agentwallet-mcp 1.13.10 → 1.13.12

package/README.md

@@ -39,7 +39,7 @@ Run `wallet_mode` at any time and the server will tell you which one you are in,
 
 Use `AGENTWALLET_KEYFILE=/path/to/key` instead if you would rather keep the key out of your shell config (one or the other: the server refuses to start when both are set). The key is read once, never written to disk, never logged, and never included in an error message.
 
-`AGENTWALLET_RPC_<chainId>` (or `AGENTWALLET_RPC_URL` for all chains) points at an endpoint you trust. Without it a public RPC is used, and a public RPC can see which addresses you ask about.
+`AGENTWALLET_RPC_<chainId>` (or `AGENTWALLET_RPC_URL` for all chains) points at an endpoint you trust (https; plain http only on localhost). Without it a public RPC is used, and a public RPC can see which addresses you ask about. Decimals for a token outside the registry come from that RPC and are accepted only up to 18; pin anything else with `AGENTWALLET_TOKEN_DECIMALS`.
 
 `AGENTWALLET_MAX_TX_NATIVE` is a per-transaction ceiling in native units (ETH, MATIC and so on). In hosted mode the server enforces limits; in local mode there is no server, so these guards are the only ones there are. Set them.
 
@@ -330,6 +330,7 @@ Which guards apply depends on who holds the key.
 **Local mode** (you hold the key): there is no server in the signing path, so the server-side limits and pause above cannot see or stop a locally signed transaction, and nobody (including us) can freeze a local wallet. Your protection is the per-transaction caps enforced inside your own process before anything is signed. Set them before you fund the wallet; an unset cap means no limit.
 
 - `AGENTWALLET_MAX_TX_NATIVE`: ceiling per transaction in native units (ETH, MATIC, and so on)
+- `AGENTWALLET_MAX_FEE_NATIVE`: the most one transaction may burn in fees, gas x max fee per gas, in native units (default `0.01`). The value cap alone did not bound fees: a node answering an absurd tip or gas estimate could take the whole balance as priority fee on a cap-compliant transfer. Caller-supplied `gas_limit` / `max_fee` / `priority_fee` are honoured and then bounded by this cap
 - `AGENTWALLET_MAX_TX_TOKEN`: ceiling per ERC-20 transfer or approval, in human units of the token
 - `AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS`: set to `1` to let calldata the token cap cannot price reach a token contract or Permit2 (refused by default while the cap is set)
 - `AGENTWALLET_TOKEN_DECIMALS`: pin decimals for tokens outside the registry (`8453:0x<token>=6,<mint>=9`); a pin is used for amounts and caps instead of asking the RPC

