agentwallet-mcp 1.10.6 → 1.10.8

package/README.md

@@ -76,7 +76,7 @@ Local signing uses [viem](https://viem.sh) for EVM and `@solana/web3.js` for Sol
 - **31 MCP tools**: create wallets, send transactions, approve tokens, wrap ETH, transfer SPL tokens, pay and accept x402 payments, verify custody mode, and more
 - **EVM + Solana**: Ethereum, Base, Polygon, BSC, Arbitrum, Optimism, Avalanche, Zora, PulseChain, Solana, and any other EVM-compatible chain
 - **SOL + SPL tokens**: native SOL transfers and SPL token transfers (USDC, USDT, etc.) with automatic account creation
-- **Built-in guards**: daily spending limits, gas price protection, emergency pause, rate limiting, replay protection, and on-chain verification, all active by default
+- **Built-in guards**: in hosted mode, daily spending limits, gas price protection, emergency pause and rate limiting are enforced server-side by default. In local mode your protection is the per-transaction caps you set (`AGENTWALLET_MAX_TX_NATIVE`, `AGENTWALLET_MAX_TX_TOKEN`, `AGENTWALLET_MAX_TX_SOL`, `AGENTWALLET_MAX_AUTOPAY`). x402 replay protection and on-chain verification apply either way
 - **x402 payments**: pay for x402-enabled APIs automatically, or accept x402 payments on your own endpoints (EVM and Solana)
 - **Self-custody option**: run local mode and the key never leaves your machine. In hosted mode, keys are encrypted at rest, decrypted only during signing, and zeroed from memory immediately after. Either way you can export and walk away.
 - **Permissionless**: No KYC. No KYT. No identity verification. No approval process. No compliance gatekeeping. Sign up, get an API key, and start transacting immediately.
@@ -274,7 +274,7 @@ On-chain verification ensures every payment is real. Replay protection prevents
 | KYC Required | Yes | **No** |
 | KYT / Transaction Monitoring | Yes | **No** |
 | Can Block Your Wallet | Yes | **No** |
-| Built-in Guards | Yes (requires setup) | **Yes (active by default)** |
+| Built-in Guards | Yes (requires setup) | **Yes (hosted: active by default; local: env caps you set)** |
 | Free Operations / Month | 5,000 | **6,000** |
 | Cost Per Operation | $0.005 | **$0.00345** |
 | x402 Verification Cost | $0.001 | **$0.0005** |
@@ -295,17 +295,30 @@ You can also pre-purchase x402 verification credits with USDC using the `buy_ver
 
 ## Built-in Guards
 
-All guards are active by default, no configuration required.
+Which guards apply depends on who holds the key.
+
+**Hosted mode** (the server holds the key): every guard below is active by default, no configuration required.
 
 - **Encrypted at rest**: private keys encrypted before storage and never leave the server
 - **Memory zeroing**: keys wiped from memory immediately after every signing operation
-- **Daily spending limits**: set a per-wallet daily cap in USD, enforced automatically on every transaction
+- **Daily spending limits**: set a per-wallet daily cap in USD, enforced by the server on every transaction
 - **Gas price protection**: transactions blocked when gas prices spike above safe thresholds
 - **Emergency pause**: instantly freeze any wallet or all wallets with one click
 - **Rate limiting**: API requests capped per minute to prevent abuse and brute force attacks
+
+**Local mode** (you hold the key): there is no server in the signing path, so the server-side limits and pause above cannot see or stop a locally signed transaction, and nobody (including us) can freeze a local wallet. Your protection is the per-transaction caps enforced inside your own process before anything is signed. Set them before you fund the wallet; an unset cap means no limit.
+
+- `AGENTWALLET_MAX_TX_NATIVE`: ceiling per transaction in native units (ETH, MATIC, and so on)
+- `AGENTWALLET_MAX_TX_TOKEN`: ceiling per ERC-20 transfer, in human units of the token
+- `AGENTWALLET_MAX_TX_SOL`: ceiling per SOL or SPL transfer
+- `AGENTWALLET_MAX_AUTOPAY`: ceiling per x402 auto-payment (default `1`)
+
+**Either mode**, for x402 paywalls you run through the hosted API:
+
 - **Replay protection**: every x402 payment verified on-chain with unique transaction tracking
 - **On-chain verification**: x402 payments verified directly on the blockchain with finalized commitment
-- Bug bounty program: $50,$500 for responsible disclosure ([details](https://hifriendbot.com/wallet))
+
+Bug bounty program: $50 to $500 for responsible disclosure ([details](https://hifriendbot.com/wallet)).
 
