agentwallet-mcp 1.13.1 → 1.13.2

package/README.md

@@ -245,7 +245,7 @@ pay_x402(
 
 **Schemes.** `exact` (EIP-3009, gasless for the payer) is preferred and works on every EVM chain AgentWallet knows. `upto` (a Permit2 maximum the seller settles at actual usage) is signed as a `PermitWitnessTransferFrom` bound to the endpoint's facilitator; it needs a one-time `approve_permit2` per token (or `AGENTWALLET_PERMIT2_AUTO_APPROVE=1`). An `upto` option without `extra.facilitatorAddress` is refused, never approximated with an upfront transfer. Native-asset and Solana requests, and AgentWallet's own paywalls, are paid by an on-chain transfer proved by transaction hash, which is what those servers verify.
 
-**Approvals above the cap.** On a hosted wallet, a payment above the cap does not have to fail. With `request_approval` (default on; `AGENTWALLET_APPROVALS=0` turns it off) the wallet owner gets an email with approve and deny links, `pay_x402` returns an `approval_id`, and the agent retries with it once `check_approval` says approved. An approval is bound to one wallet, chain, asset, recipient and maximum, expires in 24 hours, and is consumed by one signature. Local mode has no approval channel: the caps in your environment are the policy.
+**Approvals above the cap.** On a hosted wallet, a payment above the cap does not have to fail. With `request_approval` (default on; `AGENTWALLET_APPROVALS=0` turns it off) the wallet owner gets an email with approve and deny links, `pay_x402` returns an `approval_id`, and the agent retries with it once `check_approval` says approved. An approval is bound to one wallet, chain, asset, recipient and maximum, expires in 24 hours, and is consumed by one signature. Local mode has no approval channel: the caps in your environment are the policy, and an `approval_id` passed there is refused.
 
 **Asset risk.** `check_token_risk` (and every `approve_token` result) reports honeypot, tax, owner-power, verified-source, holder-concentration and liquidity flags from GoPlus Security, with an on-chain fallback. A warning for the caller to weigh, never a block.
 

package/build/index.js

@@ -13,7 +13,7 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { z } from 'zod';
 import { assertPublicUrl, safeFetch, FINAL_URL_HEADER } from './ssrf-guard.js';
-import { deriveX402Payment, isWithinCap, lookupTrustedDecimals, assertDeclaredDecimals, nativeDecimals, SOLANA_CHAIN_IDS, assetLabel, autopayAssetAllowed, autopayEnvCap, effectiveAutopayCap, maxAuthWindowSeconds, parseDecimalPins, } from './x402-payment.js';
+import { deriveX402Payment, isWithinCap, lookupTrustedDecimals, assertDeclaredDecimals, nativeDecimals, SOLANA_CHAIN_IDS, assetLabel, autopayAssetAllowed, autopayEnvCap, effectiveAutopayCap, maxAuthWindowSeconds, parseDecimalPins, approvalRefusal, } from './x402-payment.js';
 import { isLocalMode, getLocalAddress, localWalletRecord, localSend, localNativeBalance, localTokenBalance, localSignMessage, resolveRpcUrl, } from './local-wallet.js';
 import { localSignAuthorization, localEthCall, localGetCode, localSignPermit2Upto } from './local-wallet.js';
 import { WRAPPED_NATIVE } from './wrapped-native.js';
@@ -561,7 +561,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.13.1',
+    version: '1.13.2',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. ${anyLocalMode()
         ? 'This server runs in LOCAL (self-custody) mode: the operator supplied the key, signing happens in this process, and the only spend guards are the AGENTWALLET_MAX_TX_* environment caps. There is no server-side pause, daily limit or approval email; pause_wallet, unpause_wallet and delete_wallet are refused.'
@@ -1370,13 +1370,14 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
         };
         const wantApproval = request_approval ?? (process.env.AGENTWALLET_APPROVALS !== '0');
         if (approval_id) {
-            const a = (await api(`/approvals/${encodeURIComponent(approval_id)}`, 'GET', undefined, skip));
-            if (a?.status !== 'approved' || Number(a.used) === 1) {
-                return jsonResponse({ ...overCap, approval_id, approval_status: a?.status ?? null, error: `Approval ${approval_id} is ${a?.status ?? 'unknown'}, not approved.${a?.error ? ' ' + a.error : ''}` });
-            }
-            const sameAsset = String(a.asset ?? '').toLowerCase() === tokenAddress.toLowerCase();
-            if (!sameAsset || String(a.pay_to || '').toLowerCase() !== option.payTo.toLowerCase() || Number(a.chain_id) !== chainId || BigInt(String(a.value || '0')) < BigInt(rawAmount)) {
-                return jsonResponse({ ...overCap, approval_id, error: 'Approval does not cover this payment (asset, recipient, chain or amount differ).' });
+            // Local mode refuses before any lookup: only the hosted signer can consume
+            // an approval, so here the same id would lift the cap on every call.
+            const want = { walletId: wallet_id, chainId, asset: tokenAddress, payTo: option.payTo, rawAmount };
+            const local = anyLocalMode();
+            const a = local ? null : (await api(`/approvals/${encodeURIComponent(approval_id)}`, 'GET', undefined, skip));
+            const refusal = approvalRefusal(approval_id, a, want, local);
+            if (refusal) {
+                return jsonResponse({ ...overCap, approval_id, ...refusal });
             }
             approvalUsed = String(approval_id);
         }