package/build/index.js

@@ -16,7 +16,7 @@ import { assertPublicUrl, safeFetch, finalUrlOf } from './ssrf-guard.js';
 import { deriveX402Payment, isWithinCap, lookupTrustedDecimals, assertDeclaredDecimals, nativeDecimals, SOLANA_CHAIN_IDS, assetLabel, autopayAssetAllowed, autopayEnvCap, effectiveAutopayCap, maxAuthWindowSeconds, parseDecimalPins, approvalRefusal, authorizationResource, resolveNetworkChainId, normalizeRawAmount, parseAutopayAssets, assetSupportsExact, approvalResourceUrl, } from './x402-payment.js';
 import { createHash } from 'node:crypto';
 import { isLocalMode, getLocalAddress, localWalletRecord, localSend, localNativeBalance, localTokenBalance, localSignMessage, resolveRpcUrl, } from './local-wallet.js';
-import { localSignAuthorization, localEthCall, localGetCode, localSignPermit2Upto } from './local-wallet.js';
+import { localSignAuthorization, localEthCall, localGetCode, localSignPermit2Upto, probeTokenDecimals } from './local-wallet.js';
 import { WRAPPED_NATIVE } from './wrapped-native.js';
 import { buildUptoAuthorization, uptoPayload, permit2AllowanceCalldata, permit2ApproveCalldata, decodeUint, permit2Address, } from './x402-permit2.js';
 import { assessTokenRisk } from './token-risk.js';
@@ -119,7 +119,12 @@ async function routeLocally(path, method, body) {
             throw new Error(`Local mode expects an EVM address, got "${to}".`);
         }
         const hasData = data && data !== '0x';
-        return localSend(chainId, to, value, hasData ? data : undefined);
+        const fees = {
+            ...(body?.gas_limit ? { gas: String(body.gas_limit) } : {}),
+            ...(body?.max_fee ? { maxFeePerGas: String(body.max_fee) } : {}),
+            ...(body?.priority_fee ? { maxPriorityFeePerGas: String(body.priority_fee) } : {}),
+        };
+        return localSend(chainId, to, value, hasData ? data : undefined, fees);
     }
     // POST /wallets/{id}/x402/authorize  (x402 "exact": EIP-3009 authorization, signed here, broadcast by nobody)
     if (method === 'POST' && /^\/wallets\/[^/]*\/x402\/authorize$/.test(rawPath)) {
@@ -376,21 +381,29 @@ async function resolveTrustedDecimals(chainId, token) {
         throw new Error(`x402 blocked: cannot verify decimals for SPL mint ${token} on chain ${chainId}. ` +
             `Unknown mints are refused because the payment cap cannot be checked without trusted decimals.`);
     }
-    // decimals() selector
+    // decimals() selector. In local mode this is the SAME probe and cache the
+    // local cap uses: two caches let a node answer 6 to one and 18 to the other
+    // and move 1000x the cap (round 5).
     let onChain = null;
-    try {
-        const r = (await api('/eth-call', 'POST', {
-            chain_id: chainId, to: token, data: '0x313ce567',
-        }, { 'X-AGW-SKIP-X402': 'true' }));
-        const hex = (r?.result || '').replace(/^0x/, '');
-        if (hex && /^[0-9a-fA-F]+$/.test(hex)) {
-            const n = parseInt(hex, 16);
-            if (Number.isInteger(n) && n >= 0 && n <= 36)
-                onChain = n;
-        }
+    if (anyLocalMode()) {
+        const p = await probeTokenDecimals(chainId, token);
+        onChain = typeof p === 'number' ? p : null;
     }
-    catch {
-        onChain = null; // fall through to the refusal below
+    else {
+        try {
+            const r = (await api('/eth-call', 'POST', {
+                chain_id: chainId, to: token, data: '0x313ce567',
+            }, { 'X-AGW-SKIP-X402': 'true' }));
+            const hex = (r?.result || '').replace(/^0x/, '');
+            if (hex && /^[0-9a-fA-F]+$/.test(hex)) {
+                const n = parseInt(hex, 16);
+                if (Number.isInteger(n) && n >= 0 && n <= 36)
+                    onChain = n;
+            }
+        }
+        catch {
+            onChain = null; // fall through to the refusal below
+        }
     }
     if (onChain === null) {
         throw new Error(`x402 blocked: could not resolve on-chain decimals for ${token} on chain ${chainId}. ` +
@@ -574,8 +587,43 @@ function redactRpcSecrets(err) {
     const e = err;
     // A rejection that is not an Error (web3.js rejects with a raw {InstructionError} object) used to read "[object Object]".
     let msg = e?.shortMessage ? [e.shortMessage, e.details].filter(Boolean).join(' ') : (e?.message !== undefined ? String(e.message) : (err && typeof err === 'object' ? JSON.stringify(err) : String(err)));
+    // Bounded BEFORE the regex: the URL pattern is quadratic on text without "://",
+    // and a node's 160 KB error page held the whole server for 14 s (round 5).
+    msg = msg.slice(0, RPC_ERROR_MAX_CHARS);
     msg = msg.split(/\r?\n/).filter(l => !/^\s*(URL|Request body|Request Arguments|Raw Call Arguments)\s*:/i.test(l)).join('\n').trim();
-    return msg.replace(/[a-z][a-z0-9+.-]*:\/\/[^\s"'<>)]+/gi, (u) => redactUrl(u)); // brackets stay in: IPv6 hosts
+    msg = msg.replace(/[a-z][a-z0-9+.-]*:\/\/[^\s"'<>)]+/gi, (u) => redactUrl(u)); // brackets stay in: IPv6 hosts
+    // A node that echoes the request path ("The requested URL /v3/<key> was not found")
+    // leaks the provider key without a scheme in front of it; every configured RPC
+    // URL's path and query are scrubbed as plain text as well (round 5).
