agentwallet-mcp 1.12.3 → 1.12.5

package/README.md

@@ -43,7 +43,7 @@ Use `AGENTWALLET_KEYFILE=/path/to/key` instead if you would rather keep the key
 
 `AGENTWALLET_MAX_TX_NATIVE` is a per-transaction ceiling in native units (ETH, MATIC and so on). In hosted mode the server enforces limits; in local mode there is no server, so these guards are the only ones there are. Set them.
 
-`AGENTWALLET_MAX_TX_TOKEN` is the equivalent ceiling for ERC-20 movement, in human units of the token. **Set this one too if you hold stablecoins.** The native cap cannot see a token transfer: an ERC-20 send carries `value = 0` with the amount in the calldata, so `AGENTWALLET_MAX_TX_NATIVE` alone leaves a USDC balance uncapped. `AGENTWALLET_MAX_TX_TOKEN` covers `transfer`, `transferFrom`, `approve`, `increaseAllowance` and Permit2 `approve`, the approvals because an unbounded allowance is a drain waiting to happen. Any other calldata sent to a token contract or to Permit2 is refused while the cap is set, because the guard cannot price it; set `AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS=1` to allow such calls deliberately. Calls to other contracts (routers, bridges) pass, since they can only pull what an approval already allowed. Decimals are resolved locally from the trusted registry, then the token's own `decimals()`; a token that resolves neither way is evaluated at 0 decimals, the only value that cannot fail open.
+`AGENTWALLET_MAX_TX_TOKEN` is the equivalent ceiling for ERC-20 movement, in human units of the token. **Set this one too if you hold stablecoins.** The native cap cannot see a token transfer: an ERC-20 send carries `value = 0` with the amount in the calldata, so `AGENTWALLET_MAX_TX_NATIVE` alone leaves a USDC balance uncapped. `AGENTWALLET_MAX_TX_TOKEN` covers `transfer`, `transferFrom`, `approve`, `increaseAllowance` and Permit2 `approve`, the approvals because an unbounded allowance is a drain waiting to happen. Any other calldata sent to a token contract or to Permit2 is refused while the cap is set, because the guard cannot price it; set `AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS=1` to allow such calls deliberately. Calls to other contracts (routers, bridges) pass, since they can only pull what an approval already allowed; a contract counts as "other" only when it demonstrably declines `decimals()`, so an absurd or malformed answer, or an RPC that cannot be reached, refuses rather than allows. Decimals are resolved locally from the trusted registry, then the token's own `decimals()`; a token that resolves neither way is evaluated at 0 decimals, the only value that cannot fail open.
 
 ### Solana local signing
 
@@ -259,6 +259,8 @@ pay_x402(
 
 **Token domains.** The EIP-712 domain comes from the endpoint's `extra.name` / `extra.version`, then a short registry of USDC deployments, then the token contract's own `name()` / `version()`. If none of those answer, the payment is refused rather than signed with a guessed domain.
 
+**Delegated payers.** If the paying address is an EIP-7702 delegated account, `pay_x402` reports it in `payer_delegation` (the delegate and whether it answers ERC-1271). A delegate without ERC-1271 is declined by facilitators that check account code before recovering the signer, and the reason they return reads like a signature fault; the warning names the real cause. Pay from a plain EOA for reliable settlement.
+
 ## x402 Acceptance
 
 AgentWallet also lets you **accept** x402 payments. Create a paywall, point it at any resource, and get a public URL that charges agents automatically:

