agentwallet-mcp 1.13.11 → 1.13.12

package/build/index.js

@@ -16,7 +16,7 @@ import { assertPublicUrl, safeFetch, finalUrlOf } from './ssrf-guard.js';
 import { deriveX402Payment, isWithinCap, lookupTrustedDecimals, assertDeclaredDecimals, nativeDecimals, SOLANA_CHAIN_IDS, assetLabel, autopayAssetAllowed, autopayEnvCap, effectiveAutopayCap, maxAuthWindowSeconds, parseDecimalPins, approvalRefusal, authorizationResource, resolveNetworkChainId, normalizeRawAmount, parseAutopayAssets, assetSupportsExact, approvalResourceUrl, } from './x402-payment.js';
 import { createHash } from 'node:crypto';
 import { isLocalMode, getLocalAddress, localWalletRecord, localSend, localNativeBalance, localTokenBalance, localSignMessage, resolveRpcUrl, } from './local-wallet.js';
-import { localSignAuthorization, localEthCall, localGetCode, localSignPermit2Upto } from './local-wallet.js';
+import { localSignAuthorization, localEthCall, localGetCode, localSignPermit2Upto, probeTokenDecimals } from './local-wallet.js';
 import { WRAPPED_NATIVE } from './wrapped-native.js';
 import { buildUptoAuthorization, uptoPayload, permit2AllowanceCalldata, permit2ApproveCalldata, decodeUint, permit2Address, } from './x402-permit2.js';
 import { assessTokenRisk } from './token-risk.js';
@@ -381,21 +381,29 @@ async function resolveTrustedDecimals(chainId, token) {
         throw new Error(`x402 blocked: cannot verify decimals for SPL mint ${token} on chain ${chainId}. ` +
             `Unknown mints are refused because the payment cap cannot be checked without trusted decimals.`);
     }
-    // decimals() selector
+    // decimals() selector. In local mode this is the SAME probe and cache the
+    // local cap uses: two caches let a node answer 6 to one and 18 to the other
+    // and move 1000x the cap (round 5).
     let onChain = null;
-    try {
-        const r = (await api('/eth-call', 'POST', {
-            chain_id: chainId, to: token, data: '0x313ce567',
-        }, { 'X-AGW-SKIP-X402': 'true' }));
-        const hex = (r?.result || '').replace(/^0x/, '');
-        if (hex && /^[0-9a-fA-F]+$/.test(hex)) {
-            const n = parseInt(hex, 16);
-            if (Number.isInteger(n) && n >= 0 && n <= 36)
-                onChain = n;
-        }
+    if (anyLocalMode()) {
+        const p = await probeTokenDecimals(chainId, token);
+        onChain = typeof p === 'number' ? p : null;
     }
-    catch {
-        onChain = null; // fall through to the refusal below
+    else {
+        try {
+            const r = (await api('/eth-call', 'POST', {
+                chain_id: chainId, to: token, data: '0x313ce567',
+            }, { 'X-AGW-SKIP-X402': 'true' }));
+            const hex = (r?.result || '').replace(/^0x/, '');
+            if (hex && /^[0-9a-fA-F]+$/.test(hex)) {
+                const n = parseInt(hex, 16);
+                if (Number.isInteger(n) && n >= 0 && n <= 36)
+                    onChain = n;
+            }
+        }
+        catch {
+            onChain = null; // fall through to the refusal below
+        }
     }
     if (onChain === null) {
         throw new Error(`x402 blocked: could not resolve on-chain decimals for ${token} on chain ${chainId}. ` +
@@ -579,8 +587,43 @@ function redactRpcSecrets(err) {
     const e = err;
     // A rejection that is not an Error (web3.js rejects with a raw {InstructionError} object) used to read "[object Object]".
     let msg = e?.shortMessage ? [e.shortMessage, e.details].filter(Boolean).join(' ') : (e?.message !== undefined ? String(e.message) : (err && typeof err === 'object' ? JSON.stringify(err) : String(err)));
+    // Bounded BEFORE the regex: the URL pattern is quadratic on text without "://",
+    // and a node's 160 KB error page held the whole server for 14 s (round 5).