package/build/local-solana.js

@@ -355,10 +355,19 @@ export async function localSplTransfer(mintStr, to, rawAmount, decimals, chainId
     };
 }
 const TOKEN_ACCOUNT_SIZE = 165;
+const MINT_SIZE = 82;
+/** Token-2022 pads a mint to the token-account size and tags the next byte: 1 = mint, 2 = token account. */
+const TOKEN_2022_TYPE_MINT = 1;
 /**
  * A recipient must be something that can own a token account: a wallet or a
- * program-derived wallet (Squads and friends), never a program and never a
- * token account. SPL sent to ATA(ATA) or to a program id is gone for good.
+ * program-derived wallet (Squads and friends), never a program and never an
+ * account the token programs own. SPL sent to ATA(ATA), ATA(mint) or a program
+ * id is gone for good, or belongs to whoever kept the mint's keypair.
+ *
+ * Ownership alone decides. A length gate (>= 165 bytes) used to sit here and
+ * let an 82-byte mint through as a "wallet" (2026-10-02 report): everything
+ * the token programs own is a mint, a token account or a multisig, and none
+ * of those is a wallet.
  */
 async function assertRecipientIsWallet(conn, recipient) {
     const info = await conn.getAccountInfo(recipient);
@@ -366,8 +375,16 @@ async function assertRecipientIsWallet(conn, recipient) {
         return; // never seen on chain: an ordinary fresh wallet
     if (info.executable)
         throw new Error(`Refusing to send to ${recipient.toBase58()}: it is a program, not a wallet.`);
-    if ((info.owner.equals(TOKEN_PROGRAM) || info.owner.equals(TOKEN_2022_PROGRAM)) && info.data.length >= TOKEN_ACCOUNT_SIZE) {
-        throw new Error(`Refusing to send to ${recipient.toBase58()}: it is a token account, not a wallet. Pass the owner's wallet address instead.`);
+    if (info.owner.equals(TOKEN_PROGRAM) || info.owner.equals(TOKEN_2022_PROGRAM)) {
+        const isMint = info.data.length === MINT_SIZE
+            || (info.data.length > TOKEN_ACCOUNT_SIZE && info.data[TOKEN_ACCOUNT_SIZE] === TOKEN_2022_TYPE_MINT);
+        if (isMint) {
+            throw new Error(`Refusing to send to ${recipient.toBase58()}: it is a token mint, not a wallet. Pass the recipient's wallet address; the mint belongs in token_mint.`);
+        }
+        if (info.data.length >= TOKEN_ACCOUNT_SIZE) {
+            throw new Error(`Refusing to send to ${recipient.toBase58()}: it is a token account, not a wallet. Pass the owner's wallet address instead.`);
+        }
+        throw new Error(`Refusing to send to ${recipient.toBase58()}: it is an account owned by the SPL token program, not a wallet.`);
     }
 }
 export function solanaWalletRecord() {