package/build/index.js

@@ -15,10 +15,10 @@ import { z } from 'zod';
 import { assertPublicUrl, safeFetch } from './ssrf-guard.js';
 import { deriveX402Payment, isWithinCap, lookupTrustedDecimals, assertDeclaredDecimals, nativeDecimals, SOLANA_CHAIN_IDS, } from './x402-payment.js';
 import { isLocalMode, getLocalAddress, localWalletRecord, localSend, localNativeBalance, localTokenBalance, localSignMessage, resolveRpcUrl, } from './local-wallet.js';
-import { localSignAuthorization, localEthCall, localSignPermit2Upto } from './local-wallet.js';
+import { localSignAuthorization, localEthCall, localGetCode, localSignPermit2Upto } from './local-wallet.js';
 import { buildUptoAuthorization, uptoPayload, permit2AllowanceCalldata, permit2ApproveCalldata, decodeUint, PERMIT2_ADDRESS, } from './x402-permit2.js';
 import { assessTokenRisk } from './token-risk.js';
-import { isLegacyAgentWalletAccept, requiredAmount, buildAuthorization, buildPaymentPayload, buildPaymentPayloadRaw, paymentHeaderFor, parsePaymentRequired, parseSettlement, pickOption, knownTokenDomain, } from './x402-eip3009.js';
+import { isLegacyAgentWalletAccept, requiredAmount, buildAuthorization, buildPaymentPayload, buildPaymentPayloadRaw, paymentHeaderFor, parsePaymentRequired, parseSettlement, pickOption, knownTokenDomain, parseEip7702Delegation, erc1271ProbeCalldata, classifyErc1271Probe, } from './x402-eip3009.js';
 import { isSolanaLocalMode, getSolanaAddress, solanaWalletRecord, localSolBalance, localSplBalance, localSolTransfer, localSplTransfer, resolveSolanaRpc, } from './local-solana.js';
 /** True when either chain family is running non-custodially. */
 function anyLocalMode() {
@@ -128,6 +128,12 @@ async function routeLocally(path, method, body) {
             return NOT_HANDLED;
         return localEthCall(localChainId(body, qs), String(body?.to || ''), String(body?.data || '0x'));
     }
+    // POST /eth-get-code  (read-only; the payer's account code, checked for an EIP-7702 delegation before an x402 authorization)
+    if (method === 'POST' && rawPath === '/eth-get-code') {
+        if (!isLocalMode())
+            return NOT_HANDLED;
+        return localGetCode(localChainId(body, qs), String(body?.address || ''));
+    }
     // GET /wallets/{id}/balance
     if (method === 'GET' && /^\/wallets\/[^/]*\/balance$/.test(rawPath)) {
         const chainId = localChainId(body, qs);
@@ -461,7 +467,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.12.3',
+    version: '1.12.5',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. Private keys are encrypted server-side and never exposed — agents sign and broadcast transactions without ever touching raw keys.
 
@@ -994,6 +1000,39 @@ async function payerAddress(walletId) {
         throw new Error(`x402: could not resolve the EVM address of wallet ${walletId} (got "${a}").`);
     return a;
 }
+/**
+ * Best-effort look at the payer's account code. An EIP-7702 delegated EOA whose delegate
+ * does not implement ERC-1271 is declined by facilitators that check code before recovering
+ * the signer, with an error that reads like a signature fault (issue #9). Nothing is refused
+ * here: the authorization costs nothing to sign and other facilitators accept it. The result
+ * carries the warning so the agent can explain a signature-shaped rejection. A lookup failure
+ * (a hosted server without the route, RPC trouble) reports nothing rather than blocking the payment.
+ */
+async function payerDelegation(chainId, payer) {
+    try {
+        const r = (await api('/eth-get-code', 'POST', { chain_id: chainId, address: payer }, { 'X-AGW-SKIP-X402': 'true' }));
+        const delegate = parseEip7702Delegation(r?.code);
+        if (!delegate)
+            return null;
+        let erc1271 = 'unknown';
+        try {
+            const probe = (await api('/eth-call', 'POST', { chain_id: chainId, to: payer, data: erc1271ProbeCalldata() }, { 'X-AGW-SKIP-X402': 'true' }));
+            erc1271 = classifyErc1271Probe(probe?.result);
+        }
+        catch {
+            erc1271 = 'unknown';
+        }
+        const warning = erc1271 === 'no'
+            ? `Payer ${payer} is an EIP-7702 delegated account (delegate ${delegate}) and the delegate does not answer ERC-1271 isValidSignature. ` +
+                `Facilitators that check account code before recovering the signer decline this authorization with a signature error. ` +
+                `Pay from a plain EOA, or clear the delegation, for reliable x402 settlement.`
+            : `Payer ${payer} is an EIP-7702 delegated account (delegate ${delegate}); a facilitator may verify the authorization through ERC-1271 on the delegate.`;
+        return { delegate, erc1271, warning };
+    }
+    catch {
+        return null;
+    }
+}
 async function ethCallHex(chainId, to, data) {
     const r = (await api('/eth-call', 'POST', { chain_id: chainId, to, data }, { 'X-AGW-SKIP-X402': 'true' }));
     return String(r?.result || '');
@@ -1225,8 +1264,10 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     let uptoAuth = null;
     let payer = null;
     let permit2ApprovalTx = null;
+    let payerDelegationInfo = null;
     if (isUpto) {
         payer = await payerAddress(wallet_id);
+        payerDelegationInfo = await payerDelegation(chainId, payer);
         const allowance = decodeUint(await ethCallHex(chainId, tokenAddress, permit2AllowanceCalldata(payer)));
         if (allowance < BigInt(rawAmount)) {
             if (process.env.AGENTWALLET_PERMIT2_AUTO_APPROVE === '1') {
@@ -1253,6 +1294,7 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     }
     else if (standardExact) {
         payer = await payerAddress(wallet_id);
+        payerDelegationInfo = await payerDelegation(chainId, payer);
         const domain = await resolveTokenDomain(chainId, tokenAddress, option.extra);
         authorization = buildAuthorization(payer, option);
         const signature = await signAuthorization(wallet_id, chainId, tokenAddress, domain, authorization, approvalUsed);
@@ -1306,6 +1348,8 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     if (retryRes.status === 402) {
         const again = parsePaymentRequired(n => retryRes.headers.get(n), retryParsed);
         retryError = String(again?.error || retryParsed?.error || 'Payment was not accepted (no reason given).');
+        if (payerDelegationInfo && /signature/i.test(retryError))
+            retryError += ` Likely cause: ${payerDelegationInfo.warning}`;
     }
     return jsonResponse({
         status: retryRes.status,
@@ -1326,6 +1370,7 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
         chain_id: chainId,
         pay_to: option.payTo,
         payer,
+        payer_delegation: payerDelegationInfo,
         tx_hash: txHash ?? settlement?.transaction ?? null,
         settlement,
         authorization: authorization ? { nonce: authorization.nonce, valid_before: authorization.validBefore }