 ## Links
 
@@ -328,6 +341,14 @@ resolve public for the check and private for the connection. The hostname is
 still used for the `Host` header and for TLS SNI and certificate validation, so
 pinning is invisible to legitimate endpoints.
 
+Credentials stay with the origin they were given to. If an endpoint redirects
+`pay_x402` to a different origin, the caller-supplied `Authorization`, `Cookie`
+and `X-PAYMENT` headers, and every other custom header, are dropped before the
+next hop; only content-negotiation headers (`Accept`, `Accept-Language`,
+`Accept-Encoding`, `User-Agent`, `Content-Type`) are carried. A redirect that
+turns a POST into a GET also sheds the body headers. Same-origin redirects keep
+everything, as a browser would.
+
 Report security issues privately to security@hifriendbot.com.
 
 ## License

package/build/index.js

@@ -424,7 +424,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.10.6',
+    version: '1.10.8',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. Private keys are encrypted server-side and never exposed — agents sign and broadcast transactions without ever touching raw keys.
 
@@ -944,7 +944,9 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     url: z.string().url().describe('The URL to access (will handle 402 payment if required)'),
     wallet_id: z.number().int().describe('Wallet ID to pay from'),
     method: z.string().default('GET').describe('HTTP method (GET, POST, PUT, DELETE)'),
-    headers: z.string().optional().describe('Optional JSON string of additional request headers'),
+    headers: z.string().optional().describe('Optional JSON string of additional request headers. Credentials placed here ' +
+        '(Authorization, Cookie, API keys) are sent only to the origin in `url`; if the ' +
+        'endpoint redirects to a different origin they are dropped, not forwarded.'),
     body: z.string().optional().describe('Optional request body for POST/PUT requests'),
     max_payment: z.string().optional().describe('Maximum payment in human-readable format (e.g. "1.00" for 1 USDC). ' +
         'Rejects payments above this amount. If omitted, a default cap of ' +

package/build/ssrf-guard.d.ts

@@ -21,8 +21,14 @@
  * still used for the Host header and for TLS SNI and certificate validation,
  * so pinning is invisible to legitimate endpoints.
  *
- * Reported privately by ARC Security Research, 2026-07-31 (spelling bypasses)
- * and by an anonymous researcher, 2026-08-02 (the DNS rebinding race).
+ * Redirects are followed by hand, and a redirect to a different origin drops
+ * every caller-supplied header except a short content-negotiation list. A
+ * bearer token meant for api.example.com must not be replayed to whatever
+ * host api.example.com chooses to redirect to.
+ *
+ * Reported privately by ARC Security Research, 2026-07-31 (spelling bypasses),
+ * by an anonymous researcher, 2026-08-02 (the DNS rebinding race), and by
+ * Arthur Kijkrittaya, 2026-09-08 (credentials surviving cross-origin redirects).
  */
 /**
  * Reduce a host to the IP address it actually denotes.
@@ -64,6 +70,17 @@ type LookupCallback = (err: NodeJS.ErrnoException | null, addressOrList?: string
  * second query cannot reach the socket.
  */
 export declare function createPinnedLookup(addresses: ValidatedAddress[]): (_hostname: string, options: unknown, callback?: LookupCallback) => void;
+/** True when two URLs share scheme, host and port (the web origin). */
+export declare function sameOrigin(a: string, b: string): boolean;
+/**
+ * Decide which request headers follow a redirect from `from` to `to`.
+ *
+ * Same origin: everything is kept, as a browser would. Different origin: only
+ * CROSS_ORIGIN_SAFE_HEADERS survive. When the redirect also turned the request
+ * into a body-less GET (`bodyDropped`), the entity headers go too, on either
+ * kind of hop.
+ */
+export declare function headersForRedirect(headers: HeadersInit | undefined, from: string, to: string, bodyDropped: boolean): Record<string, string>;
 /**
  * fetch() that validates the target, and every redirect hop, against
  * resolvePublicUrl, and connects only to the addresses that validation
@@ -71,6 +88,9 @@ export declare function createPinnedLookup(addresses: ValidatedAddress[]): (_hos
  * would happily land on a private address after a public first hop, and
  * because each hop needs its own resolve-then-pin cycle.
  *
+ * Headers are re-derived on every redirect (see headersForRedirect): a hop to
+ * another origin carries no credential the caller attached for the first one.
+ *
  * The body is buffered so the pinned connection can be torn down before the
  * response is handed back.
  */

