agentwallet-mcp 1.11.0 → 1.12.1

package/README.md

@@ -172,7 +172,10 @@ Add to your settings:
 | `get_allowance` | Check ERC-20 token allowance |
 | `wrap_eth` | Wrap native tokens to WETH/WAVAX/etc. |
 | `unwrap_eth` | Unwrap WETH back to native tokens |
-| `pay_x402` | Pay x402 invoices automatically (fetch, pay, retry) |
+| `pay_x402` | Pay x402 invoices (exact via EIP-3009, upto via Permit2), with approvals above the cap |
+| `check_approval` | Status of a human approval created by an over-cap `pay_x402` |
+| `approve_permit2` | One-time token approval to Permit2 for `upto` endpoints |
+| `check_token_risk` | Honeypot, tax, owner-power and holder-concentration flags for a token |
 | `create_paywall` | Create an x402 paywall to charge for a resource |
 | `list_paywalls` | List all your x402 paywalls |
 | `get_paywall` | Get paywall details by ID |
@@ -239,7 +242,20 @@ pay_x402(
 
 `max_payment` is a hard per-payment cap. If you omit it, `pay_x402` falls back to `AGENTWALLET_MAX_AUTOPAY` (default `1`), so a malicious or compromised 402 endpoint can never authorize an unbounded payment. In local mode `AGENTWALLET_MAX_TX_TOKEN` applies to authorizations too, because an authorization is a transfer somebody else executes.
 
-**Schemes.** `exact` is fully supported on every EVM chain AgentWallet knows. `upto` (a Permit2 maximum the seller settles below) is refused with a clear message rather than approximated with an upfront transfer; Permit2 support is next. Native-asset and Solana requests, and AgentWallet's own paywalls, are paid by an on-chain transfer proved by transaction hash, which is what those servers verify.
+**Schemes.** `exact` (EIP-3009, gasless for the payer) is preferred and works on every EVM chain AgentWallet knows. `upto` (a Permit2 maximum the seller settles at actual usage) is signed as a `PermitWitnessTransferFrom` bound to the endpoint's facilitator; it needs a one-time `approve_permit2` per token (or `AGENTWALLET_PERMIT2_AUTO_APPROVE=1`). An `upto` option without `extra.facilitatorAddress` is refused, never approximated with an upfront transfer. Native-asset and Solana requests, and AgentWallet's own paywalls, are paid by an on-chain transfer proved by transaction hash, which is what those servers verify.
+
+**Approvals above the cap.** On a hosted wallet, a payment above the cap does not have to fail. With `request_approval` (default on; `AGENTWALLET_APPROVALS=0` turns it off) the wallet owner gets an email with approve and deny links, `pay_x402` returns an `approval_id`, and the agent retries with it once `check_approval` says approved. An approval is bound to one wallet, chain, asset, recipient and maximum, expires in 24 hours, and is consumed by one signature. Local mode has no approval channel: the caps in your environment are the policy.
+
+**Asset risk.** `check_token_risk` (and every `approve_token` result) reports honeypot, tax, owner-power, verified-source, holder-concentration and liquidity flags from GoPlus Security, with an on-chain fallback. A warning for the caller to weigh, never a block.
+
+**Proof.** Real settlements are listed in [PAYMENTS.md](PAYMENTS.md); the first is a 0.02 USDC `exact` payment on Base with the facilitator paying the gas.
+
+## Pay any x402 API from Claude in three steps
+
+1. Add the server (one of the snippets under Quick Start). Self-custody: set `AGENTWALLET_PRIVATE_KEY` to a key that holds USDC on Base. Hosted: `AGENTWALLET_USER` and `AGENTWALLET_PASS` from hifriendbot.com/wallet.
+2. Ask: *"Use pay_x402 to POST https://api.ozdreamtools.de/api/holidays with body {"year":2026,"state":"BY"} and a max_payment of 0.05."*
+3. Read the result: `payment_made: true`, the amount, `payment_method`, and `settlement.transaction`, the on-chain hash. No ETH needed for `exact`: the endpoint's facilitator pays the gas.
+
 
 **Token domains.** The EIP-712 domain comes from the endpoint's `extra.name` / `extra.version`, then a short registry of USDC deployments, then the token contract's own `name()` / `version()`. If none of those answer, the payment is refused rather than signed with a guessed domain.
 

package/build/index.js

@@ -15,8 +15,10 @@ import { z } from 'zod';
 import { assertPublicUrl, safeFetch } from './ssrf-guard.js';
 import { deriveX402Payment, isWithinCap, lookupTrustedDecimals, assertDeclaredDecimals, nativeDecimals, SOLANA_CHAIN_IDS, } from './x402-payment.js';
 import { isLocalMode, getLocalAddress, localWalletRecord, localSend, localNativeBalance, localTokenBalance, localSignMessage, resolveRpcUrl, } from './local-wallet.js';
-import { localSignAuthorization, localEthCall } from './local-wallet.js';
-import { isLegacyAgentWalletAccept, requiredAmount, buildAuthorization, buildPaymentPayload, paymentHeaderFor, parsePaymentRequired, parseSettlement, pickOption, knownTokenDomain, } from './x402-eip3009.js';
+import { localSignAuthorization, localEthCall, localSignPermit2Upto } from './local-wallet.js';
+import { buildUptoAuthorization, uptoPayload, permit2AllowanceCalldata, permit2ApproveCalldata, decodeUint, PERMIT2_ADDRESS, } from './x402-permit2.js';
+import { assessTokenRisk } from './token-risk.js';
+import { isLegacyAgentWalletAccept, requiredAmount, buildAuthorization, buildPaymentPayload, buildPaymentPayloadRaw, paymentHeaderFor, parsePaymentRequired, parseSettlement, pickOption, knownTokenDomain, } from './x402-eip3009.js';
 import { isSolanaLocalMode, getSolanaAddress, solanaWalletRecord, localSolBalance, localSplBalance, localSolTransfer, localSplTransfer, resolveSolanaRpc, } from './local-solana.js';
 /** True when either chain family is running non-custodially. */
 function anyLocalMode() {
@@ -106,6 +108,20 @@ async function routeLocally(path, method, body) {
             nonce: String(body?.nonce || ''),
         });
     }
+    // POST /wallets/{id}/x402/permit2  (x402 "upto": Permit2 max-authorization, signed here)
+    if (method === 'POST' && /^\/wallets\/[^/]*\/x402\/permit2$/.test(rawPath)) {
+        if (!isLocalMode())
+            refuseMissingLocalKey('evm');
+        const chainId = localChainId(body, qs);
+        return localSignPermit2Upto(chainId, {
+            from: getLocalAddress(),
+            permitted: { token: String(body?.asset || ''), amount: String(body?.amount ?? '0') },
+            spender: String(body?.spender || ''),
+            nonce: String(body?.nonce ?? '0'),
+            deadline: String(body?.deadline ?? '0'),
+            witness: { to: String(body?.to || ''), facilitator: String(body?.facilitator || ''), validAfter: String(body?.valid_after ?? '0') },
+        });
+    }
     // POST /eth-call  (read-only; answered from the local RPC so pure self-custody needs no hosted credentials)
     if (method === 'POST' && rawPath === '/eth-call') {
         if (!isLocalMode())
@@ -445,7 +461,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.11.0',
+    version: '1.12.1',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. Private keys are encrypted server-side and never exposed — agents sign and broadcast transactions without ever touching raw keys.
 