package/build/local-wallet.d.ts

@@ -108,6 +108,10 @@ export declare function localSignAuthorization(chainId: number, asset: Address,
 export declare function localEthCall(chainId: number, to: Address, data: Hex): Promise<{
     result: string;
 }>;
+/** Read-only eth_getCode against the local RPC, same shape as the hosted /eth-get-code route. */
+export declare function localGetCode(chainId: number, address: Address): Promise<{
+    code: string;
+}>;
 /** x402 "upto": sign a Permit2 max-authorization in-process. The maximum goes through the token cap like a transfer would. */
 export declare function localSignPermit2Upto(chainId: number, auth: UptoPermit2Authorization): Promise<{
     signature: `0x${string}`;

package/build/local-wallet.js

@@ -15,7 +15,7 @@
  * on the custodial path and say so explicitly rather than silently downgrading.
  */
 import { readFileSync } from 'node:fs';
-import { createPublicClient, createWalletClient, http, encodeFunctionData, parseAbi, formatUnits, } from 'viem';
+import { createPublicClient, createWalletClient, http, encodeFunctionData, parseAbi, formatUnits, BaseError, ContractFunctionZeroDataError, ContractFunctionRevertedError, ExecutionRevertedError, AbiDecodingDataSizeTooSmallError, AbiDecodingDataSizeInvalidError, } from 'viem';
 import { privateKeyToAccount } from 'viem/accounts';
 import { lookupTrustedDecimals } from './x402-payment.js';
 import { typedDataFor } from './x402-eip3009.js';
@@ -195,8 +195,7 @@ export async function localTokenBalance(chainId, token) {
 const decimalsCache = new Map();
 /**
  * Decimals for `token`: the trusted registry, then the contract's own
- * decimals() (cached on success). Null when the address does not answer like
- * an ERC-20 at all, which is how the guard tells a token from a router.
+ * decimals() (cached on success). See DecimalsProbe for the other outcomes.
  */
 async function probeTokenDecimals(chainId, token) {
     const known = lookupTrustedDecimals(chainId, token);
@@ -206,28 +205,47 @@ async function probeTokenDecimals(chainId, token) {
     const cached = decimalsCache.get(key);
     if (typeof cached === 'number')
         return cached;
+    let onChain;
     try {
         const { pub } = clients(chainId);
-        const onChain = await pub.readContract({
+        onChain = await pub.readContract({
             address: token,
             abi: ERC20_ABI,
             functionName: 'decimals',
         });
-        const d = Number(onChain);
-        // Reject nonsense rather than trusting it; an out-of-range value would
-        // widen the ceiling exactly like the old assumption did.
-        if (Number.isInteger(d) && d >= 0 && d <= 36) {
-            decimalsCache.set(key, d);
-            return d;
-        }
     }
-    catch {
-        // Unreachable RPC, non-standard token, not a token at all.
+    catch (err) {
+        // viem wraps every readContract failure in ContractFunctionExecutionError;
+        // the cause says whether the contract itself declined (revert, empty
+        // return: not an ERC-20) or the answer never arrived (RPC down, timeout,
+        // malformed response). Only the first is evidence of anything.
+        const declined = err instanceof BaseError && err.walk((e) => e instanceof ContractFunctionZeroDataError
+            || e instanceof ContractFunctionRevertedError
+            || e instanceof ExecutionRevertedError // nodes that report a revert as -32000 rather than 3
+        ) !== null;
+        if (declined)
+            return 'not-a-token';
+        // A decode failure on non-empty data means the contract answered
+        // decimals() with something that is not a uint8: a token, just a broken one.
+        const decodeFailed = err instanceof BaseError && err.walk((e) => e instanceof AbiDecodingDataSizeTooSmallError || e instanceof AbiDecodingDataSizeInvalidError) !== null;