package/build/x402-payment.d.ts

@@ -163,3 +163,35 @@ export declare const SOLANA_CHAIN_IDS: ReadonlySet<number>;
  */
 export declare function nativeDecimals(chainId: number): number;
 export declare function isWithinCap(rawAmountRequired: string, trustedDecimals: number, capHuman: string): boolean;
+/** The row GET /approvals/{id} answers with. Numbers arrive as strings from the server. */
+export interface ApprovalRow {
+    status?: string;
+    used?: number | string;
+    wallet_id?: number | string;
+    chain_id?: number | string;
+    asset?: string;
+    pay_to?: string;
+    value?: string;
+    error?: string;
+}
+export interface ApprovalWant {
+    walletId: number;
+    chainId: number;
+    asset: string;
+    payTo: string;
+    rawAmount: string;
+}
+/**
+ * Why an approval cannot stand in for the cap on this payment, or null when it can.
+ *
+ * An approval is single-use because the hosted signer marks it used in the same
+ * request that signs. A local signer never talks to that server, so in local
+ * mode nothing could ever consume one and the same id would lift the cap again
+ * on every call (2026-10-02 report). Local mode therefore refuses approvals
+ * outright, before any lookup. For a hosted wallet every bound field is checked
+ * here, the wallet included, and the server checks them again when it signs.
+ */
+export declare function approvalRefusal(approvalId: string, row: ApprovalRow | null | undefined, want: ApprovalWant, localMode: boolean): {
+    error: string;
+    approval_status?: string | null;
+} | null;

package/build/x402-payment.js

@@ -324,3 +324,37 @@ export function isWithinCap(rawAmountRequired, trustedDecimals, capHuman) {
     const capRaw = toBaseUnits(capHuman, trustedDecimals);
     return BigInt(rawAmountRequired) <= BigInt(capRaw);
 }
+/**
+ * Why an approval cannot stand in for the cap on this payment, or null when it can.
+ *
+ * An approval is single-use because the hosted signer marks it used in the same
+ * request that signs. A local signer never talks to that server, so in local
+ * mode nothing could ever consume one and the same id would lift the cap again
+ * on every call (2026-10-02 report). Local mode therefore refuses approvals
+ * outright, before any lookup. For a hosted wallet every bound field is checked
+ * here, the wallet included, and the server checks them again when it signs.
+ */
+export function approvalRefusal(approvalId, row, want, localMode) {
+    if (localMode) {
+        return {
+            error: `Approval ${approvalId} cannot be used in local mode: approvals are consumed by the hosted signer, and this server signs with your own key, so nothing could mark it used. Local mode has no approval channel: raise AGENTWALLET_MAX_AUTOPAY or AGENTWALLET_MAX_TX_TOKEN yourself.`,
+        };
+    }
+    const status = row?.status ?? null;
+    // "used" must read as exactly 0. A missing or unparseable field refuses rather than passes.
+    if (status !== 'approved' || Number(row?.used) !== 0) {
+        const state = status === 'approved' ? 'already used' : `${status ?? 'unknown'}, not approved`;
+        return { approval_status: status, error: `Approval ${approvalId} is ${state}.${row?.error ? ' ' + row.error : ''}` };
+    }
+    const value = String(row?.value ?? '');
+    const covers = Number(row?.wallet_id) === want.walletId
+        && Number(row?.chain_id) === want.chainId
+        && String(row?.asset ?? '').toLowerCase() === want.asset.toLowerCase()
+        && String(row?.pay_to ?? '').toLowerCase() === want.payTo.toLowerCase()
+        && /^\d+$/.test(value) && /^\d+$/.test(want.rawAmount)
+        && BigInt(value) >= BigInt(want.rawAmount);
+    if (!covers) {
+        return { error: 'Approval does not cover this payment (wallet, asset, recipient, chain or amount differ).' };
+    }
+    return null;
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agentwallet-mcp",
   "mcpName": "io.github.hifriendbot/agentwallet",
-  "version": "1.13.1",
+  "version": "1.13.2",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",
@@ -16,7 +16,7 @@
   "scripts": {
     "build": "tsc",
     "start": "node build/index.js",
-    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs",
+    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs",
     "prepublishOnly": "npm run build"
   },
   "keywords": [