+    for (const secret of rpcPathSecrets())
+        msg = msg.split(secret).join('/…');
+    return msg.length > 2000 ? msg.slice(0, 2000) + '…' : msg;
+}
+const RPC_ERROR_MAX_CHARS = 4000;
+let rpcPathSecretsCache = null;
+/** The path+query of every configured RPC URL (and its URL-decoded form), longest first. */
+function rpcPathSecrets() {
+    if (rpcPathSecretsCache)
+        return rpcPathSecretsCache;
+    const out = new Set();
+    for (const [k, v] of Object.entries(process.env)) {
+        if (!/^AGENTWALLET_(RPC_URL|RPC_\d+|SOLANA_RPC|SOLANA_RPC_\d+)$/.test(k) || !v)
+            continue;
+        try {
+            const u = new URL(v.trim());
+            const tail = u.pathname + u.search;
+            if (tail.length > 1) {
+                out.add(tail);
+                try {
+                    out.add(decodeURIComponent(tail));
+                }
+                catch { /* keep the raw form */ }
+            }
+        }
+        catch { /* not a URL; nothing to scrub */ }
+    }
+    rpcPathSecretsCache = [...out].sort((a, b) => b.length - a.length);
+    return rpcPathSecretsCache;
 }
 /**
  * Decimals to scale a human amount by. Always the token's own value (registry,
@@ -603,7 +651,7 @@ async function verifiedDecimals(chainId, token, given) {
 /** Cap variables are read at send time; a typo must fail at startup, not after funding. */
 function validateGuardEnv() {
     parseDecimalPins(process.env.AGENTWALLET_TOKEN_DECIMALS); // throws on a malformed pin
-    for (const name of ['AGENTWALLET_MAX_TX_NATIVE', 'AGENTWALLET_MAX_TX_TOKEN', 'AGENTWALLET_MAX_TX_SOL', 'AGENTWALLET_MAX_AUTOPAY']) {
+    for (const name of ['AGENTWALLET_MAX_TX_NATIVE', 'AGENTWALLET_MAX_TX_TOKEN', 'AGENTWALLET_MAX_TX_SOL', 'AGENTWALLET_MAX_AUTOPAY', 'AGENTWALLET_MAX_FEE_NATIVE']) {
         const raw = process.env[name];
         const v = (raw || '').trim();
         // Set but blank is a typo, not "no cap": refuse to start rather than run uncapped.
@@ -654,7 +702,7 @@ function validateGuardEnv() {
         throw new Error(`Unknown environment variable ${k}. AgentWallet refuses to start on an unrecognised AGENTWALLET_* name so that a misspelled cap cannot run uncapped. Known names: ${[...KNOWN_ENV].join(', ')}, AGENTWALLET_RPC_<chainId>, AGENTWALLET_SOLANA_RPC_<chainId>.`);
     }
 }
-const KNOWN_ENV = new Set(["AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS", "AGENTWALLET_API_URL", "AGENTWALLET_APPROVALS", "AGENTWALLET_AUTOPAY_ASSETS", "AGENTWALLET_CHAIN_ID", "AGENTWALLET_DASHBOARD_URL", "AGENTWALLET_KEYFILE", "AGENTWALLET_LEGACY_PAYWALL_ORIGINS", "AGENTWALLET_MAX_AUTOPAY", "AGENTWALLET_MAX_AUTOPAY_PER_HOUR", "AGENTWALLET_MAX_TX_NATIVE", "AGENTWALLET_MAX_TX_SOL", "AGENTWALLET_MAX_TX_TOKEN", "AGENTWALLET_PASS", "AGENTWALLET_PERMIT2_AUTO_APPROVE", "AGENTWALLET_PRIVATE_KEY", "AGENTWALLET_RPC_URL", "AGENTWALLET_SOLANA_KEY", "AGENTWALLET_SOLANA_KEYFILE", "AGENTWALLET_SOLANA_RPC", "AGENTWALLET_TOKEN_DECIMALS", "AGENTWALLET_TOKEN_RISK", "AGENTWALLET_USER", "AGENTWALLET_WALLET_ID", "AGENTWALLET_X402_MAX_TIMEOUT"]);
+const KNOWN_ENV = new Set(["AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS", "AGENTWALLET_API_URL", "AGENTWALLET_APPROVALS", "AGENTWALLET_AUTOPAY_ASSETS", "AGENTWALLET_CHAIN_ID", "AGENTWALLET_DASHBOARD_URL", "AGENTWALLET_KEYFILE", "AGENTWALLET_LEGACY_PAYWALL_ORIGINS", "AGENTWALLET_MAX_AUTOPAY", "AGENTWALLET_MAX_AUTOPAY_PER_HOUR", "AGENTWALLET_MAX_FEE_NATIVE", "AGENTWALLET_MAX_TX_NATIVE", "AGENTWALLET_MAX_TX_SOL", "AGENTWALLET_MAX_TX_TOKEN", "AGENTWALLET_PASS", "AGENTWALLET_PERMIT2_AUTO_APPROVE", "AGENTWALLET_PRIVATE_KEY", "AGENTWALLET_RPC_URL", "AGENTWALLET_SOLANA_KEY", "AGENTWALLET_SOLANA_KEYFILE", "AGENTWALLET_SOLANA_RPC", "AGENTWALLET_TOKEN_DECIMALS", "AGENTWALLET_TOKEN_RISK", "AGENTWALLET_USER", "AGENTWALLET_WALLET_ID", "AGENTWALLET_X402_MAX_TIMEOUT"]);
 /**
  * Register a tool whose arguments are strict: an unknown key (max_payemnt for
  * max_payment) is an error that names it, not a silently dropped guard. The
@@ -742,7 +790,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.13.10',
+    version: '1.13.12',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. ${anyLocalMode()
         ? 'This server runs in LOCAL (self-custody) mode: the operator supplied the key, signing happens in this process, and the only spend guards are the environment caps (AGENTWALLET_MAX_TX_NATIVE / _TOKEN / _SOL per transaction, AGENTWALLET_MAX_AUTOPAY and AGENTWALLET_AUTOPAY_ASSETS for x402, AGENTWALLET_X402_MAX_TIMEOUT for authorization windows). There is no server-side pause, daily limit or approval email; pause_wallet, unpause_wallet and delete_wallet are refused.'
@@ -1347,8 +1395,10 @@ async function resolveTokenDomain(chainId, asset, extra) {
         }
         return known;
     }
-    if (declared)
-        return declared;
+    // Outside the registry the contract's own name()/version() come first; the
+    // 402's declared pair is accepted only when the contract does not answer, and
+    // a declared pair that contradicts the contract is refused (round 5: a
+    // declared "Evil Name"/"9" used to be signed over the real domain).
     let name = '', version = '';
     try {
         // The signing decoder (256 bytes, strict UTF-8), not the 64-char display sanitiser