+        return decodeFailed ? 'unusable' : 'unreachable';
     }
-    return null;
+    const d = Number(onChain);
+    // Reject nonsense rather than trusting it; an out-of-range value would
+    // widen the ceiling exactly like the old assumption did.
+    if (Number.isInteger(d) && d >= 0 && d <= 36) {
+        decimalsCache.set(key, d);
+        return d;
+    }
+    return 'unusable';
 }
+/**
+ * Decimals to price a known transfer or approval at. Anything short of a
+ * usable answer is evaluated at 0, the only value that cannot fail open.
+ */
 async function resolveTokenDecimals(chainId, token) {
-    return (await probeTokenDecimals(chainId, token)) ?? 0;
+    const probe = await probeTokenDecimals(chainId, token);
+    return typeof probe === 'number' ? probe : 0;
 }
 /** Canonical Permit2, the same address on every EVM chain it is deployed to. */
 const PERMIT2 = '0x000000000022d473030f116ddee9f6b43ac78ba3';
@@ -263,12 +281,18 @@ async function assertWithinTokenCap(chainId, to, data) {
     if (!priced) {
         if (process.env.AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS === '1')
             return;
-        const looksLikeToken = isPermit2 || (await probeTokenDecimals(chainId, to)) !== null;
-        if (looksLikeToken) {
-            throw new Error(`Blocked by local guard: calldata selector 0x${selector} sent to ` +
-                `${isPermit2 ? 'Permit2' : 'a token contract'} is not one AGENTWALLET_MAX_TX_TOKEN can price, ` +
-                `so it is refused rather than let through uncapped. Use transfer, transferFrom, approve, ` +
-                `increaseAllowance or Permit2 approve, or set AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS=1 to allow it deliberately.`);
+        // Only a contract that demonstrably declines decimals() is let through.
+        // "Answered nonsense" and "could not ask" both refuse: the first is a
+        // token with a broken or hostile decimals(), the second is no evidence at
+        // all, and this guard does not allow on no evidence (2026-09-26 report).
+        const probe = isPermit2 ? 'unusable' : await probeTokenDecimals(chainId, to);
+        if (probe !== 'not-a-token') {
+            const why = probe === 'unreachable'
+                ? `the RPC for chain ${chainId} could not be reached to classify the target, so the guard cannot tell a token from a router`
+                : `the target is ${isPermit2 ? 'Permit2' : 'a token contract'} and this calldata is not one AGENTWALLET_MAX_TX_TOKEN can price`;
+            throw new Error(`Blocked by local guard: calldata selector 0x${selector} refused rather than let through uncapped: ${why}. ` +
+                `Use transfer, transferFrom, approve, increaseAllowance or Permit2 approve, ` +
+                `or set AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS=1 to allow it deliberately.`);
         }
         return; // an ordinary contract call; it can only pull what an approval already allowed
     }
@@ -380,6 +404,12 @@ export async function localEthCall(chainId, to, data) {
     const r = await client.call({ to, data });
     return { result: r.data ?? '0x' };
 }
+/** Read-only eth_getCode against the local RPC, same shape as the hosted /eth-get-code route. */
+export async function localGetCode(chainId, address) {
+    const client = createPublicClient({ transport: http(resolveRpcUrl(chainId)) });
+    const code = await client.getCode({ address });
+    return { code: code ?? '0x' };
+}
 /** x402 "upto": sign a Permit2 max-authorization in-process. The maximum goes through the token cap like a transfer would. */
 export async function localSignPermit2Upto(chainId, auth) {
     const token = auth.permitted.token;