package/build/ssrf-guard.js

@@ -21,8 +21,14 @@
  * still used for the Host header and for TLS SNI and certificate validation,
  * so pinning is invisible to legitimate endpoints.
  *
- * Reported privately by ARC Security Research, 2026-07-31 (spelling bypasses)
- * and by an anonymous researcher, 2026-08-02 (the DNS rebinding race).
+ * Redirects are followed by hand, and a redirect to a different origin drops
+ * every caller-supplied header except a short content-negotiation list. A
+ * bearer token meant for api.example.com must not be replayed to whatever
+ * host api.example.com chooses to redirect to.
+ *
+ * Reported privately by ARC Security Research, 2026-07-31 (spelling bypasses),
+ * by an anonymous researcher, 2026-08-02 (the DNS rebinding race), and by
+ * Arthur Kijkrittaya, 2026-09-08 (credentials surviving cross-origin redirects).
  */
 import { isIP } from 'node:net';
 import { lookup as dnsLookup } from 'node:dns/promises';
@@ -212,6 +218,66 @@ export function createPinnedLookup(addresses) {
 }
 /** Statuses whose Response must be constructed with a null body. */
 const NULL_BODY_STATUS = new Set([101, 103, 204, 205, 304]);
+/**
+ * The only request headers that may travel to a different origin on a
+ * redirect. Everything else the caller supplied (Authorization, Cookie,
+ * X-PAYMENT, API keys under any custom name) is bound to the origin the caller
+ * addressed and is dropped. An allow list is used rather than a deny list so a
+ * secret under an unanticipated header name cannot slip through.
+ */
+const CROSS_ORIGIN_SAFE_HEADERS = new Set([
+    'accept',
+    'accept-language',
+    'accept-encoding',
+    'user-agent',
+    'content-type',
+]);
+/** Headers that describe a request body and are wrong once the body is gone. */
+const ENTITY_HEADERS = new Set(['content-type', 'content-length', 'content-encoding', 'transfer-encoding']);
+/** True when two URLs share scheme, host and port (the web origin). */
+export function sameOrigin(a, b) {
+    const ua = new URL(a);
+    const ub = new URL(b);
+    return ua.protocol === ub.protocol && ua.host === ub.host;
+}
+function headersToRecord(headers) {
+    const out = {};
+    if (!headers)
+        return out;
+    if (typeof headers.forEach === 'function' && !Array.isArray(headers)) {
+        headers.forEach((v, k) => { out[k] = v; });
+        return out;
+    }
+    if (Array.isArray(headers)) {
+        for (const [k, v] of headers)
+            out[k] = v;
+        return out;
+    }
+    for (const [k, v] of Object.entries(headers))
+        out[k] = v;
+    return out;
+}
+/**
+ * Decide which request headers follow a redirect from `from` to `to`.
+ *
+ * Same origin: everything is kept, as a browser would. Different origin: only
+ * CROSS_ORIGIN_SAFE_HEADERS survive. When the redirect also turned the request
+ * into a body-less GET (`bodyDropped`), the entity headers go too, on either
+ * kind of hop.
+ */
+export function headersForRedirect(headers, from, to, bodyDropped) {
+    const crossOrigin = !sameOrigin(from, to);
+    const out = {};
+    for (const [k, v] of Object.entries(headersToRecord(headers))) {
+        const name = k.toLowerCase();
+        if (bodyDropped && ENTITY_HEADERS.has(name))
+            continue;
+        if (crossOrigin && !CROSS_ORIGIN_SAFE_HEADERS.has(name))
+            continue;
+        out[k] = v;
+    }
+    return out;
+}
 /**
  * fetch() that validates the target, and every redirect hop, against
  * resolvePublicUrl, and connects only to the addresses that validation
@@ -219,6 +285,9 @@ const NULL_BODY_STATUS = new Set([101, 103, 204, 205, 304]);
  * would happily land on a private address after a public first hop, and
  * because each hop needs its own resolve-then-pin cycle.
  *
+ * Headers are re-derived on every redirect (see headersForRedirect): a hop to
+ * another origin carries no credential the caller attached for the first one.
+ *
  * The body is buffered so the pinned connection can be torn down before the
  * response is handed back.
  */
@@ -262,8 +331,12 @@ export async function safeFetch(url, options = {}, maxHops = 3) {
         if (!isRedirect)
             return out;
         const next = new URL(out.headers.get('location'), current).toString();
-        // A redirected request must not replay the body or method blindly.
-        if (status === 303 || ((status === 301 || status === 302) && opts.method && opts.method !== 'GET')) {
+        // A redirected request must not replay the body or method blindly, and it
+        // must not replay the caller's credentials to a different origin at all.
+        const bodyDropped = status === 303
+            || ((status === 301 || status === 302) && !!opts.method && opts.method !== 'GET');
+        opts = { ...opts, headers: headersForRedirect(opts.headers, current, next, bodyDropped) };
+        if (bodyDropped) {
             opts = { ...opts, method: 'GET', body: undefined };
         }
         current = next;