@@ -1357,12 +1407,17 @@ async function resolveTokenDomain(chainId, asset, extra) {
         name = decodeDomainString(await ethCallHex(chainId, asset, '0x06fdde03')); // name()
         version = decodeDomainString(await ethCallHex(chainId, asset, '0x54fd4d50')); // version()
     }
-    catch { /* refused below */ }
-    if (!name || !version) {
-        throw new Error(`x402: cannot determine the EIP-712 domain for token ${asset} on chain ${chainId}: the endpoint sent no ` +
-            `extra.name/extra.version and the contract did not answer name()/version(). Refused rather than signed with a guessed domain.`);
+    catch { /* handled below */ }
+    if (name && version) {
+        if (declared && (declared.name !== name || declared.version !== version)) {
+            throw new Error(`x402: the endpoint declared EIP-712 domain "${serverText(declared.name)}"/"${serverText(declared.version)}" for ${asset} on chain ${chainId}, but the contract reports "${serverText(name)}"/"${serverText(version)}"; refusing to sign under a domain the token would reject.`);
+        }
+        return { name, version };
     }
-    return { name, version };
+    if (declared)
+        return declared;
+    throw new Error(`x402: cannot determine the EIP-712 domain for token ${asset} on chain ${chainId}: the endpoint sent no ` +
+        `extra.name/extra.version and the contract did not answer name()/version(). Refused rather than signed with a guessed domain.`);
 }
 /** Text an endpoint wrote, bounded so it cannot flood the agent's context. */
 function serverText(s) {
@@ -1816,8 +1871,17 @@ tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the server
     const retryServedFrom = finalUrlOf(retryRes, url);
     const retryCrossOrigin = new URL(retryServedFrom).origin !== new URL(url).origin;
     const verdict = settlementVerdict(retryRes.status, settlement, retryCrossOrigin);
-    const claimedRaw = typeof settlement?.amount === 'string' && /^\d+$/.test(settlement.amount) ? settlement.amount : null;
-    const claimedAboveMax = claimedRaw !== null && BigInt(claimedRaw) > BigInt(rawAmount);
+    // The server's claimed settled amount may be in base units or human units; it is inconsistent if it exceeds the maximum in either reading.
+    const claimedStr = typeof settlement?.amount === 'string' ? settlement.amount.trim() : null;
+    let claimedAboveMax = false;
+    if (claimedStr && /^\d+(\.\d+)?$/.test(claimedStr)) {
+        try {
+            claimedAboveMax = (/^\d+$/.test(claimedStr) && BigInt(claimedStr) > BigInt(rawAmount)) || BigInt(parseUnits(claimedStr, trustedDecimals)) > BigInt(rawAmount);
+        }
+        catch {
+            claimedAboveMax = false;
+        }
+    }
     if (retryCrossOrigin) {
         retryError = `The paid request was redirected to another origin (${new URL(retryServedFrom).origin}); the payment header is never forwarded across origins, so this response did not see the payment.`;
     }
@@ -1836,6 +1900,8 @@ tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the server
         payment_made: verdict.payment_made,
         payment_outcome: verdict.outcome,
         authorization_reused: authorizationReused,
+        // A cached authorization is re-sent as signed; if this call's max_payment is lower than it, say so (no new authorization was signed).
+        cached_authorization_above_current_cap: authorizationReused && !isWithinCap(rawAmount, trustedDecimals, effectiveMax),
         retry_error: retryError,
         payment_method: isUpto ? 'permit2-upto-authorization' : (standardExact ? 'eip3009-authorization' : 'onchain-transfer'),
         approval_id: approvalUsed,
@@ -1893,7 +1959,13 @@ tool('check_token_risk', 'Assess an ERC-20 token before approving or swapping it
     'A warning for the caller to weigh, never a block.', {
     token: z.string().regex(/^0x[a-fA-F0-9]{40}$/).describe('ERC-20 token contract address'),
     chain_id: z.number().int().describe('Chain ID'),
-}, async ({ token, chain_id }) => jsonResponse({ token, chain_id, risk: await assessTokenRisk(chain_id, token, (to, data) => ethCallHex(chain_id, to, data)) }));
+}, async ({ token, chain_id }) => {
+    if (process.env.AGENTWALLET_TOKEN_RISK === '0') {
+        // The operator said no third-party lookups; approve_token honoured it, this tool did not (round 5).
+        return jsonResponse({ token, chain_id, risk: { source: 'none', notes: ['The GoPlus lookup is disabled by AGENTWALLET_TOKEN_RISK=0; no third party was contacted.'] } });
+    }
+    return jsonResponse({ token, chain_id, risk: await assessTokenRisk(chain_id, token, (to, data) => ethCallHex(chain_id, to, data)) });
+});
 // ─── Tool: get_usage ─────────────────────────────────────────────
 tool('get_usage', 'Get the current month\'s usage statistics. ' +
     'Returns operations count, tier info, remaining quota, and fees.', {}, async () => {
@@ -2115,6 +2187,7 @@ tool('wallet_mode', 'Report whether this server is signing locally (self-custody
             address: getLocalAddress(),
             rpc_endpoint: redactUrl(rpc),
             per_tx_cap_native: (process.env.AGENTWALLET_MAX_TX_NATIVE || '').trim() || 'not set',
+            per_tx_fee_cap_native: (process.env.AGENTWALLET_MAX_FEE_NATIVE || '').trim() || '0.01 (default)',
         };
     }
     else {