@@ -787,6 +803,17 @@ server.tool('approve_token', 'Approve a spender contract to transfer ERC-20 toke
         rawAmount = parseUnits(amount, decimals);
     }
     const calldata = '0x095ea7b3' + padAddress(spender) + encodeUint256(rawAmount);
+    // Asset risk rides along with the approval (issue #13). It never blocks; it is the
+    // caller's call. Skipped for Permit2, which only moves what a signature allows.
+    let risk = null;
+    if (spender.toLowerCase() !== PERMIT2_ADDRESS.toLowerCase()) {
+        try {
+            risk = await assessTokenRisk(chain_id, token, (to, data) => ethCallHex(chain_id, to, data));
+        }
+        catch {
+            risk = null;
+        }
+    }
     const result = await api(`/wallets/${wallet_id}/send`, 'POST', {
         to: token,
         value: '0',
@@ -798,6 +825,7 @@ server.tool('approve_token', 'Approve a spender contract to transfer ERC-20 toke
         token,
         spender,
         amount: amount.toLowerCase() === 'max' ? 'unlimited' : amount,
+        risk,
     });
 });
 // ─── Tool: get_allowance ────────────────────────────────────────
@@ -996,10 +1024,11 @@ async function resolveTokenDomain(chainId, asset, extra) {
     return { name, version };
 }
 /** Sign the authorization with whichever custody mode is active (local key, or the hosted signer). */
-async function signAuthorization(walletId, chainId, asset, domain, auth) {
+async function signAuthorization(walletId, chainId, asset, domain, auth, approvalId) {
     const r = (await api(`/wallets/${walletId}/x402/authorize`, 'POST', {
         chain_id: chainId, asset, name: domain.name, version: domain.version,
         to: auth.to, value: auth.value, valid_after: auth.validAfter, valid_before: auth.validBefore, nonce: auth.nonce,
+        ...(approvalId ? { approval_id: approvalId } : {}),
     }, { 'X-AGW-SKIP-X402': 'true' }));
     const sig = String(r?.signature || '');
     if (!/^0x[0-9a-fA-F]{130}$/.test(sig)) {
@@ -1007,6 +1036,18 @@ async function signAuthorization(walletId, chainId, asset, domain, auth) {
     }
     return sig;
 }
+/** Sign a Permit2 upto authorization with whichever custody mode is active. */
+async function signPermit2(walletId, chainId, auth, approvalId) {
+    const r = (await api(`/wallets/${walletId}/x402/permit2`, 'POST', {
+        chain_id: chainId, asset: auth.permitted.token, amount: auth.permitted.amount, spender: auth.spender, permit2: PERMIT2_ADDRESS,
+        nonce: auth.nonce, deadline: auth.deadline, to: auth.witness.to, facilitator: auth.witness.facilitator, valid_after: auth.witness.validAfter,
+        ...(approvalId ? { approval_id: approvalId } : {}),
+    }, { 'X-AGW-SKIP-X402': 'true' }));
+    const sig = String(r?.signature || '');
+    if (!/^0x[0-9a-fA-F]{130}$/.test(sig))
+        throw new Error(`x402 upto: the wallet did not return a valid Permit2 signature${r?.error ? ` (${r.error})` : ''}.`);
+    return sig;
+}
 // ─── Tool: pay_x402 ─────────────────────────────────────────────
 server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the server returns HTTP 402 Payment Required, ' +
     'parses the payment requirements (v1 body or v2 PAYMENT-REQUIRED header), signs an EIP-3009 ' +
@@ -1028,7 +1069,10 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
         'to allow a larger single payment.'),
     prefer_chain: z.number().int().optional().describe('Preferred chain ID if the server accepts payment on multiple chains ' +
         '(e.g. 8453 for Base, 1 for Ethereum)'),
-}, async ({ url, wallet_id, method, headers: headersJson, body: reqBody, max_payment, prefer_chain }) => {
+    request_approval: z.boolean().optional().describe('Hosted wallets only. When the payment exceeds the cap, email the wallet owner an approve/deny link ' +
+        'instead of refusing, and return an approval_id to retry with. Default true unless AGENTWALLET_APPROVALS=0.'),
+    approval_id: z.string().optional().describe('An approval id from an earlier over-cap attempt. Once the owner has approved it, pass it here to make that one payment.'),
+}, async ({ url, wallet_id, method, headers: headersJson, body: reqBody, max_payment, prefer_chain, request_approval, approval_id }) => {
     // Build request headers
     const reqHeaders = { Accept: 'application/json' };
     if (headersJson) {
@@ -1089,7 +1133,7 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     }
     const x402Version = Number(paymentInfo.x402Version) || 1;
     const accepts = paymentInfo.accepts;
-    // Step 3: Pick an option this client can sign. "exact" only; "upto" is refused, never approximated (issue #6).
+    // Step 3: Pick an option this client can sign: exact (EIP-3009) first, then a signable upto (Permit2).
     const picked = pickOption(accepts, resolveChainId, prefer_chain);
     if (!picked.option || !picked.chainId) {
         return jsonResponse({
@@ -1102,6 +1146,7 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     }
     const option = picked.option;
     const chainId = picked.chainId;
+    const isUpto = option.scheme === 'upto';
     const rawAmount = requiredAmount(option);
     if (!/^\d+$/.test(rawAmount)) {
         throw new Error(`x402: invalid amount "${rawAmount}" in the payment requirements (expected integer base units).`);
@@ -1117,44 +1162,100 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
         assertDeclaredDecimals(option.requiredDecimals, trustedDecimals);
     const amount = formatUnits(rawAmount, trustedDecimals);
     const tokenLabel = option.extra?.name || (tokenAddress ? 'tokens' : 'native');
+    const skip = { 'X-AGW-SKIP-X402': 'true' };
     // Step 4: Hard per-payment cap, ALWAYS applied. If the caller omits max_payment
-    // we fall back to AGENTWALLET_MAX_AUTOPAY (default "1"), so an untrusted 402
