agentwallet-mcp 1.13.1 → 1.13.3

package/README.md

@@ -245,7 +245,7 @@ pay_x402(
 
 **Schemes.** `exact` (EIP-3009, gasless for the payer) is preferred and works on every EVM chain AgentWallet knows. `upto` (a Permit2 maximum the seller settles at actual usage) is signed as a `PermitWitnessTransferFrom` bound to the endpoint's facilitator; it needs a one-time `approve_permit2` per token (or `AGENTWALLET_PERMIT2_AUTO_APPROVE=1`). An `upto` option without `extra.facilitatorAddress` is refused, never approximated with an upfront transfer. Native-asset and Solana requests, and AgentWallet's own paywalls, are paid by an on-chain transfer proved by transaction hash, which is what those servers verify.
 
-**Approvals above the cap.** On a hosted wallet, a payment above the cap does not have to fail. With `request_approval` (default on; `AGENTWALLET_APPROVALS=0` turns it off) the wallet owner gets an email with approve and deny links, `pay_x402` returns an `approval_id`, and the agent retries with it once `check_approval` says approved. An approval is bound to one wallet, chain, asset, recipient and maximum, expires in 24 hours, and is consumed by one signature. Local mode has no approval channel: the caps in your environment are the policy.
+**Approvals above the cap.** On a hosted wallet, a payment above the cap does not have to fail. With `request_approval` (default on; `AGENTWALLET_APPROVALS=0` turns it off) the wallet owner gets an email with approve and deny links, `pay_x402` returns an `approval_id`, and the agent retries with it once `check_approval` says approved. An approval is bound to one wallet, chain, asset, recipient and maximum, expires in 24 hours, and is consumed by one signature. Local mode has no approval channel: the caps in your environment are the policy, and an `approval_id` passed there is refused.
 
 **Asset risk.** `check_token_risk` (and every `approve_token` result) reports honeypot, tax, owner-power, verified-source, holder-concentration and liquidity flags from GoPlus Security, with an on-chain fallback. A warning for the caller to weigh, never a block.
 

package/build/index.js

@@ -13,7 +13,7 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { z } from 'zod';
 import { assertPublicUrl, safeFetch, FINAL_URL_HEADER } from './ssrf-guard.js';
-import { deriveX402Payment, isWithinCap, lookupTrustedDecimals, assertDeclaredDecimals, nativeDecimals, SOLANA_CHAIN_IDS, assetLabel, autopayAssetAllowed, autopayEnvCap, effectiveAutopayCap, maxAuthWindowSeconds, parseDecimalPins, } from './x402-payment.js';
+import { deriveX402Payment, isWithinCap, lookupTrustedDecimals, assertDeclaredDecimals, nativeDecimals, SOLANA_CHAIN_IDS, assetLabel, autopayAssetAllowed, autopayEnvCap, effectiveAutopayCap, maxAuthWindowSeconds, parseDecimalPins, approvalRefusal, } from './x402-payment.js';
 import { isLocalMode, getLocalAddress, localWalletRecord, localSend, localNativeBalance, localTokenBalance, localSignMessage, resolveRpcUrl, } from './local-wallet.js';
 import { localSignAuthorization, localEthCall, localGetCode, localSignPermit2Upto } from './local-wallet.js';
 import { WRAPPED_NATIVE } from './wrapped-native.js';
@@ -561,7 +561,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.13.1',
+    version: '1.13.3',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. ${anyLocalMode()
         ? 'This server runs in LOCAL (self-custody) mode: the operator supplied the key, signing happens in this process, and the only spend guards are the AGENTWALLET_MAX_TX_* environment caps. There is no server-side pause, daily limit or approval email; pause_wallet, unpause_wallet and delete_wallet are refused.'
@@ -1370,13 +1370,14 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
         };
         const wantApproval = request_approval ?? (process.env.AGENTWALLET_APPROVALS !== '0');
         if (approval_id) {
-            const a = (await api(`/approvals/${encodeURIComponent(approval_id)}`, 'GET', undefined, skip));
-            if (a?.status !== 'approved' || Number(a.used) === 1) {
-                return jsonResponse({ ...overCap, approval_id, approval_status: a?.status ?? null, error: `Approval ${approval_id} is ${a?.status ?? 'unknown'}, not approved.${a?.error ? ' ' + a.error : ''}` });
-            }
-            const sameAsset = String(a.asset ?? '').toLowerCase() === tokenAddress.toLowerCase();
-            if (!sameAsset || String(a.pay_to || '').toLowerCase() !== option.payTo.toLowerCase() || Number(a.chain_id) !== chainId || BigInt(String(a.value || '0')) < BigInt(rawAmount)) {
-                return jsonResponse({ ...overCap, approval_id, error: 'Approval does not cover this payment (asset, recipient, chain or amount differ).' });
+            // Local mode refuses before any lookup: only the hosted signer can consume
+            // an approval, so here the same id would lift the cap on every call.
+            const want = { walletId: wallet_id, chainId, asset: tokenAddress, payTo: option.payTo, rawAmount };
+            const local = anyLocalMode();
+            const a = local ? null : (await api(`/approvals/${encodeURIComponent(approval_id)}`, 'GET', undefined, skip));
+            const refusal = approvalRefusal(approval_id, a, want, local);
+            if (refusal) {
+                return jsonResponse({ ...overCap, approval_id, ...refusal });
             }
             approvalUsed = String(approval_id);
         }