package/build/local-solana.js

@@ -106,6 +106,9 @@ export function resolveSolanaRpc(chainId = 900) {
     const explicit = (process.env.AGENTWALLET_SOLANA_RPC || '').trim();
     if (explicit)
         return explicit;
+    if (Object.keys(process.env).some(k => /^AGENTWALLET_SOLANA_RPC_\d+$/.test(k) && (process.env[k] || '').trim())) {
+        throw new Error(`No Solana RPC for chain ${chainId}: AGENTWALLET_SOLANA_RPC_<chainId> is set for another cluster, so the public default is not used. Set AGENTWALLET_SOLANA_RPC_${chainId} or AGENTWALLET_SOLANA_RPC.`);
+    }
     const fallback = DEFAULT_SOLANA_RPC[chainId];
     if (fallback)
         return fallback;

package/build/local-wallet.d.ts

@@ -49,14 +49,15 @@ export declare function localNativeBalance(chainId: number): Promise<{
     mode: string;
 }>;
 export declare function localTokenBalance(chainId: number, token: Address): Promise<{
+    mode: string;
+    warning?: string | undefined;
     address: `0x${string}`;
     chain_id: number;
     token: `0x${string}`;
     symbol: string;
-    decimals: number;
+    decimals: number | null;
     balance_raw: string;
-    balance: string;
-    mode: string;
+    balance: string | null;
 }>;
 export interface LocalSendResult {
     tx_hash: string;
@@ -66,6 +67,9 @@ export interface LocalSendResult {
     chain_id: number;
     mode: 'local';
     signed_locally: true;
+    gas?: string;
+    max_fee_per_gas?: string;
+    worst_case_fee?: string;
 }
 /**
  * What a decimals() probe learned about an address. The four outcomes are
@@ -86,10 +90,28 @@ export interface LocalSendResult {
  * differing only in that immutable were blocked (18) and sent (77).
  */
 type DecimalsProbe = number | 'unusable' | 'not-a-token' | 'unreachable';
+/**
+ * Decimals for `token`: the trusted registry, then the contract's own
+ * decimals() (cached on success). See DecimalsProbe for the other outcomes.
+ */
+export declare function probeTokenDecimals(chainId: number, token: Address): Promise<DecimalsProbe>;
 /** An eth_call failure is a revert only when the node says so; every other failure is "could not ask". */
 export declare function classifyDecimalsError(err: unknown): DecimalsProbe;
 export declare function permit2AddressFor(chainId: number): string;
-export declare function localSend(chainId: number, to: Address, valueWei: bigint, data?: Hex): Promise<LocalSendResult>;
+/** Caller-chosen gas parameters (wei / gas units as decimal strings); honoured, then bounded by the fee cap. */
+export interface FeeOverrides {
+    gas?: string;
+    maxFeePerGas?: string;
+    maxPriorityFeePerGas?: string;
+}
+/**
+ * The most a transaction may burn in fees: gas x maxFeePerGas, in native units.
+ * Without it a node that answered a 47,000 gwei tip or a 30M gas estimate took
+ * the whole balance as fees on a cap-compliant 0.001 ETH transfer (round 4).
+ * Default 0.01; AGENTWALLET_MAX_FEE_NATIVE raises or lowers it.
+ */
+export declare function feeCapWei(): bigint;
+export declare function localSend(chainId: number, to: Address, valueWei: bigint, data?: Hex, fees?: FeeOverrides): Promise<LocalSendResult>;
 /** ERC-20 transfer, encoded locally. */
 export declare function localTransferToken(chainId: number, token: Address, to: Address, rawAmount: string): Promise<LocalSendResult>;
 /** ERC-20 approve, encoded locally. */