-    // endpoint can never authorize an unbounded payment. Never silently skipped.
+    // we fall back to AGENTWALLET_MAX_AUTOPAY (default "1"). Above the cap a hosted
+    // wallet can ask its owner instead of refusing: an approval is created, the
+    // owner gets approve/deny links by email, and the agent retries with the id.
+    // For upto the cap applies to the MAXIMUM the seller may settle.
     const capSource = max_payment ? 'max_payment' : 'AGENTWALLET_MAX_AUTOPAY';
     const effectiveMax = max_payment || process.env.AGENTWALLET_MAX_AUTOPAY || '1';
+    let approvalUsed = null;
     if (!isWithinCap(rawAmount, trustedDecimals, effectiveMax)) {
-        return jsonResponse({
-            status: 402,
-            payment_required: true,
-            payment_made: false,
-            error: `Payment of ${amount} ${tokenLabel} exceeds the ${effectiveMax} cap (from ${capSource}).` +
-                (max_payment ? '' : ' No max_payment was provided, so the default cap was applied. ' +
-                    'Pass max_payment (or raise AGENTWALLET_MAX_AUTOPAY) to allow a larger payment.'),
-            required_amount: amount,
-            max_allowed: effectiveMax,
-            cap_source: capSource,
-            token: tokenLabel,
-            network: option.network,
-            chain_id: chainId,
-            pay_to: option.payTo,
-            description: option.description,
-        });
+        const overCap = {
+            status: 402, payment_required: true, payment_made: false,
+            required_amount: amount, max_allowed: effectiveMax, cap_source: capSource, token: tokenLabel,
+            network: option.network, chain_id: chainId, pay_to: option.payTo, description: option.description,
+        };
+        const wantApproval = request_approval ?? (process.env.AGENTWALLET_APPROVALS !== '0');
+        if (approval_id) {
+            const a = (await api(`/approvals/${encodeURIComponent(approval_id)}`, 'GET', undefined, skip));
+            if (a?.status !== 'approved' || Number(a.used) === 1) {
+                return jsonResponse({ ...overCap, approval_id, approval_status: a?.status ?? null, error: `Approval ${approval_id} is ${a?.status ?? 'unknown'}, not approved.${a?.error ? ' ' + a.error : ''}` });
+            }
+            if (String(a.pay_to || '').toLowerCase() !== option.payTo.toLowerCase() || Number(a.chain_id) !== chainId || BigInt(String(a.value || '0')) < BigInt(rawAmount)) {
+                return jsonResponse({ ...overCap, approval_id, error: 'Approval does not cover this payment (recipient, chain or amount differ).' });
+            }
+            approvalUsed = String(approval_id);
+        }
+        else if (wantApproval && !anyLocalMode()) {
+            const created = (await api('/approvals', 'POST', {
+                wallet_id, chain_id: chainId, scheme: option.scheme, asset: tokenAddress, pay_to: option.payTo, value: rawAmount,
+                amount_human: amount, token_name: tokenLabel, url,
+            }, skip));
+            if (!created?.id) {
+                return jsonResponse({ ...overCap, error: `Payment of ${amount} ${tokenLabel} exceeds the ${effectiveMax} cap and the approval request failed: ${created?.error || 'unknown error'}.` });
+            }
+            return jsonResponse({
+                ...overCap, approval_pending: true, approval_id: String(created.id), expires_at: created.expires_at ?? null,
+                error: `Payment of ${amount} ${tokenLabel} exceeds the ${effectiveMax} cap (from ${capSource}). The wallet owner has been emailed approve/deny links ` +
+                    `(approval ${created.id}, valid 24 hours). Check it with check_approval, then call pay_x402 again with approval_id "${created.id}".`,
+            });
+        }
+        else {
+            return jsonResponse({
+                ...overCap,
+                error: `Payment of ${amount} ${tokenLabel} exceeds the ${effectiveMax} cap (from ${capSource}).` +
+                    (max_payment ? '' : ' No max_payment was provided, so the default cap was applied.') +
+                    (anyLocalMode() ? ' Local mode has no approval channel: raise max_payment, AGENTWALLET_MAX_AUTOPAY or AGENTWALLET_MAX_TX_TOKEN yourself.'
+                        : ' Pass request_approval=true to email the wallet owner for a one-time approval, or raise the cap.'),
+            });
+        }
     }
     // Step 5: Pay. Standard x402 "exact" on EVM is an EIP-3009 authorization the
-    // facilitator settles; the payer broadcasts nothing and pays no gas. AgentWallet's
+    // facilitator settles; "upto" is a Permit2 max-authorization settled at actual
+    // usage; the payer broadcasts nothing and pays no gas for either. AgentWallet's
     // own paywalls (verified by receipt), native-asset requests and Solana still use
     // a broadcast transfer proved by hash.
-    const standardExact = !isSolanaChain(chainId) && Boolean(tokenAddress) && !isLegacyAgentWalletAccept(option);
+    const standardExact = !isUpto && !isSolanaChain(chainId) && Boolean(tokenAddress) && !isLegacyAgentWalletAccept(option);
     let headerName = 'X-PAYMENT';
     let paymentHeader = '';
     let txHash = null;
     let authorization = null;
+    let uptoAuth = null;
     let payer = null;
-    if (standardExact) {
+    let permit2ApprovalTx = null;
+    if (isUpto) {
+        payer = await payerAddress(wallet_id);
+        const allowance = decodeUint(await ethCallHex(chainId, tokenAddress, permit2AllowanceCalldata(payer)));
+        if (allowance < BigInt(rawAmount)) {
+            if (process.env.AGENTWALLET_PERMIT2_AUTO_APPROVE === '1') {
+                const r = (await api(`/wallets/${wallet_id}/send`, 'POST', { to: tokenAddress, value: '0', data: permit2ApproveCalldata(), chain_id: chainId }, skip));