+    msg = msg.slice(0, RPC_ERROR_MAX_CHARS);
     msg = msg.split(/\r?\n/).filter(l => !/^\s*(URL|Request body|Request Arguments|Raw Call Arguments)\s*:/i.test(l)).join('\n').trim();
-    return msg.replace(/[a-z][a-z0-9+.-]*:\/\/[^\s"'<>)]+/gi, (u) => redactUrl(u)); // brackets stay in: IPv6 hosts
+    msg = msg.replace(/[a-z][a-z0-9+.-]*:\/\/[^\s"'<>)]+/gi, (u) => redactUrl(u)); // brackets stay in: IPv6 hosts
+    // A node that echoes the request path ("The requested URL /v3/<key> was not found")
+    // leaks the provider key without a scheme in front of it; every configured RPC
+    // URL's path and query are scrubbed as plain text as well (round 5).
+    for (const secret of rpcPathSecrets())
+        msg = msg.split(secret).join('/…');
+    return msg.length > 2000 ? msg.slice(0, 2000) + '…' : msg;
+}
+const RPC_ERROR_MAX_CHARS = 4000;
+let rpcPathSecretsCache = null;
+/** The path+query of every configured RPC URL (and its URL-decoded form), longest first. */
+function rpcPathSecrets() {
+    if (rpcPathSecretsCache)
+        return rpcPathSecretsCache;
+    const out = new Set();
+    for (const [k, v] of Object.entries(process.env)) {
+        if (!/^AGENTWALLET_(RPC_URL|RPC_\d+|SOLANA_RPC|SOLANA_RPC_\d+)$/.test(k) || !v)
+            continue;
+        try {
+            const u = new URL(v.trim());
+            const tail = u.pathname + u.search;
+            if (tail.length > 1) {
+                out.add(tail);
+                try {
+                    out.add(decodeURIComponent(tail));
+                }
+                catch { /* keep the raw form */ }
+            }
+        }
+        catch { /* not a URL; nothing to scrub */ }
+    }
+    rpcPathSecretsCache = [...out].sort((a, b) => b.length - a.length);
+    return rpcPathSecretsCache;
 }
 /**
  * Decimals to scale a human amount by. Always the token's own value (registry,
@@ -747,7 +790,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.13.11',
+    version: '1.13.12',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. ${anyLocalMode()
         ? 'This server runs in LOCAL (self-custody) mode: the operator supplied the key, signing happens in this process, and the only spend guards are the environment caps (AGENTWALLET_MAX_TX_NATIVE / _TOKEN / _SOL per transaction, AGENTWALLET_MAX_AUTOPAY and AGENTWALLET_AUTOPAY_ASSETS for x402, AGENTWALLET_X402_MAX_TIMEOUT for authorization windows). There is no server-side pause, daily limit or approval email; pause_wallet, unpause_wallet and delete_wallet are refused.'
@@ -1352,8 +1395,10 @@ async function resolveTokenDomain(chainId, asset, extra) {
         }
         return known;
     }
-    if (declared)
-        return declared;
+    // Outside the registry the contract's own name()/version() come first; the
+    // 402's declared pair is accepted only when the contract does not answer, and
+    // a declared pair that contradicts the contract is refused (round 5: a
+    // declared "Evil Name"/"9" used to be signed over the real domain).