package/build/local-solana.d.ts

@@ -23,6 +23,16 @@ export declare function localSolBalance(chainId?: number): Promise<{
     balance: string;
     mode: string;
 }>;
+/**
+ * Bytes the Associated Token Account program allocates for a new token account
+ * of this mint. Classic SPL is always 165. Token-2022 adds an account-type byte
+ * and one TLV entry per account extension: ImmutableOwner on every associated
+ * account, plus whatever the mint's own extensions require.
+ *
+ * The rent charged follows this size, so the SOL cap has to be checked against
+ * it. A flat 165 under-counted every Token-2022 account (2026-10-02 report).
+ */
+export declare function associatedAccountSize(token2022: boolean, mintData: Uint8Array): number;
 export declare function localSplBalance(mintStr: string, chainId?: number): Promise<{
     address: string;
     chain_id: number;

package/build/local-solana.js

@@ -222,14 +222,69 @@ export async function localSolBalance(chainId = 900) {
         mode: 'local',
     };
 }
-/** Which token program owns this mint: classic SPL or Token-2022. */
-async function tokenProgramFor(conn, mint) {
+/** Which token program owns this mint, and how big a token account for it is. */
+async function mintLayout(conn, mint) {
     const info = await conn.getAccountInfo(mint);
     if (!info)
         throw new Error(`Mint ${mint.toBase58()} not found on this cluster.`);
-    if (info.owner.equals(TOKEN_2022_PROGRAM))
-        return TOKEN_2022_PROGRAM;
-    return TOKEN_PROGRAM;
+    const token2022 = info.owner.equals(TOKEN_2022_PROGRAM);
+    return {
+        tokenProgram: token2022 ? TOKEN_2022_PROGRAM : TOKEN_PROGRAM,
+        ataSize: associatedAccountSize(token2022, info.data),
+    };
+}
+/** Which token program owns this mint: classic SPL or Token-2022. */
+async function tokenProgramFor(conn, mint) {
+    return (await mintLayout(conn, mint)).tokenProgram;
+}
+/* Token-2022 mint extensions that make every token account for the mint carry
+   an extension of its own, and the size of that account extension's value.
+   Mirrors required_init_account_extensions in the token-2022 program. */
+const ACCOUNT_EXTENSION_FOR_MINT_EXTENSION = {
+    1: 8, // TransferFeeConfig -> TransferFeeAmount (withheld amount, u64)
+    9: 0, // NonTransferable   -> NonTransferableAccount (plus ImmutableOwner, always present below)
+    14: 1, // TransferHook      -> TransferHookAccount (one flag byte)
+    26: 0, // Pausable          -> PausableAccount
+};
+/** Highest extension type this table was written against (PermissionedBurn). */
+const HIGHEST_KNOWN_EXTENSION = 28;
+/** Charged for a mint extension newer than the table, so the estimate errs high, never low. */
+const UNKNOWN_EXTENSION_ALLOWANCE = 64;
+const TLV_HEADER = 4; // u16 type + u16 length
+const MULTISIG_SIZE = 355; // the program pads an account that would collide with a multisig's size
+/**
+ * Bytes the Associated Token Account program allocates for a new token account
+ * of this mint. Classic SPL is always 165. Token-2022 adds an account-type byte
+ * and one TLV entry per account extension: ImmutableOwner on every associated
+ * account, plus whatever the mint's own extensions require.
+ *
+ * The rent charged follows this size, so the SOL cap has to be checked against
+ * it. A flat 165 under-counted every Token-2022 account (2026-10-02 report).
+ */
+export function associatedAccountSize(token2022, mintData) {
+    if (!token2022)
+        return TOKEN_ACCOUNT_SIZE;
+    let tlvBytes = TLV_HEADER; // ImmutableOwner, zero-length value
+    const seen = new Set();
+    // Mint layout: 82 bytes of base state padded to 165, the account-type byte, then TLV entries.
+    let offset = TOKEN_ACCOUNT_SIZE + 1;
+    while (offset + TLV_HEADER <= mintData.length) {
+        const type = mintData[offset] | (mintData[offset + 1] << 8);
+        const length = mintData[offset + 2] | (mintData[offset + 3] << 8);
+        if (type === 0)
+            break; // uninitialized: the rest is padding
+        if (!seen.has(type)) {
+            seen.add(type);
+            const accountValue = ACCOUNT_EXTENSION_FOR_MINT_EXTENSION[type];
+            if (accountValue !== undefined)
+                tlvBytes += TLV_HEADER + accountValue;
+            else if (type > HIGHEST_KNOWN_EXTENSION)