+                permit2ApprovalTx = String(r?.tx_hash || '');
+                await new Promise(res => setTimeout(res, 4000));
+            }
+            else {
+                return jsonResponse({
+                    status: 402, payment_required: true, payment_made: false, permit2_approval_needed: true,
+                    token: tokenLabel, token_address: tokenAddress, chain_id: chainId, payer, permit2: PERMIT2_ADDRESS,
+                    error: `This endpoint uses the x402 "upto" scheme, which settles through Permit2. Wallet ${payer} has not approved ` +
+                        `${tokenLabel} to Permit2 on chain ${chainId}. Call approve_permit2 once for this token (a normal transaction that needs gas), ` +
+                        `or set AGENTWALLET_PERMIT2_AUTO_APPROVE=1, then call pay_x402 again.`,
+                });
+            }
+        }
+        uptoAuth = buildUptoAuthorization(payer, option);
+        const signature = await signPermit2(wallet_id, chainId, uptoAuth, approvalUsed);
+        const payload = buildPaymentPayloadRaw(x402Version, option, uptoPayload(uptoAuth, signature), paymentInfo.resource, paymentInfo.extensions);
+        const h = paymentHeaderFor(x402Version, payload);
+        headerName = h.name;
+        paymentHeader = h.value;
+    }
+    else if (standardExact) {
         payer = await payerAddress(wallet_id);
         const domain = await resolveTokenDomain(chainId, tokenAddress, option.extra);
         authorization = buildAuthorization(payer, option);
-        const signature = await signAuthorization(wallet_id, chainId, tokenAddress, domain, authorization);
+        const signature = await signAuthorization(wallet_id, chainId, tokenAddress, domain, authorization, approvalUsed);
         const payload = buildPaymentPayload(x402Version, option, authorization, signature, paymentInfo.resource, paymentInfo.extensions);
         const h = paymentHeaderFor(x402Version, payload);
         headerName = h.name;
@@ -1211,7 +1312,9 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
         payment_required: true,
         payment_made: retryRes.status !== 402,
         retry_error: retryError,
-        payment_method: standardExact ? 'eip3009-authorization' : 'onchain-transfer',
+        payment_method: isUpto ? 'permit2-upto-authorization' : (standardExact ? 'eip3009-authorization' : 'onchain-transfer'),
+        approval_id: approvalUsed,
+        permit2_approval_tx: permit2ApprovalTx,
         x402_version: x402Version,
         amount,
         token: tokenLabel,
@@ -1222,11 +1325,35 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
         payer,
         tx_hash: txHash ?? settlement?.transaction ?? null,
         settlement,
-        authorization: authorization ? { nonce: authorization.nonce, valid_before: authorization.validBefore } : null,
+        authorization: authorization ? { nonce: authorization.nonce, valid_before: authorization.validBefore }
+            : (uptoAuth ? { scheme: 'upto', max_amount: amount, nonce: uptoAuth.nonce, deadline: uptoAuth.deadline, facilitator: uptoAuth.witness.facilitator } : null),
         description: option.description,
         response: retryParsed,
     });
 });
+// ─── Tool: check_approval ───────────────────────────────────────
+server.tool('check_approval', 'Status of a payment approval created when pay_x402 exceeded the cap on a hosted wallet. ' +
+    'Returns pending, approved, denied or expired. Once approved, call pay_x402 again with approval_id.', { approval_id: z.string().describe('Approval id returned by pay_x402') }, async ({ approval_id }) => jsonResponse(await api(`/approvals/${encodeURIComponent(approval_id)}`, 'GET', undefined, { 'X-AGW-SKIP-X402': 'true' })));
+// ─── Tool: approve_permit2 ──────────────────────────────────────
+server.tool('approve_permit2', 'One-time ERC-20 approval of a token to the Permit2 contract, needed before paying x402 "upto" endpoints with that token. ' +
+    'A normal on-chain transaction (needs gas). Approves the maximum so it never has to be repeated; Permit2 itself only moves ' +
+    'what each signed authorization allows.', {
+    wallet_id: z.number().int().describe('Wallet ID'),
+    token: z.string().regex(/^0x[a-fA-F0-9]{40}$/).describe('ERC-20 token address (e.g. USDC on Base)'),
+    chain_id: z.number().int().describe('Chain ID'),
+}, async ({ wallet_id, token, chain_id }) => {
+    if (isSolanaChain(chain_id))
+        throw new Error('Permit2 is an EVM contract; there is nothing to approve on Solana.');
+    const result = (await api(`/wallets/${wallet_id}/send`, 'POST', { to: token, value: '0', data: permit2ApproveCalldata(), chain_id }));
+    return jsonResponse({ ...result, token, spender: PERMIT2_ADDRESS, amount: 'unlimited', note: 'Permit2 only transfers what a signed authorization allows; the allowance itself moves nothing.' });
+});
+// ─── Tool: check_token_risk ─────────────────────────────────────
+server.tool('check_token_risk', 'Assess an ERC-20 token before approving or swapping it: honeypot, taxes, owner powers, verified source, ' +
+    'holder concentration, DEX liquidity. Uses GoPlus Security (free, no key) with an on-chain fallback. ' +
+    'A warning for the caller to weigh, never a block.', {
+    token: z.string().regex(/^0x[a-fA-F0-9]{40}$/).describe('ERC-20 token contract address'),
+    chain_id: z.number().int().describe('Chain ID'),
+}, async ({ token, chain_id }) => jsonResponse({ token, chain_id, risk: await assessTokenRisk(chain_id, token, (to, data) => ethCallHex(chain_id, to, data)) }));
 // ─── Tool: get_usage ─────────────────────────────────────────────
 server.tool('get_usage', 'Get the current month\'s usage statistics. ' +
     'Returns operations count, tier info, remaining quota, and fees.', {}, async () => {

