate endpoints.
 
+Credentials stay with the origin they were given to. If an endpoint redirects
+`pay_x402` to a different origin, the caller-supplied `Authorization`, `Cookie`
+and `X-PAYMENT` headers, and every other custom header, are dropped before the
+next hop; only content-negotiation headers (`Accept`, `Accept-Language`,
+`Accept-Encoding`, `User-Agent`, `Content-Type`) are carried. A redirect that
+turns a POST into a GET also sheds the body headers. Same-origin redirects keep
+everything, as a browser would.
+
 Report security issues privately to security@hifriendbot.com.
 
 ## License

package/build/index.js

@@ -424,7 +424,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.10.6',
+    version: '1.10.7',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. Private keys are encrypted server-side and never exposed — agents sign and broadcast transactions without ever touching raw keys.
 
@@ -944,7 +944,9 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     url: z.string().url().describe('The URL to access (will handle 402 payment if required)'),
     wallet_id: z.number().int().describe('Wallet ID to pay from'),
     method: z.string().default('GET').describe('HTTP method (GET, POST, PUT, DELETE)'),
-    headers: z.string().optional().describe('Optional JSON string of additional request headers'),
+    headers: z.string().optional().describe('Optional JSON string of additional request headers. Credentials placed here ' +
+        '(Authorization, Cookie, API keys) are sent only to the origin in `url`; if the ' +
+        'endpoint redirects to a different origin they are dropped, not forwarded.'),
     body: z.string().optional().describe('Optional request body for POST/PUT requests'),
     max_payment: z.string().optional().describe('Maximum payment in human-readable format (e.g. "1.00" for 1 USDC). ' +
         'Rejects payments above this amount. If omitted, a default cap of ' +

package/build/ssrf-guard.d.ts

@@ -21,8 +21,14 @@
  * still used for the Host header and for TLS SNI and certificate validation,
  * so pinning is invisible to legitimate endpoints.
  *
- * Reported privately by ARC Security Research, 2026-07-31 (spelling bypasses)
- * and by an anonymous researcher, 2026-08-02 (the DNS rebinding race).
+ * Redirects are followed by hand, and a redirect to a different origin drops
+ * every caller-supplied header except a short content-negotiation list. A
+ * bearer token meant for api.example.com must not be replayed to whatever
+ * host api.example.com chooses to redirect to.
+ *
+ * Reported privately by ARC Security Research, 2026-07-31 (spelling bypasses),
+ * by an anonymous researcher, 2026-08-02 (the DNS rebinding race), and by
+ * Arthur Kijkrittaya, 2026-09-08 (credentials surviving cross-origin redirects).
  */
 /**
  * Reduce a host to the IP address it actually denotes.
@@ -64,6 +70,17 @@ type LookupCallback = (err: NodeJS.ErrnoException | null, addressOrList?: string
  * second query cannot reach the socket.
  */
 export declare function createPinnedLookup(addresses: ValidatedAddress[]): (_hostname: string, options: unknown, callback?: LookupCallback) => void;
+/** True when two URLs share scheme, host and port (the web origin). */
+export declare function sameOrigin(a: string, b: string): boolean;
+/**
+ * Decide which request headers follow a redirect from `from` to `to`.
+ *
+ * Same origin: everything is kept, as a browser would. Different origin: only
+ * CROSS_ORIGIN_SAFE_HEADERS survive. When the redirect also turned the request
+ * into a body-less GET (`bodyDropped`), the entity headers go too, on either
+ * kind of hop.
+ */
+export declare function headersForRedirect(headers: HeadersInit | undefined, from: string, to: string, bodyDropped: boolean): Record<string, string>;
 /**
  * fetch() that validates the target, and every redirect hop, against
  * resolvePublicUrl, and connects only to the addresses that validation
@@ -71,6 +88,9 @@ export declare function createPinnedLookup(addresses: ValidatedAddress[]): (_hos
  * would happily land on a private address after a public first hop, and
  * because each hop needs its own resolve-then-pin cycle.
  *
+ * Headers are re-derived on every redirect (see headersForRedirect): a hop to
+ * another origin carries no credential the caller attached for the first one.
+ *
  * The body is buffered so the pinned connection can be torn down before the
  * response is handed back.
  */