package/build/local-wallet.js

@@ -15,7 +15,7 @@
  * on the custodial path and say so explicitly rather than silently downgrading.
  */
 import { readFileSync, statSync } from 'node:fs';
-import { createPublicClient, createWalletClient, http, encodeFunctionData, parseAbi, formatUnits, } from 'viem';
+import { createPublicClient, createWalletClient, http, encodeFunctionData, parseAbi, formatUnits, keccak256, } from 'viem';
 import { privateKeyToAccount } from 'viem/accounts';
 import { nonceManager } from 'viem/nonce';
 import { lookupTrustedDecimals, maxAuthWindowSeconds } from './x402-payment.js';
@@ -109,16 +109,37 @@ const DEFAULT_RPC = {
 export function resolveRpcUrl(chainId) {
     const perChain = (process.env[`AGENTWALLET_RPC_${chainId}`] || '').trim();
     if (perChain)
-        return perChain;
+        return assertRpcScheme(perChain, `AGENTWALLET_RPC_${chainId}`);
     const generic = (process.env.AGENTWALLET_RPC_URL || '').trim();
     if (generic)
-        return generic;
+        return assertRpcScheme(generic, 'AGENTWALLET_RPC_URL');
+    // An operator who named a node for any chain wants control of all of them:
+    // a chain they did not name must not fall through to a public endpoint
+    // (a devnet default answered a real simulation in round 5).
+    if (Object.keys(process.env).some(k => /^AGENTWALLET_RPC_\d+$/.test(k) && (process.env[k] || '').trim())) {
+        throw new Error(`No RPC endpoint for chain ${chainId}: AGENTWALLET_RPC_<chainId> is set for other chains, so the public default is not used. Set AGENTWALLET_RPC_${chainId} or AGENTWALLET_RPC_URL.`);
+    }
     const fallback = DEFAULT_RPC[chainId];
     if (fallback)
         return fallback;
     throw new Error(`No RPC endpoint for chain ${chainId} in local mode. ` +
         `Set AGENTWALLET_RPC_${chainId} to an endpoint you trust.`);
 }
+/** An RPC over plain http to anything but loopback is the hostile-node model in full; refused like the API URL is. */
+function assertRpcScheme(url, name) {
+    let u;
+    try {
+        u = new URL(url);
+    }
+    catch {
+        throw new Error(`${name} is not a URL: "${url}".`);
+    }
+    const loopback = u.hostname === 'localhost' || u.hostname === '127.0.0.1' || u.hostname === '[::1]';
+    if (u.protocol !== 'https:' && !(u.protocol === 'http:' && loopback)) {
+        throw new Error(`${name} must be https (got ${u.protocol}//${u.host}); plain http is allowed only for localhost.`);
+    }
+    return url;
+}
 /**
  * Chain ids each RPC URL has been seen to serve, so an operator pointing
  * AGENTWALLET_RPC_URL at one node for every chain, or mistyping a per-chain
@@ -171,6 +192,7 @@ function assertWithinNativeCap(valueWei) {
 }
 /* ── Read operations ─────────────────────────────────────────────── */
 export async function localNativeBalance(chainId) {
+    await assertRpcServesChain(chainId); // reads used to skip the check and report another chain's balance (round 5)
     const { pub } = clients(chainId);
     const address = getLocalAddress();
     const wei = await pub.getBalance({ address });
@@ -185,18 +207,24 @@ const ERC20_ABI = parseAbi([
     'function allowance(address,address) view returns (uint256)',
 ]);
 export async function localTokenBalance(chainId, token) {
+    await assertRpcServesChain(chainId);
     const { pub } = clients(chainId);
     const address = getLocalAddress();
-    const [raw, decimals, symbol] = await Promise.all([
+    const [raw, decimalsRaw, symbol] = await Promise.all([
         pub.readContract({ address: token, abi: ERC20_ABI, functionName: 'balanceOf', args: [address] }),
-        pub.readContract({ address: token, abi: ERC20_ABI, functionName: 'decimals' }).catch(() => 18),
+        pub.readContract({ address: token, abi: ERC20_ABI, functionName: 'decimals' }).catch(() => null),
         pub.readContract({ address: token, abi: ERC20_ABI, functionName: 'symbol' }).catch(() => ''),
     ]);
+    // A decimals() of 2^20 handed to viem's formatUnits held the whole server for
+    // minutes (quadratic trailing-zero trim, round 4): only 0..36 is formatted.
+    const d = Number(decimalsRaw);
+    const safe = Number.isInteger(d) && d >= 0 && d <= 36 ? d : null;
     return {
         address, chain_id: chainId, token, symbol,
-        decimals: Number(decimals),
+        decimals: safe,
         balance_raw: raw.toString(),
-        balance: formatUnits(raw, Number(decimals)),
+        balance: safe === null ? null : formatUnits(raw, safe),
+        ...(safe === null ? { warning: 'the token reported decimals outside 0..36 (or none); only the raw balance is shown' } : {}),
         mode: 'local',
     };
 }
@@ -232,7 +260,7 @@ const decimalsCache = new Map();
  * Decimals for `token`: the trusted registry, then the contract's own
  * decimals() (cached on success). See DecimalsProbe for the other outcomes.
  */
-async function probeTokenDecimals(chainId, token) {
+export async function probeTokenDecimals(chainId, token) {
     const known = lookupTrustedDecimals(chainId, token);
     if (typeof known === 'number')
         return known;
@@ -261,8 +289,11 @@ async function probeTokenDecimals(chainId, token) {
         return 'unusable'; // answered, but not one uint8 word
     const d = Number(BigInt(result));
     // Reject nonsense rather than trusting it; an out-of-range value would
-    // widen the ceiling exactly like the old assumption did.
-    if (Number.isInteger(d) && d >= 0 && d <= 36) {
+    // widen the ceiling exactly like the old assumption did. Above 18 the RPC is
+    // the only witness and a lie there scales the cap by 10^18 (a node saying 36
+    // for mainnet WETH, round 4): such tokens must be pinned with
+    // AGENTWALLET_TOKEN_DECIMALS.
+    if (Number.isInteger(d) && d >= 0 && d <= 18) {
         decimalsCache.set(key, d);
         return d;
     }
@@ -303,12 +334,19 @@ const PERMIT2_SELECTORS = new Set(['87517c45', '2b67b570', '2a2d80d1', '36c78516
    and so read as "not a token" to the cap, which let setApprovalForAll to an
    attacker through uncapped (2026-10-04 round 2, verified on a live
    collection). Nothing prices an NFT, so these are refused outright. */
-const NFT_SELECTORS = new Set(['a22cb465', '42842e0e', 'b88d4fde', 'f242432a', '2eb2c2d6']);
+const NFT_SELECTORS = new Set(['a22cb465', '42842e0e', 'b88d4fde', 'f242432a', '2eb2c2d6', '959b8c3f']); // plus ERC-777 authorizeOperator: an unbounded delegation
 const CAP_LAYOUTS = {
     a9059cbb: { amountIndex: 1, what: 'token transfer' }, // transfer(address,uint256)
     '23b872dd': { amountIndex: 2, what: 'token transfer' }, // transferFrom(address,address,uint256)
     '095ea7b3': { amountIndex: 1, what: 'approval' }, // approve(address,uint256)
     '39509351': { amountIndex: 1, what: 'allowance increase' }, // increaseAllowance(address,uint256)
+    // ERC-677 and ERC-777 value movers: priced like transfer, so a contract that
+    // declines decimals() is evaluated at 0 decimals instead of waved through
+    // (transferAndCall(attacker, 1e24) on a not-a-token target, round 5).