package/build/local-wallet.d.ts

@@ -16,6 +16,7 @@
  */
 import { type Address, type Hex } from 'viem';
 import { type Eip3009Authorization } from './x402-eip3009.js';
+import { type UptoPermit2Authorization } from './x402-permit2.js';
 /** True when the server is running non-custodially. */
 export declare function isLocalMode(): boolean;
 export declare function getLocalAccount(): {
@@ -107,3 +108,9 @@ export declare function localSignAuthorization(chainId: number, asset: Address,
 export declare function localEthCall(chainId: number, to: Address, data: Hex): Promise<{
     result: string;
 }>;
+/** x402 "upto": sign a Permit2 max-authorization in-process. The maximum goes through the token cap like a transfer would. */
+export declare function localSignPermit2Upto(chainId: number, auth: UptoPermit2Authorization): Promise<{
+    signature: `0x${string}`;
+    from: Address;
+    mode: 'local';
+}>;

package/build/local-wallet.js

@@ -19,6 +19,7 @@ import { createPublicClient, createWalletClient, http, encodeFunctionData, parse
 import { privateKeyToAccount } from 'viem/accounts';
 import { lookupTrustedDecimals } from './x402-payment.js';
 import { typedDataFor } from './x402-eip3009.js';
+import { uptoTypedData } from './x402-permit2.js';
 /* ── Key loading ─────────────────────────────────────────────────── */
 /**
  * Read the key once at startup. Kept module-private: nothing exports the key
@@ -335,3 +336,16 @@ export async function localEthCall(chainId, to, data) {
     const r = await client.call({ to, data });
     return { result: r.data ?? '0x' };
 }
+/** x402 "upto": sign a Permit2 max-authorization in-process. The maximum goes through the token cap like a transfer would. */
+export async function localSignPermit2Upto(chainId, auth) {
+    const token = auth.permitted.token;
+    if (!/^0x[a-fA-F0-9]{40}$/.test(token))
+        throw new Error(`Local mode needs an EVM token address for x402 upto, got "${token}".`);
+    if (!/^\d+$/.test(auth.permitted.amount))
+        throw new Error(`x402 upto amount must be integer base units, got "${auth.permitted.amount}".`);
+    const calldata = ('0xa9059cbb' + auth.witness.to.slice(2).toLowerCase().padStart(64, '0') + BigInt(auth.permitted.amount).toString(16).padStart(64, '0'));
+    await assertWithinTokenCap(chainId, token, calldata);
+    const from = getLocalAddress();
+    const signature = await getLocalAccount().signTypedData(uptoTypedData(chainId, { ...auth, from }));
+    return { signature, from, mode: 'local' };
+}

package/build/token-risk.d.ts

@@ -0,0 +1,19 @@
+export type RiskLevel = 'low' | 'medium' | 'high' | 'unknown';
+export interface TokenRisk {
+    level: RiskLevel;
+    score: number;
+    flags: string[];
+    notes: string[];
+    source: 'goplus' | 'onchain' | 'none';
+    holder_count?: number;
+    top_holder_percent?: number;
+    buy_tax?: number;
+    sell_tax?: number;
+}
+/** Turn a GoPlus token_security record into a verdict. Exported so it can be unit-tested offline. */
+export declare function assessGoPlus(r: Record<string, unknown>): TokenRisk;
+/**
+ * Assess a token. `ethCall` runs a read-only call and returns the hex result
+ * (used for the on-chain fallback: does the contract answer name() and decimals()?).
+ */
+export declare function assessTokenRisk(chainId: number, token: string, ethCall?: (to: string, data: string) => Promise<string>): Promise<TokenRisk>;