+                tlvBytes += TLV_HEADER + UNKNOWN_EXTENSION_ALLOWANCE;
+        }
+        offset += TLV_HEADER + length;
+    }
+    const size = TOKEN_ACCOUNT_SIZE + 1 + tlvBytes;
+    return size === MULTISIG_SIZE ? size + 2 : size;
 }
 function associatedTokenAddress(owner, mint, tokenProgram) {
     const [ata] = PublicKey.findProgramAddressSync([owner.toBuffer(), tokenProgram.toBuffer(), mint.toBuffer()], ASSOCIATED_TOKEN_PROGRAM);
@@ -327,7 +382,7 @@ export async function localSplTransfer(mintStr, to, rawAmount, decimals, chainId
     const mint = new PublicKey(mintStr);
     const recipient = new PublicKey(to);
     await assertRecipientIsWallet(conn, recipient);
-    const tokenProgram = await tokenProgramFor(conn, mint);
+    const { tokenProgram, ataSize } = await mintLayout(conn, mint);
     // The instruction's decimals byte is the mint's real value, not whatever the
     // caller passed; TransferChecked would reject a wrong one on-chain anyway.
     decimals = await resolveMintDecimals(mintStr, chainId);
@@ -338,7 +393,8 @@ export async function localSplTransfer(mintStr, to, rawAmount, decimals, chainId
     if (!destInfo) {
         // Creating the recipient's token account costs the payer rent in SOL, an
         // outflow the SOL cap must see (0.002 SOL a time adds up over many sends).
-        const rent = await conn.getMinimumBalanceForRentExemption(TOKEN_ACCOUNT_SIZE);
+        // Rent follows the account's real size, which for Token-2022 is above 165.
+        const rent = await conn.getMinimumBalanceForRentExemption(ataSize);
         assertWithinSolCap(BigInt(rent));
         tx.add(createAtaIdempotentIx(payer.publicKey, destAta, recipient, mint, tokenProgram));
     }
@@ -355,10 +411,19 @@ export async function localSplTransfer(mintStr, to, rawAmount, decimals, chainId
     };
 }
 const TOKEN_ACCOUNT_SIZE = 165;
+const MINT_SIZE = 82;
+/** Token-2022 pads a mint to the token-account size and tags the next byte: 1 = mint, 2 = token account. */
+const TOKEN_2022_TYPE_MINT = 1;
 /**
  * A recipient must be something that can own a token account: a wallet or a
- * program-derived wallet (Squads and friends), never a program and never a
- * token account. SPL sent to ATA(ATA) or to a program id is gone for good.
+ * program-derived wallet (Squads and friends), never a program and never an
+ * account the token programs own. SPL sent to ATA(ATA), ATA(mint) or a program
+ * id is gone for good, or belongs to whoever kept the mint's keypair.
+ *
+ * Ownership alone decides. A length gate (>= 165 bytes) used to sit here and
+ * let an 82-byte mint through as a "wallet" (2026-10-02 report): everything
+ * the token programs own is a mint, a token account or a multisig, and none
+ * of those is a wallet.
  */
 async function assertRecipientIsWallet(conn, recipient) {
     const info = await conn.getAccountInfo(recipient);
@@ -366,8 +431,16 @@ async function assertRecipientIsWallet(conn, recipient) {
         return; // never seen on chain: an ordinary fresh wallet
     if (info.executable)
         throw new Error(`Refusing to send to ${recipient.toBase58()}: it is a program, not a wallet.`);
-    if ((info.owner.equals(TOKEN_PROGRAM) || info.owner.equals(TOKEN_2022_PROGRAM)) && info.data.length >= TOKEN_ACCOUNT_SIZE) {
-        throw new Error(`Refusing to send to ${recipient.toBase58()}: it is a token account, not a wallet. Pass the owner's wallet address instead.`);
+    if (info.owner.equals(TOKEN_PROGRAM) || info.owner.equals(TOKEN_2022_PROGRAM)) {
+        const isMint = info.data.length === MINT_SIZE
+            || (info.data.length > TOKEN_ACCOUNT_SIZE && info.data[TOKEN_ACCOUNT_SIZE] === TOKEN_2022_TYPE_MINT);
+        if (isMint) {
+            throw new Error(`Refusing to send to ${recipient.toBase58()}: it is a token mint, not a wallet. Pass the recipient's wallet address; the mint belongs in token_mint.`);
+        }
+        if (info.data.length >= TOKEN_ACCOUNT_SIZE) {
+            throw new Error(`Refusing to send to ${recipient.toBase58()}: it is a token account, not a wallet. Pass the owner's wallet address instead.`);
+        }
+        throw new Error(`Refusing to send to ${recipient.toBase58()}: it is an account owned by the SPL token program, not a wallet.`);
     }
 }
 export function solanaWalletRecord() {