+    '4000aea0': { amountIndex: 1, what: 'token transfer (transferAndCall)' }, // transferAndCall(address,uint256,bytes)
+    cae9ca51: { amountIndex: 1, what: 'approval (approveAndCall)' }, // approveAndCall(address,uint256,bytes)
+    '9bd9bbc6': { amountIndex: 1, what: 'token transfer (ERC-777 send)' }, // send(address,uint256,bytes)
+    '62ad1b83': { amountIndex: 2, what: 'token transfer (ERC-777 operatorSend)' }, // operatorSend(address,address,uint256,bytes,bytes)
     '87517c45': { amountIndex: 2, tokenIndex: 0, what: 'Permit2 approval' }, // Permit2.approve(address,address,uint160,uint48)
     // WETH9 calls, priced only when `to` is the chain's own wrapped-native
     // contract (wrappedNativeOnly). deposit() carries its amount as msg.value,
@@ -435,7 +473,25 @@ async function assertWithinTokenCap(chainId, to, data, valueWei = 0n) {
         }
     }
 }
-export async function localSend(chainId, to, valueWei, data) {
+function parseUint(v, what) {
+    if (!/^\d{1,40}$/.test(v))
+        throw new Error(`${what} must be a non-negative integer string, got "${v}".`);
+    return BigInt(v);
+}
+/**
+ * The most a transaction may burn in fees: gas x maxFeePerGas, in native units.
+ * Without it a node that answered a 47,000 gwei tip or a 30M gas estimate took
+ * the whole balance as fees on a cap-compliant 0.001 ETH transfer (round 4).
+ * Default 0.01; AGENTWALLET_MAX_FEE_NATIVE raises or lowers it.
+ */
+export function feeCapWei() {
+    const raw = (process.env.AGENTWALLET_MAX_FEE_NATIVE || '0.01').trim();
+    if (!/^\d+(\.\d+)?$/.test(raw))
+        throw new Error(`AGENTWALLET_MAX_FEE_NATIVE must be a decimal number, got "${raw}".`);
+    const [whole, frac = ''] = raw.split('.');
+    return BigInt(whole + frac.padEnd(18, '0').slice(0, 18));
+}
+export async function localSend(chainId, to, valueWei, data, fees) {
     assertWithinNativeCap(valueWei);
     if (data && data !== '0x') {
         if (!/^0x([0-9a-fA-F]{2})*$/.test(data))
@@ -443,20 +499,73 @@ export async function localSend(chainId, to, valueWei, data) {
         await assertWithinTokenCap(chainId, to, data, valueWei);
     }
     await assertRpcServesChain(chainId);
-    const { wallet } = clients(chainId);
-    const hash = await wallet.sendTransaction({
-        to,
-        value: valueWei,
-        ...(data ? { data } : {}),
+    const { pub, wallet } = clients(chainId);
+    const account = getLocalAccount();
+    const base = { account, to, value: valueWei, ...(data ? { data } : {}) };
+    // Gas: the caller's figure when given (it used to be read and dropped,
+    // round 4), otherwise the node's estimate.
+    const gas = fees?.gas ? parseUint(fees.gas, 'gas_limit') : await pub.estimateGas(base);
+    // Fees: the caller's figures when given, otherwise the node's; either way the
+    // worst case gas x maxFeePerGas must fit the fee cap before anything is signed.
+    let maxFeePerGas;
+    let maxPriorityFeePerGas;
+    let gasPrice;
+    if (fees?.maxFeePerGas) {
+        maxFeePerGas = parseUint(fees.maxFeePerGas, 'max_fee');
+        maxPriorityFeePerGas = fees.maxPriorityFeePerGas ? parseUint(fees.maxPriorityFeePerGas, 'priority_fee') : maxFeePerGas;
+    }
+    else {
+        try {
+            const est = await pub.estimateFeesPerGas();
+            maxFeePerGas = est.maxFeePerGas;
+            maxPriorityFeePerGas = fees?.maxPriorityFeePerGas ? parseUint(fees.maxPriorityFeePerGas, 'priority_fee') : est.maxPriorityFeePerGas;
+        }
+        catch {
+            gasPrice = (await pub.estimateFeesPerGas({ type: 'legacy' })).gasPrice; // a chain without EIP-1559
+        }
+    }
+    if (maxFeePerGas !== undefined && maxPriorityFeePerGas !== undefined && maxPriorityFeePerGas > maxFeePerGas)
+        maxPriorityFeePerGas = maxFeePerGas;
+    const perGas = maxFeePerGas ?? gasPrice ?? 0n;
+    const worst = gas * perGas;
+    const feeCap = feeCapWei();
+    if (worst > feeCap) {
+        throw new Error(`Blocked by local guard: the transaction could burn up to ${formatUnits(worst, 18)} native in fees (gas ${gas} x ${formatUnits(perGas, 9)} gwei), ` +
+            `above AGENTWALLET_MAX_FEE_NATIVE (${formatUnits(feeCap, 18)}). A node answering an absurd fee or gas estimate is the usual cause; ` +
+            `pass gas_limit / max_fee / priority_fee explicitly, or the operator can raise the cap.`);
+    }
+    // Sign here, hash here, then hand the bytes to the node: the hash reported is
+    // the one computed from the signed transaction, never the node's answer.
+    const address = getLocalAddress();
+    const nonce = await account.nonceManager.consume({ address, chainId, client: pub });
+    const request = await wallet.prepareTransactionRequest({
+        ...base, gas, nonce, chainId,
+        ...(gasPrice !== undefined ? { type: 'legacy', gasPrice } : { type: 'eip1559', maxFeePerGas: maxFeePerGas, maxPriorityFeePerGas: maxPriorityFeePerGas }),
     });
+    const signed = await wallet.signTransaction(request);
+    const localHash = keccak256(signed);
+    let reported;
+    try {
+        reported = await pub.sendRawTransaction({ serializedTransaction: signed });
+    }
+    catch (e) {
+        account.nonceManager.reset({ address, chainId });
+        throw new Error(`Broadcast of transaction ${localHash} (nonce ${nonce}) failed: ${e.message.split('\n')[0]}. The transaction is signed and MAY be live if the node forwarded it before answering; check the hash on an explorer before retrying.`);
+    }
+    if (reported.toLowerCase() !== localHash.toLowerCase()) {
+        throw new Error(`Transaction ${localHash} (nonce ${nonce}) was BROADCAST, but the node answered with a different hash (${String(reported).slice(0, 80)}), so it cannot be trusted about its fate. Verify ${localHash} on an explorer before retrying.`);
+    }
     return {
-        tx_hash: hash,
-        from: getLocalAddress(),
+        tx_hash: localHash,
+        from: address,
         to,
         value: valueWei.toString(),
         chain_id: chainId,
         mode: 'local',
         signed_locally: true,
+        gas: gas.toString(),
+        max_fee_per_gas: (maxFeePerGas ?? gasPrice ?? 0n).toString(),
+        worst_case_fee: formatUnits(worst, 18),
     };
 }
 /** ERC-20 transfer, encoded locally. */
@@ -532,12 +641,14 @@ export async function localSignAuthorization(chainId, asset, domain, auth) {
 }
 /** Read-only eth_call against the local RPC, same shape as the hosted /eth-call route. */
 export async function localEthCall(chainId, to, data) {
+    await assertRpcServesChain(chainId);
     const client = createPublicClient({ transport: http(resolveRpcUrl(chainId)) });
     const r = await client.call({ to, data });
     return { result: r.data ?? '0x' };
 }
 /** Read-only eth_getCode against the local RPC, same shape as the hosted /eth-get-code route. */
 export async function localGetCode(chainId, address) {
+    await assertRpcServesChain(chainId);
     const client = createPublicClient({ transport: http(resolveRpcUrl(chainId)) });
     const code = await client.getCode({ address });
     return { code: code ?? '0x' };