package/build/token-risk.js

@@ -0,0 +1,127 @@
+/**
+ * Asset risk before an approval or a swap. The wallet layer knows the amount;
+ * it did not know the asset. This asks GoPlus Security's free token_security
+ * endpoint (no key) and, when that is unavailable, falls back to what the
+ * chain itself can tell us. Always a WARNING, never a block: the caller
+ * decides. Requested in agentwallet-mcp issue #13.
+ */
+import { safeFetch } from './ssrf-guard.js';
+const GOPLUS_CHAINS = new Set([1, 56, 137, 8453, 42161, 10, 43114, 324, 59144, 534352, 25, 250, 100, 1101, 5000, 81457, 204]);
+function num(v) {
+    if (v === undefined || v === null || v === '')
+        return null;
+    const n = Number(v);
+    return Number.isFinite(n) ? n : null;
+}
+function flag(v) { return v === '1' || v === 1 || v === true; }
+/** Turn a GoPlus token_security record into a verdict. Exported so it can be unit-tested offline. */
+export function assessGoPlus(r) {
+    const flags = [];
+    const notes = [];
+    let score = 0;
+    const add = (cond, name, pts, note) => { if (cond) {
+        flags.push(name);
+        score += pts;
+        if (note)
+            notes.push(note);
+    } };
+    add(flag(r.is_honeypot), 'honeypot', 100, 'GoPlus marks this token as a honeypot: it can be bought but not sold.');
+    add(flag(r.fake_token), 'fake_token', 100, 'Flagged as an imitation of a known token.');
+    add(flag(r.is_airdrop_scam), 'airdrop_scam', 80);
+    add(flag(r.cannot_sell_all), 'cannot_sell_all', 60);
+    add(flag(r.transfer_pausable), 'transfer_pausable', 30, 'The owner can pause transfers.');
+    add(flag(r.is_blacklisted), 'blacklist', 30, 'The contract has a blacklist function.');
+    add(flag(r.owner_change_balance), 'owner_change_balance', 80, 'The owner can change any balance.');
+    add(flag(r.hidden_owner), 'hidden_owner', 40);
+    add(flag(r.selfdestruct), 'selfdestruct', 40);
+    add(flag(r.is_mintable), 'mintable', 15);
+    add(flag(r.slippage_modifiable), 'tax_modifiable', 25, 'Buy/sell tax can be changed by the owner.');
+    add(flag(r.personal_slippage_modifiable), 'personal_tax', 40, 'The owner can set a different tax for specific addresses.');
+    add(flag(r.trading_cooldown), 'trading_cooldown', 10);
+    add(flag(r.external_call), 'external_call', 15);
+    add(r.is_open_source === '0', 'closed_source', 35, 'Contract source is not verified.');
+    add(flag(r.is_proxy), 'proxy', 10, 'Upgradeable proxy: the logic can change.');
+    const buy = num(r.buy_tax), sell = num(r.sell_tax);
+    if (buy !== null && buy > 0.1) {
+        flags.push('buy_tax_high');
+        score += 30;
+    }
+    if (sell !== null && sell > 0.1) {
+        flags.push('sell_tax_high');
+        score += 40;
+    }
+    const holders = num(r.holder_count);
+    if (holders !== null && holders < 50) {
+        flags.push('few_holders');
+        score += 25;
+    }
+    let top = 0;
+    const list = Array.isArray(r.holders) ? r.holders : [];
+    for (const h of list) {
+        const p = num(h.percent);
+        if (p !== null && !flag(h.is_contract) && !flag(h.is_locked) && p > top)
+            top = p;
+    }
+    if (top > 0.5) {
+        flags.push('top_holder_over_50pct');
+        score += 40;
+    }
+    else if (top > 0.2) {
+        flags.push('top_holder_over_20pct');
+        score += 15;
+    }
+    if (r.is_in_dex === '0') {
+        flags.push('no_dex_liquidity');
+        score += 20;
+    }
+    if (flag(r.trust_list)) {
+        notes.push('On GoPlus trust list (well-known token).');
+        score = Math.min(score, 5);
+    }
+    score = Math.min(100, score);
+    const level = score >= 60 ? 'high' : score >= 25 ? 'medium' : 'low';
+    const out = { level, score, flags, notes, source: 'goplus' };
+    if (holders !== null)
+        out.holder_count = holders;
+    if (top)
+        out.top_holder_percent = Math.round(top * 10000) / 100;
+    if (buy !== null)
+        out.buy_tax = buy;
+    if (sell !== null)
+        out.sell_tax = sell;
+    return out;
+}
+/**
+ * Assess a token. `ethCall` runs a read-only call and returns the hex result
+ * (used for the on-chain fallback: does the contract answer name() and decimals()?).
+ */
+export async function assessTokenRisk(chainId, token, ethCall) {
+    const addr = token.toLowerCase();
+    if (GOPLUS_CHAINS.has(chainId)) {
+        try {
+            const res = await safeFetch(`https://api.gopluslabs.io/api/v1/token_security/${chainId}?contract_addresses=${addr}`, {
+                method: 'GET', headers: { Accept: 'application/json' }, signal: AbortSignal.timeout(12_000),
+            });
+            const j = (await res.json());
+            const rec = j?.result?.[addr];
+            if (rec && Object.keys(rec).length > 0)
+                return assessGoPlus(rec);
+        }
+        catch { /* fall through to on-chain */ }
+    }
+    if (ethCall) {
+        try {
+            const name = await ethCall(token, '0x06fdde03');
+            const decimals = await ethCall(token, '0x313ce567');
+            const answers = Boolean(name && name !== '0x') && Boolean(decimals && decimals !== '0x');
+            return {
+                level: answers ? 'unknown' : 'high', score: answers ? 50 : 90,
+                flags: answers ? ['no_security_data'] : ['not_an_erc20'],
+                notes: [answers ? 'No security data available for this chain or token; only basic ERC-20 shape was confirmed.' : 'Contract did not answer name() and decimals(); it may not be an ERC-20 token at all.'],
+                source: 'onchain',
+            };
+        }
+        catch { /* fall through */ }
+    }
+    return { level: 'unknown', score: 50, flags: ['no_security_data'], notes: ['No risk data could be fetched.'], source: 'none' };
+}

package/build/x402-eip3009.d.ts

@@ -140,6 +140,8 @@ export declare function knownTokenDomain(chainId: number, asset: string): {
 export declare function decodeAbiString(hex: string): string;
 /** Build the payment payload the resource server expects for this x402 version. */
 export declare function buildPaymentPayload(x402Version: number, req: X402Requirement, auth: Eip3009Authorization, signature: string, resource?: X402PaymentRequired['resource'], extensions?: Record<string, unknown>): Record<string, unknown>;
+/** Same envelope for any scheme payload (EIP-3009 authorization, Permit2 authorization, tx hash). */
+export declare function buildPaymentPayloadRaw(x402Version: number, req: X402Requirement, payload: Record<string, unknown>, resource?: X402PaymentRequired['resource'], extensions?: Record<string, unknown>): Record<string, unknown>;
 /** 16-128 chars of [A-Za-z0-9_-], the shape the payment-identifier extension accepts. */
 export declare function generatePaymentId(): string;
 /**
@@ -156,10 +158,11 @@ export declare function paymentHeaderFor(x402Version: number, payload: Record<st
 export declare function parsePaymentRequired(getHeader: (name: string) => string | null | undefined, body: unknown): X402PaymentRequired | null;
 export declare function parseSettlement(getHeader: (name: string) => string | null | undefined): X402Settlement | null;
 /**
- * Choose which accepts[] entry to pay. `exact` is the only scheme this client
- * can sign today; `upto` needs Permit2 (a max authorization the seller settles
- * below) and is refused rather than approximated with a full upfront transfer,
- * which is what issue #6 caught. Returns the reason when nothing is payable.
+ * Choose which accepts[] entry to pay. `exact` (EIP-3009, gasless for the
+ * payer) is preferred. `upto` is accepted when it carries the facilitator
+ * address the Permit2 witness must be bound to; an upto option without it is
+ * refused rather than approximated with an upfront transfer (issue #6).
+ * Returns the reason when nothing is payable.
  */
 export declare function pickOption(accepts: X402Requirement[], resolveChainId: (network: string) => number | null, preferChain?: number): {
     option: X402Requirement | null;

