agentwallet-mcp 1.10.8 → 1.10.9

package/build/index.js

@@ -13,7 +13,7 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { z } from 'zod';
 import { assertPublicUrl, safeFetch } from './ssrf-guard.js';
-import { deriveX402Payment, isWithinCap, lookupTrustedDecimals, assertDeclaredDecimals, } from './x402-payment.js';
+import { deriveX402Payment, isWithinCap, lookupTrustedDecimals, assertDeclaredDecimals, nativeDecimals, SOLANA_CHAIN_IDS, } from './x402-payment.js';
 import { isLocalMode, getLocalAddress, localWalletRecord, localSend, localNativeBalance, localTokenBalance, localSignMessage, resolveRpcUrl, } from './local-wallet.js';
 import { isSolanaLocalMode, getSolanaAddress, solanaWalletRecord, localSolBalance, localSplBalance, localSolTransfer, localSplTransfer, resolveSolanaRpc, } from './local-solana.js';
 /** True when either chain family is running non-custodially. */
@@ -258,7 +258,7 @@ async function handleX402Payment(x402Data, originalPath, originalMethod, origina
     const assetForDecimals = accept.asset || accept.extra?.token || '';
     const trustedDecimals = assetForDecimals
         ? await resolveTrustedDecimals(chainId, assetForDecimals)
-        : 18; // native asset: value is already in wei-equivalent base units
+        : nativeDecimals(chainId); // native asset: 18 on EVM (wei), 9 on Solana (lamports)
     const { tokenAddress, rawAmount, decimals } = deriveX402Payment(accept, maxAutopay, trustedDecimals);
     // Send payment using our wallet (with X-AGW-SKIP-X402 to prevent recursion)
     let txHash;
@@ -310,7 +310,6 @@ function jsonResponse(data) {
     return { content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] };
 }
 // ─── Solana Helpers ───────────────────────────────────────────────
-const SOLANA_CHAIN_IDS = new Set([900, 901, 902]);
 function isSolanaChain(chainId) {
     return SOLANA_CHAIN_IDS.has(chainId);
 }
@@ -424,7 +423,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.10.8',
+    version: '1.10.9',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. Private keys are encrypted server-side and never exposed — agents sign and broadcast transactions without ever touching raw keys.
 
@@ -1032,7 +1031,7 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     const assetForDecimals = option.asset || option.extra?.token || '';
     const trustedDecimals = assetForDecimals
         ? await resolveTrustedDecimals(chainId, assetForDecimals)
-        : 18;
+        : nativeDecimals(chainId); // 18 on EVM (wei), 9 on Solana (lamports)
     assertDeclaredDecimals(option.requiredDecimals, trustedDecimals);
     // Human-readable amount, computed with trusted decimals so what the agent
     // is told matches what will actually leave the wallet.

package/build/x402-payment.d.ts

@@ -81,4 +81,15 @@ export declare function deriveX402Payment(accept: X402AcceptLike, maxAutopayHuma
  * @param trustedDecimals   token decimals from a trusted source, NOT the 402 body
  * @param capHuman          cap in human-readable units of the asset (e.g. "1")
  */
+/**
+ * Chain IDs this server treats as Solana (mainnet, devnet, testnet).
+ */
+export declare const SOLANA_CHAIN_IDS: ReadonlySet<number>;
+/**
+ * Decimals of a chain's NATIVE asset. EVM natives are 18 (wei); native SOL is
+ * 9 (lamports). The x402 cap and the human-readable amount must use this when
+ * a requirement names no token, otherwise a native-SOL requirement is measured
+ * against a cap inflated by 10**9 (AW-002, reported 2026-09-22).
+ */
+export declare function nativeDecimals(chainId: number): number;
 export declare function isWithinCap(rawAmountRequired: string, trustedDecimals: number, capHuman: string): boolean;

package/build/x402-payment.js

@@ -146,6 +146,19 @@ export function deriveX402Payment(accept, maxAutopayHuman, trustedDecimals) {
  * @param trustedDecimals   token decimals from a trusted source, NOT the 402 body
  * @param capHuman          cap in human-readable units of the asset (e.g. "1")
  */
+/**
+ * Chain IDs this server treats as Solana (mainnet, devnet, testnet).
+ */
+export const SOLANA_CHAIN_IDS = new Set([900, 901, 902]);
+/**
+ * Decimals of a chain's NATIVE asset. EVM natives are 18 (wei); native SOL is
+ * 9 (lamports). The x402 cap and the human-readable amount must use this when
+ * a requirement names no token, otherwise a native-SOL requirement is measured
+ * against a cap inflated by 10**9 (AW-002, reported 2026-09-22).
+ */
+export function nativeDecimals(chainId) {
+    return SOLANA_CHAIN_IDS.has(chainId) ? 9 : 18;
+}
 export function isWithinCap(rawAmountRequired, trustedDecimals, capHuman) {
     if (!/^\d+$/.test(rawAmountRequired)) {
         throw new Error(`Invalid maxAmountRequired "${rawAmountRequired}" (expected an integer base-unit amount).`);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agentwallet-mcp",
   "mcpName": "io.github.hifriendbot/agentwallet",
-  "version": "1.10.8",
+  "version": "1.10.9",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",