package/build/ssrf-guard.js

@@ -363,7 +363,8 @@ export function buildFetchedResponse(status, statusText, serverHeaders, body, fi
         headers.push([k, v]);
     }
     headers.push([FINAL_URL_HEADER, finalUrl]);
-    const out = new Response(body, { status, statusText, headers });
+    // A reason phrase with bytes above 0xFF (undici decodes it as UTF-8 with U+FFFD) is not a ByteString and threw (round 5).
+    const out = new Response(body, { status, statusText: statusText.replace(/[^\x20-\x7e]/g, ''), headers });
     finalUrls.set(out, finalUrl);
     return out;
 }

package/build/x402-payment.d.ts

@@ -1,19 +1,3 @@
-/**
- * Pure helpers for x402 auto-pay amount/token derivation.
- *
- * Isolated from the server bootstrap in index.ts so the funds-sensitive amount
- * math can be unit-tested without starting the MCP server.
- *
- * SECURITY INVARIANT: token decimals must NEVER come from the 402 response.
- * A resource server controls `asset`, `payTo`, `maxAmountRequired` AND
- * `requiredDecimals`. If the cap is scaled using server-declared decimals, the
- * server can inflate the cap arbitrarily: declaring 18 decimals for 6-decimal
- * USDC turns a "1 USDC" cap into 10^18 base units, so a request for
- * 1,000,000,000,000 units (1,000,000 USDC) passes a 1 USDC cap. Reported by
- * ARC Security Research, 2026-08-02, against 1.10.1. Decimals are now resolved
- * from a trusted source and the declared value is only ever used to detect a
- * mismatch and refuse.
- */
 export interface X402AcceptLike {
     maxAmountRequired: string;
     requiredDecimals?: number;

package/build/x402-payment.js

@@ -14,6 +14,7 @@
  * from a trusted source and the declared value is only ever used to detect a
  * mismatch and refuse.
  */
+import { wrappedNativeAddress } from './wrapped-native.js';
 /**
  * Decimals for assets that x402 endpoints actually settle in, keyed by
  * chain id then lowercased contract address (or SPL mint on Solana).
@@ -142,7 +143,7 @@ export function autopayAssetAllowed(chainId, asset) {
     const label = assetLabel(chainId, asset);
     return {
         allowed: false, via: 'none',
-        reason: `x402 blocked: this endpoint wants payment in ${label}${asset ? ` (${asset})` : ''} on chain ${chainId}, which is not a stablecoin ` +
+        reason: `x402 blocked: this endpoint wants payment in ${String(label).slice(0, 40)}${asset ? ` (${asset.slice(0, 80)})` : ''} on chain ${chainId}, which is not a stablecoin ` +
             `AGENTWALLET_MAX_AUTOPAY can price and is not on the operator's AGENTWALLET_AUTOPAY_ASSETS list for chain ${chainId}. ` +
             `Only the operator can change that list; do not edit the environment or config to add it.`,
     };
@@ -283,6 +284,11 @@ export function lookupTrustedDecimals(chainId, token) {
     const pinned = pinnedDecimals(chainId, token);
     if (pinned !== null)
         return pinned;
+    // Every chain's wrapped native coin is 18 decimals (WETH9 clones; the local
+    // guard asserts it). The registry carried WETH for Base only, so mainnet WETH
+    // was priced by the RPC, which could say 36 (2026-10-04 round 4).
+    if (wrappedNativeAddress(chainId)?.toLowerCase() === token.toLowerCase())
+        return 18;
     const spl = TRUSTED_SPL_DECIMALS[token];
     if (typeof spl === 'number')
         return spl;

package/package.json

@@ -2,7 +2,7 @@
   "name": "agentwallet-mcp",
   "mcpName": "io.github.hifriendbot/agentwallet",
   "repository": { "type": "git", "url": "https://github.com/hifriendbot/agentwallet-mcp" },
-  "version": "1.13.10",
+  "version": "1.13.12",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",
@@ -17,7 +17,7 @@
   "scripts": {
     "build": "tsc",
     "start": "node build/index.js",
-    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs && node test/ata-rent-size.test.mjs && node test/final-url-guard.test.mjs && node test/audit-1135.test.mjs && node test/local-no-autopay.test.mjs && node test/audit-1136.test.mjs && node test/delete-confirm.test.mjs && node test/audit-1138.test.mjs && node test/audit-1139.test.mjs && node test/audit-11310.test.mjs",
+    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs && node test/ata-rent-size.test.mjs && node test/final-url-guard.test.mjs && node test/audit-1135.test.mjs && node test/local-no-autopay.test.mjs && node test/audit-1136.test.mjs && node test/delete-confirm.test.mjs && node test/audit-1138.test.mjs && node test/audit-1139.test.mjs && node test/audit-11310.test.mjs && node test/audit-11311.test.mjs && node test/audit-11312.test.mjs",
     "prepublishOnly": "npm run build"
   },
   "keywords": [