package/build/x402-eip3009.js

@@ -19,6 +19,7 @@
  *       response header PAYMENT-RESPONSE
  */
 import { randomBytes } from 'node:crypto';
+import { isUptoPayable } from './x402-permit2.js';
 export const TRANSFER_WITH_AUTHORIZATION_TYPES = {
     TransferWithAuthorization: [
         { name: 'from', type: 'address' },
@@ -115,7 +116,10 @@ export function decodeAbiString(hex) {
 }
 /** Build the payment payload the resource server expects for this x402 version. */
 export function buildPaymentPayload(x402Version, req, auth, signature, resource, extensions) {
-    const payload = { signature, authorization: auth };
+    return buildPaymentPayloadRaw(x402Version, req, { signature, authorization: auth }, resource, extensions);
+}
+/** Same envelope for any scheme payload (EIP-3009 authorization, Permit2 authorization, tx hash). */
+export function buildPaymentPayloadRaw(x402Version, req, payload, resource, extensions) {
     if (x402Version >= 2) {
         const out = { x402Version, accepted: req, payload };
         if (resource)
@@ -176,19 +180,23 @@ export function parseSettlement(getHeader) {
         ?? decodeBase64Json(getHeader('X-PAYMENT-RESPONSE') ?? getHeader('x-payment-response')));
 }
 /**
- * Choose which accepts[] entry to pay. `exact` is the only scheme this client
- * can sign today; `upto` needs Permit2 (a max authorization the seller settles
- * below) and is refused rather than approximated with a full upfront transfer,
- * which is what issue #6 caught. Returns the reason when nothing is payable.
+ * Choose which accepts[] entry to pay. `exact` (EIP-3009, gasless for the
+ * payer) is preferred. `upto` is accepted when it carries the facilitator
+ * address the Permit2 witness must be bound to; an upto option without it is
+ * refused rather than approximated with an upfront transfer (issue #6).
+ * Returns the reason when nothing is payable.
  */
 export function pickOption(accepts, resolveChainId, preferChain) {
-    const payable = accepts.filter(a => a.scheme === 'exact' && resolveChainId(a.network) !== null);
+    const onChain = accepts.filter(a => resolveChainId(a.network) !== null);
+    const exact = onChain.filter(a => a.scheme === 'exact');
+    const upto = onChain.filter(a => isUptoPayable(a));
+    const payable = [...exact, ...upto];
     if (payable.length === 0) {
         const schemes = Array.from(new Set(accepts.map(a => a.scheme))).join(', ') || 'none';
         const reason = accepts.some(a => a.scheme === 'upto')
-            ? 'This endpoint only offers the x402 "upto" scheme (Permit2 max-authorization settled by usage). ' +
-                'AgentWallet does not sign upto authorizations yet and will not approximate one with an upfront transfer. ' +
-                'Ask the endpoint for an "exact" option, or wait for Permit2 support.'
+            ? 'This endpoint offers the x402 "upto" scheme without an extra.facilitatorAddress (or without an asset), so the ' +
+                'Permit2 authorization cannot be bound to a facilitator. AgentWallet will not approximate it with an upfront transfer. ' +
+                'Ask the endpoint operator to publish facilitatorAddress, or an "exact" option.'
             : `No payable option: schemes offered were ${schemes}.`;
         return { option: null, chainId: null, reason };
     }

package/build/x402-permit2.d.ts

@@ -0,0 +1,124 @@
+import type { X402Requirement } from './x402-eip3009.js';
+export declare const PERMIT2_ADDRESS: "0x000000000022D473030F116dDEE9F6B43aC78BA3";
+export declare const X402_UPTO_PERMIT2_PROXY: "0x4020A4f3b7b90ccA423B9fabCc0CE57C6C240002";
+/** EIP-712 types. Referenced types must follow the primary type in alphabetical order (TokenPermissions, Witness). */
+export declare const UPTO_PERMIT2_WITNESS_TYPES: {
+    readonly PermitWitnessTransferFrom: readonly [{
+        readonly name: "permitted";
+        readonly type: "TokenPermissions";
+    }, {
+        readonly name: "spender";
+        readonly type: "address";
+    }, {
+        readonly name: "nonce";
+        readonly type: "uint256";
+    }, {
+        readonly name: "deadline";
+        readonly type: "uint256";
+    }, {
+        readonly name: "witness";
+        readonly type: "Witness";
+    }];
+    readonly TokenPermissions: readonly [{
+        readonly name: "token";
+        readonly type: "address";
+    }, {
+        readonly name: "amount";
+        readonly type: "uint256";
+    }];
+    readonly Witness: readonly [{
+        readonly name: "to";
+        readonly type: "address";
+    }, {
+        readonly name: "facilitator";
+        readonly type: "address";
+    }, {
+        readonly name: "validAfter";
+        readonly type: "uint256";
+    }];
+};
+export interface UptoPermit2Authorization {
+    from: `0x${string}`;
+    permitted: {
+        token: `0x${string}`;
+        amount: string;
+    };
+    spender: `0x${string}`;
+    nonce: string;
+    deadline: string;
+    witness: {
+        to: `0x${string}`;
+        facilitator: `0x${string}`;
+        validAfter: string;
+    };
+}
+/** Permit2 nonces are uint256; 32 random bytes as a decimal string. */
+export declare function createPermit2Nonce(): string;
+export declare function facilitatorAddressOf(req: X402Requirement): `0x${string}` | null;
+/** True when this upto option carries everything the client needs to sign it. */
+export declare function isUptoPayable(req: X402Requirement): boolean;
+export declare function buildUptoAuthorization(from: string, req: X402Requirement, nowSeconds?: number, nonce?: string): UptoPermit2Authorization;
+export declare function uptoTypedData(chainId: number, auth: UptoPermit2Authorization): {
+    domain: {
+        name: string;
+        chainId: number;
+        verifyingContract: "0x000000000022D473030F116dDEE9F6B43aC78BA3";
+    };
+    types: {
+        readonly PermitWitnessTransferFrom: readonly [{
+            readonly name: "permitted";
+            readonly type: "TokenPermissions";
+        }, {
+            readonly name: "spender";
+            readonly type: "address";
+        }, {
+            readonly name: "nonce";
+            readonly type: "uint256";
+        }, {
+            readonly name: "deadline";
+            readonly type: "uint256";
+        }, {
+            readonly name: "witness";
+            readonly type: "Witness";
+        }];
+        readonly TokenPermissions: readonly [{
+            readonly name: "token";
+            readonly type: "address";
+        }, {
+            readonly name: "amount";
+            readonly type: "uint256";
+        }];
+        readonly Witness: readonly [{
+            readonly name: "to";
+            readonly type: "address";
+        }, {
+            readonly name: "facilitator";
+            readonly type: "address";
+        }, {
+            readonly name: "validAfter";
+            readonly type: "uint256";
+        }];
+    };
+    primaryType: "PermitWitnessTransferFrom";
+    message: {
+        permitted: {
+            token: `0x${string}`;
+            amount: bigint;
+        };
+        spender: `0x${string}`;
+        nonce: bigint;
+        deadline: bigint;
+        witness: {
+            to: `0x${string}`;
+            facilitator: `0x${string}`;
+            validAfter: bigint;
+        };
+    };
+};
+/** The payload object that goes under `payload` in the x402 payment. */
+export declare function uptoPayload(auth: UptoPermit2Authorization, signature: string): Record<string, unknown>;
+/** allowance(owner, Permit2) calldata. */
+export declare function permit2AllowanceCalldata(owner: string): `0x${string}`;
+/** approve(Permit2, max) calldata: the one-time step upto needs. */
+export declare function permit2ApproveCalldata(): `0x${string}`;
+export declare function decodeUint(hex: string): bigint;