package/package.json

@@ -1,69 +1,69 @@
-{
-  "name": "agentwallet-mcp",
-  "mcpName": "io.github.hifriendbot/agentwallet",
-  "version": "1.10.6",
-  "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
-  "type": "module",
-  "main": "build/index.js",
-  "bin": {
-    "agentwallet-mcp": "build/index.js"
-  },
-  "files": [
-    "build",
-    "README.md",
-    "LICENSE"
-  ],
-  "scripts": {
-    "build": "tsc",
-    "start": "node build/index.js",
-    "test": "node test/x402-payment.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs",
-    "prepublishOnly": "npm run build"
-  },
-  "keywords": [
-    "mcp",
-    "model-context-protocol",
-    "wallet",
-    "ai-agent",
-    "blockchain",
-    "evm",
-    "ethereum",
-    "base",
-    "arbitrum",
-    "optimism",
-    "polygon",
-    "avalanche",
-    "bsc",
-    "zora",
-    "pulsechain",
-    "solana",
-    "spl-token",
-    "erc20",
-    "token-transfer",
-    "transaction-signing",
-    "x402",
-    "http-402",
-    "agent-payments",
-    "agentwallet",
-    "self-custody",
-    "non-custodial",
-    "local-signing"
-  ],
-  "author": "HiFriendbot (https://hifriendbot.com)",
-  "license": "MIT",
-  "homepage": "https://hifriendbot.com/wallet/",
-  "engines": {
-    "node": ">=18.0.0"
-  },
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.11.4",
-    "@solana/web3.js": "^1.98.4",
-    "bs58": "^6.0.0",
-    "undici": "^8.9.0",
-    "viem": "^2.55.10",
-    "zod": "^3.24.0"
-  },
-  "devDependencies": {
-    "@types/node": "^20.0.0",
-    "typescript": "^5.3.0"
-  }
-}
+{
+  "name": "agentwallet-mcp",
+  "mcpName": "io.github.hifriendbot/agentwallet",
+  "version": "1.10.8",
+  "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
+  "type": "module",
+  "main": "build/index.js",
+  "bin": {
+    "agentwallet-mcp": "build/index.js"
+  },
+  "files": [
+    "build",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "start": "node build/index.js",
+    "test": "node test/x402-payment.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "wallet",
+    "ai-agent",
+    "blockchain",
+    "evm",
+    "ethereum",
+    "base",
+    "arbitrum",
+    "optimism",
+    "polygon",
+    "avalanche",
+    "bsc",
+    "zora",
+    "pulsechain",
+    "solana",
+    "spl-token",
+    "erc20",
+    "token-transfer",
+    "transaction-signing",
+    "x402",
+    "http-402",
+    "agent-payments",
+    "agentwallet",
+    "self-custody",
+    "non-custodial",
+    "local-signing"
+  ],
+  "author": "HiFriendbot (https://hifriendbot.com)",
+  "license": "MIT",
+  "homepage": "https://hifriendbot.com/wallet/",
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.11.4",
+    "@solana/web3.js": "^1.98.4",
+    "bs58": "^6.0.0",
+    "undici": "^8.9.0",
+    "viem": "^2.55.10",
+    "zod": "^3.24.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "typescript": "^5.3.0"
+  }
+}