package/build/x402-payment.d.ts

@@ -163,3 +163,35 @@ export declare const SOLANA_CHAIN_IDS: ReadonlySet<number>;
  */
 export declare function nativeDecimals(chainId: number): number;
 export declare function isWithinCap(rawAmountRequired: string, trustedDecimals: number, capHuman: string): boolean;
+/** The row GET /approvals/{id} answers with. Numbers arrive as strings from the server. */
+export interface ApprovalRow {
+    status?: string;
+    used?: number | string;
+    wallet_id?: number | string;
+    chain_id?: number | string;
+    asset?: string;
+    pay_to?: string;
+    value?: string;
+    error?: string;
+}
+export interface ApprovalWant {
+    walletId: number;
+    chainId: number;
+    asset: string;
+    payTo: string;
+    rawAmount: string;
+}
+/**
+ * Why an approval cannot stand in for the cap on this payment, or null when it can.
+ *
+ * An approval is single-use because the hosted signer marks it used in the same
+ * request that signs. A local signer never talks to that server, so in local
+ * mode nothing could ever consume one and the same id would lift the cap again
+ * on every call (2026-10-02 report). Local mode therefore refuses approvals
+ * outright, before any lookup. For a hosted wallet every bound field is checked
+ * here, the wallet included, and the server checks them again when it signs.
+ */
+export declare function approvalRefusal(approvalId: string, row: ApprovalRow | null | undefined, want: ApprovalWant, localMode: boolean): {
+    error: string;
+    approval_status?: string | null;
+} | null;

package/build/x402-payment.js

@@ -324,3 +324,37 @@ export function isWithinCap(rawAmountRequired, trustedDecimals, capHuman) {
     const capRaw = toBaseUnits(capHuman, trustedDecimals);
     return BigInt(rawAmountRequired) <= BigInt(capRaw);
 }
+/**
+ * Why an approval cannot stand in for the cap on this payment, or null when it can.
+ *
+ * An approval is single-use because the hosted signer marks it used in the same
+ * request that signs. A local signer never talks to that server, so in local
+ * mode nothing could ever consume one and the same id would lift the cap again
+ * on every call (2026-10-02 report). Local mode therefore refuses approvals
+ * outright, before any lookup. For a hosted wallet every bound field is checked
+ * here, the wallet included, and the server checks them again when it signs.
+ */
+export function approvalRefusal(approvalId, row, want, localMode) {
+    if (localMode) {
+        return {
+            error: `Approval ${approvalId} cannot be used in local mode: approvals are consumed by the hosted signer, and this server signs with your own key, so nothing could mark it used. Local mode has no approval channel: raise AGENTWALLET_MAX_AUTOPAY or AGENTWALLET_MAX_TX_TOKEN yourself.`,
+        };
+    }
+    const status = row?.status ?? null;
+    // "used" must read as exactly 0. A missing or unparseable field refuses rather than passes.
+    if (status !== 'approved' || Number(row?.used) !== 0) {
+        const state = status === 'approved' ? 'already used' : `${status ?? 'unknown'}, not approved`;
+        return { approval_status: status, error: `Approval ${approvalId} is ${state}.${row?.error ? ' ' + row.error : ''}` };
+    }
+    const value = String(row?.value ?? '');
+    const covers = Number(row?.wallet_id) === want.walletId
+        && Number(row?.chain_id) === want.chainId
+        && String(row?.asset ?? '').toLowerCase() === want.asset.toLowerCase()
+        && String(row?.pay_to ?? '').toLowerCase() === want.payTo.toLowerCase()
+        && /^\d+$/.test(value) && /^\d+$/.test(want.rawAmount)
+        && BigInt(value) >= BigInt(want.rawAmount);
+    if (!covers) {
+        return { error: 'Approval does not cover this payment (wallet, asset, recipient, chain or amount differ).' };
+    }
+    return null;
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agentwallet-mcp",
   "mcpName": "io.github.hifriendbot/agentwallet",
-  "version": "1.13.1",
+  "version": "1.13.3",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",
@@ -16,7 +16,7 @@
   "scripts": {
     "build": "tsc",
     "start": "node build/index.js",
-    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs",
+    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs && node test/ata-rent-size.test.mjs",
     "prepublishOnly": "npm run build"
   },
   "keywords": [