package/build/x402-permit2.js

@@ -0,0 +1,93 @@
+/**
+ * x402 "upto" scheme on EVM: a Permit2 PermitWitnessTransferFrom that authorizes
+ * a MAXIMUM, which the seller settles at or below actual usage through the
+ * x402 upto proxy. Only the facilitator named in the witness can settle it.
+ *
+ * Needs a one-time ERC-20 approval of the token to the Permit2 contract from
+ * the payer (costs gas once per token per chain); see permit2AllowanceCalldata
+ * and permit2ApproveCalldata. Reference: coinbase/x402 mechanisms/evm/upto.
+ */
+import { randomBytes } from 'node:crypto';
+export const PERMIT2_ADDRESS = '0x000000000022D473030F116dDEE9F6B43aC78BA3';
+export const X402_UPTO_PERMIT2_PROXY = '0x4020A4f3b7b90ccA423B9fabCc0CE57C6C240002';
+/** EIP-712 types. Referenced types must follow the primary type in alphabetical order (TokenPermissions, Witness). */
+export const UPTO_PERMIT2_WITNESS_TYPES = {
+    PermitWitnessTransferFrom: [
+        { name: 'permitted', type: 'TokenPermissions' },
+        { name: 'spender', type: 'address' },
+        { name: 'nonce', type: 'uint256' },
+        { name: 'deadline', type: 'uint256' },
+        { name: 'witness', type: 'Witness' },
+    ],
+    TokenPermissions: [
+        { name: 'token', type: 'address' },
+        { name: 'amount', type: 'uint256' },
+    ],
+    Witness: [
+        { name: 'to', type: 'address' },
+        { name: 'facilitator', type: 'address' },
+        { name: 'validAfter', type: 'uint256' },
+    ],
+};
+/** Permit2 nonces are uint256; 32 random bytes as a decimal string. */
+export function createPermit2Nonce() {
+    return BigInt('0x' + randomBytes(32).toString('hex')).toString();
+}
+export function facilitatorAddressOf(req) {
+    const f = req.extra?.facilitatorAddress;
+    return typeof f === 'string' && /^0x[0-9a-fA-F]{40}$/.test(f) ? f : null;
+}
+/** True when this upto option carries everything the client needs to sign it. */
+export function isUptoPayable(req) {
+    return req.scheme === 'upto' && Boolean(facilitatorAddressOf(req)) && /^0x[0-9a-fA-F]{40}$/.test(String(req.asset || ''));
+}
+export function buildUptoAuthorization(from, req, nowSeconds = Math.floor(Date.now() / 1000), nonce = createPermit2Nonce()) {
+    const facilitator = facilitatorAddressOf(req);
+    if (!facilitator)
+        throw new Error('x402 upto: the payment requirements carry no extra.facilitatorAddress, so the authorization cannot be bound to a facilitator.');
+    const amount = String(req.amount ?? req.maxAmountRequired ?? '');
+    if (!/^\d+$/.test(amount))
+        throw new Error(`x402 upto: invalid amount "${amount}" (expected integer base units).`);
+    if (!/^0x[0-9a-fA-F]{40}$/.test(req.payTo))
+        throw new Error(`x402 upto: payTo is not an EVM address: "${req.payTo}".`);
+    const timeout = Number.isFinite(req.maxTimeoutSeconds) && req.maxTimeoutSeconds > 0 ? Math.floor(req.maxTimeoutSeconds) : 300;
+    return {
+        from: from,
+        permitted: { token: req.asset, amount },
+        spender: X402_UPTO_PERMIT2_PROXY,
+        nonce,
+        deadline: String(nowSeconds + timeout),
+        witness: { to: req.payTo, facilitator, validAfter: String(nowSeconds - 600) },
+    };
+}
+export function uptoTypedData(chainId, auth) {
+    return {
+        domain: { name: 'Permit2', chainId, verifyingContract: PERMIT2_ADDRESS },
+        types: UPTO_PERMIT2_WITNESS_TYPES,
+        primaryType: 'PermitWitnessTransferFrom',
+        message: {
+            permitted: { token: auth.permitted.token, amount: BigInt(auth.permitted.amount) },
+            spender: auth.spender,
+            nonce: BigInt(auth.nonce),
+            deadline: BigInt(auth.deadline),
+            witness: { to: auth.witness.to, facilitator: auth.witness.facilitator, validAfter: BigInt(auth.witness.validAfter) },
+        },
+    };
+}
+/** The payload object that goes under `payload` in the x402 payment. */
+export function uptoPayload(auth, signature) {
+    return { signature, permit2Authorization: auth };
+}
+function pad(addr) { return addr.replace(/^0x/, '').toLowerCase().padStart(64, '0'); }
+/** allowance(owner, Permit2) calldata. */
+export function permit2AllowanceCalldata(owner) {
+    return ('0xdd62ed3e' + pad(owner) + pad(PERMIT2_ADDRESS));
+}
+/** approve(Permit2, max) calldata: the one-time step upto needs. */
+export function permit2ApproveCalldata() {
+    return ('0x095ea7b3' + pad(PERMIT2_ADDRESS) + 'f'.repeat(64));
+}
+export function decodeUint(hex) {
+    const h = (hex || '').replace(/^0x/, '');
+    return h && /^[0-9a-fA-F]+$/.test(h) ? BigInt('0x' + h) : 0n;
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agentwallet-mcp",
   "mcpName": "io.github.hifriendbot/agentwallet",
-  "version": "1.11.0",
+  "version": "1.12.1",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",
@@ -16,7 +16,7 @@
   "scripts": {
     "build": "tsc",
     "start": "node build/index.js",
-    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs",
+    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs",
     "prepublishOnly": "npm run build"
   },
   "keywords": [