package/build/x402-eip3009.d.ts

@@ -169,3 +169,22 @@ export declare function pickOption(accepts: X402Requirement[], resolveChainId: (
     chainId: number | null;
     reason?: string;
 };
+/**
+ * An EIP-7702 delegated EOA has code 0xef0100 || delegate (23 bytes). A facilitator that
+ * checks account code before recovering the signer treats such a payer as a contract
+ * wallet and calls ERC-1271 isValidSignature on it; a delegate that does not implement
+ * it answers with empty data, and the payment is declined with a signature-shaped error
+ * that has nothing to do with the signature (issue #9: a well-known test key that
+ * sweeper bots had delegated on Base mainnet).
+ */
+export declare function parseEip7702Delegation(code: string | null | undefined): string | null;
+export declare const ERC1271_MAGIC = "0x1626ba7e";
+/** Calldata for isValidSignature(bytes32, bytes) with a placeholder hash and a 65-byte placeholder signature. */
+export declare function erc1271ProbeCalldata(): `0x${string}`;
+export type Erc1271Support = 'yes' | 'no' | 'unknown';
+/**
+ * Classify an isValidSignature probe. Empty return data means the account has no such
+ * function (the failure shape from issue #9); a 4-byte word means the interface exists,
+ * whatever it thought of the placeholder signature; a revert or transport failure is unknown.
+ */
+export declare function classifyErc1271Probe(result: string | null | undefined, failed?: boolean): Erc1271Support;

package/build/x402-eip3009.js

@@ -205,3 +205,40 @@ export function pickOption(accepts, resolveChainId, preferChain) {
         option = payable.find(a => resolveChainId(a.network) === preferChain) ?? option;
     return { option, chainId: resolveChainId(option.network) };
 }
+// ─── Payer account shape (EIP-7702) ──────────────────────────────
+/**
+ * An EIP-7702 delegated EOA has code 0xef0100 || delegate (23 bytes). A facilitator that
+ * checks account code before recovering the signer treats such a payer as a contract
+ * wallet and calls ERC-1271 isValidSignature on it; a delegate that does not implement
+ * it answers with empty data, and the payment is declined with a signature-shaped error
+ * that has nothing to do with the signature (issue #9: a well-known test key that
+ * sweeper bots had delegated on Base mainnet).
+ */
+export function parseEip7702Delegation(code) {
+    const m = /^0xef0100([0-9a-f]{40})$/.exec(String(code || '').toLowerCase());
+    return m ? `0x${m[1]}` : null;
+}
+export const ERC1271_MAGIC = '0x1626ba7e';
+/** Calldata for isValidSignature(bytes32, bytes) with a placeholder hash and a 65-byte placeholder signature. */
+export function erc1271ProbeCalldata() {
+    const hash = '11'.repeat(32);
+    const offset = (64).toString(16).padStart(64, '0');
+    const length = (65).toString(16).padStart(64, '0');
+    const sig = 'aa'.repeat(65).padEnd(192, '0');
+    return `${ERC1271_MAGIC}${hash}${offset}${length}${sig}`;
+}
+/**
+ * Classify an isValidSignature probe. Empty return data means the account has no such
+ * function (the failure shape from issue #9); a 4-byte word means the interface exists,
+ * whatever it thought of the placeholder signature; a revert or transport failure is unknown.
+ */
+export function classifyErc1271Probe(result, failed = false) {
+    if (failed)
+        return 'unknown';
+    const r = String(result || '').toLowerCase();
+    if (r === '' || r === '0x')
+        return 'no';
+    if (/^0x[0-9a-f]{8}0{56}$/.test(r))
+        return 'yes';
+    return 'unknown';
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agentwallet-mcp",
   "mcpName": "io.github.hifriendbot/agentwallet",
-  "version": "1.12.3",
+  "version": "1.12.5",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",
@@ -16,7 +16,7 @@
   "scripts": {
     "build": "tsc",
     "start": "node build/index.js",
-    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs",
+    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs",
     "prepublishOnly": "npm run build"
   },
   "keywords": [