package/build/ssrf-guard.js

@@ -21,8 +21,14 @@
  * still used for the Host header and for TLS SNI and certificate validation,
  * so pinning is invisible to legitimate endpoints.
  *
- * Reported privately by ARC Security Research, 2026-07-31 (spelling bypasses)
- * and by an anonymous researcher, 2026-08-02 (the DNS rebinding race).
+ * Redirects are followed by hand, and a redirect to a different origin drops
+ * every caller-supplied header except a short content-negotiation list. A
+ * bearer token meant for api.example.com must not be replayed to whatever
+ * host api.example.com chooses to redirect to.
+ *
+ * Reported privately by ARC Security Research, 2026-07-31 (spelling bypasses),
+ * by an anonymous researcher, 2026-08-02 (the DNS rebinding race), and by
+ * Arthur Kijkrittaya, 2026-09-08 (credentials surviving cross-origin redirects).
  */
 import { isIP } from 'node:net';
 import { lookup as dnsLookup } from 'node:dns/promises';
@@ -212,6 +218,66 @@ export function createPinnedLookup(addresses) {
 }
 /** Statuses whose Response must be constructed with a null body. */
 const NULL_BODY_STATUS = new Set([101, 103, 204, 205, 304]);
+/**
+ * The only request headers that may travel to a different origin on a
+ * redirect. Everything else the caller supplied (Authorization, Cookie,
+ * X-PAYMENT, API keys under any custom name) is bound to the origin the caller
+ * addressed and is dropped. An allow list is used rather than a deny list so a
+ * secret under an unanticipated header name cannot slip through.
+ */
+const CROSS_ORIGIN_SAFE_HEADERS = new Set([
+    'accept',
+    'accept-language',
+    'accept-encoding',
+    'user-agent',
+    'content-type',
+]);
+/** Headers that describe a request body and are wrong once the body is gone. */
+const ENTITY_HEADERS = new Set(['content-type', 'content-length', 'content-encoding', 'transfer-encoding']);
+/** True when two URLs share scheme, host and port (the web origin). */
+export function sameOrigin(a, b) {
+    const ua = new URL(a);
+    const ub = new URL(b);
+    return ua.protocol === ub.protocol && ua.host === ub.host;
+}
+function headersToRecord(headers) {
+    const out = {};
+    if (!headers)
+        return out;
+    if (typeof headers.forEach === 'function' && !Array.isArray(headers)) {
+        headers.forEach((v, k) => { out[k] = v; });
+        return out;
+    }
+    if (Array.isArray(headers)) {
+        for (const [k, v] of headers)
+            out[k] = v;
+        return out;
+    }
+    for (const [k, v] of Object.entries(headers))
+        out[k] = v;
+    return out;
+}
+/**
+ * Decide which request headers follow a redirect from `from` to `to`.
+ *
+ * Same origin: everything is kept, as a browser would. Different origin: only
+ * CROSS_ORIGIN_SAFE_HEADERS survive. When the redirect also turned the request
+ * into a body-less GET (`bodyDropped`), the entity headers go too, on either
+ * kind of hop.
+ */
+export function headersForRedirect(headers, from, to, bodyDropped) {
+    const crossOrigin = !sameOrigin(from, to);
+    const out = {};
+    for (const [k, v] of Object.entries(headersToRecord(headers))) {
+        const name = k.toLowerCase();
+        if (bodyDropped && ENTITY_HEADERS.has(name))
+            continue;
+        if (crossOrigin && !CROSS_ORIGIN_SAFE_HEADERS.has(name))
+            continue;
+        out[k] = v;
+    }
+    return out;
+}
 /**
  * fetch() that validates the target, and every redirect hop, against
  * resolvePublicUrl, and connects only to the addresses that validation
@@ -219,6 +285,9 @@ const NULL_BODY_STATUS = new Set([101, 103, 204, 205, 304]);
  * would happily land on a private address after a public first hop, and
  * because each hop needs its own resolve-then-pin cycle.
  *
+ * Headers are re-derived on every redirect (see headersForRedirect): a hop to
+ * another origin carries no credential the caller attached for the first one.
+ *
  * The body is buffered so the pinned connection can be torn down before the
  * response is handed back.
  */
@@ -262,8 +331,12 @@ export async function safeFetch(url, options = {}, maxHops = 3) {
         if (!isRedirect)
             return out;
         const next = new URL(out.headers.get('location'), current).toString();
-        // A redirected request must not replay the body or method blindly.
-        if (status === 303 || ((status === 301 || status === 302) && opts.method && opts.method !== 'GET')) {
+        // A redirected request must not replay the body or method blindly, and it
+        // must not replay the caller's credentials to a different origin at all.
+        const bodyDropped = status === 303
+            || ((status === 301 || status === 302) && !!opts.method && opts.method !== 'GET');
+        opts = { ...opts, headers: headersForRedirect(opts.headers, current, next, bodyDropped) };
+        if (bodyDropped) {
             opts = { ...opts, method: 'GET', body: undefined };
         }
         current = next;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agentwallet-mcp",
   "mcpName": "io.github.hifriendbot/agentwallet",
-  "version": "1.10.6",
+  "version": "1.10.7",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",