     let name = '', version = '';
     try {
         // The signing decoder (256 bytes, strict UTF-8), not the 64-char display sanitiser
@@ -1362,12 +1407,17 @@ async function resolveTokenDomain(chainId, asset, extra) {
         name = decodeDomainString(await ethCallHex(chainId, asset, '0x06fdde03')); // name()
         version = decodeDomainString(await ethCallHex(chainId, asset, '0x54fd4d50')); // version()
     }
-    catch { /* refused below */ }
-    if (!name || !version) {
-        throw new Error(`x402: cannot determine the EIP-712 domain for token ${asset} on chain ${chainId}: the endpoint sent no ` +
-            `extra.name/extra.version and the contract did not answer name()/version(). Refused rather than signed with a guessed domain.`);
+    catch { /* handled below */ }
+    if (name && version) {
+        if (declared && (declared.name !== name || declared.version !== version)) {
+            throw new Error(`x402: the endpoint declared EIP-712 domain "${serverText(declared.name)}"/"${serverText(declared.version)}" for ${asset} on chain ${chainId}, but the contract reports "${serverText(name)}"/"${serverText(version)}"; refusing to sign under a domain the token would reject.`);
+        }
+        return { name, version };
     }
-    return { name, version };
+    if (declared)
+        return declared;
+    throw new Error(`x402: cannot determine the EIP-712 domain for token ${asset} on chain ${chainId}: the endpoint sent no ` +
+        `extra.name/extra.version and the contract did not answer name()/version(). Refused rather than signed with a guessed domain.`);
 }
 /** Text an endpoint wrote, bounded so it cannot flood the agent's context. */
 function serverText(s) {
@@ -1821,8 +1871,17 @@ tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the server
     const retryServedFrom = finalUrlOf(retryRes, url);
     const retryCrossOrigin = new URL(retryServedFrom).origin !== new URL(url).origin;
     const verdict = settlementVerdict(retryRes.status, settlement, retryCrossOrigin);
-    const claimedRaw = typeof settlement?.amount === 'string' && /^\d+$/.test(settlement.amount) ? settlement.amount : null;
-    const claimedAboveMax = claimedRaw !== null && BigInt(claimedRaw) > BigInt(rawAmount);
+    // The server's claimed settled amount may be in base units or human units; it is inconsistent if it exceeds the maximum in either reading.
+    const claimedStr = typeof settlement?.amount === 'string' ? settlement.amount.trim() : null;
+    let claimedAboveMax = false;
+    if (claimedStr && /^\d+(\.\d+)?$/.test(claimedStr)) {
+        try {
+            claimedAboveMax = (/^\d+$/.test(claimedStr) && BigInt(claimedStr) > BigInt(rawAmount)) || BigInt(parseUnits(claimedStr, trustedDecimals)) > BigInt(rawAmount);
+        }
+        catch {
+            claimedAboveMax = false;
+        }
+    }
     if (retryCrossOrigin) {
         retryError = `The paid request was redirected to another origin (${new URL(retryServedFrom).origin}); the payment header is never forwarded across origins, so this response did not see the payment.`;
     }
@@ -1841,6 +1900,8 @@ tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the server
         payment_made: verdict.payment_made,
         payment_outcome: verdict.outcome,
         authorization_reused: authorizationReused,
+        // A cached authorization is re-sent as signed; if this call's max_payment is lower than it, say so (no new authorization was signed).
+        cached_authorization_above_current_cap: authorizationReused && !isWithinCap(rawAmount, trustedDecimals, effectiveMax),
         retry_error: retryError,
         payment_method: isUpto ? 'permit2-upto-authorization' : (standardExact ? 'eip3009-authorization' : 'onchain-transfer'),
         approval_id: approvalUsed,
@@ -1898,7 +1959,13 @@ tool('check_token_risk', 'Assess an ERC-20 token before approving or swapping it
     'A warning for the caller to weigh, never a block.', {
     token: z.string().regex(/^0x[a-fA-F0-9]{40}$/).describe('ERC-20 token contract address'),
     chain_id: z.number().int().describe('Chain ID'),
-}, async ({ token, chain_id }) => jsonResponse({ token, chain_id, risk: await assessTokenRisk(chain_id, token, (to, data) => ethCallHex(chain_id, to, data)) }));
+}, async ({ token, chain_id }) => {
+    if (process.env.AGENTWALLET_TOKEN_RISK === '0') {
+        // The operator said no third-party lookups; approve_token honoured it, this tool did not (round 5).
+        return jsonResponse({ token, chain_id, risk: { source: 'none', notes: ['The GoPlus lookup is disabled by AGENTWALLET_TOKEN_RISK=0; no third party was contacted.'] } });
+    }
+    return jsonResponse({ token, chain_id, risk: await assessTokenRisk(chain_id, token, (to, data) => ethCallHex(chain_id, to, data)) });
+});
 // ─── Tool: get_usage ─────────────────────────────────────────────
 tool('get_usage', 'Get the current month\'s usage statistics. ' +
     'Returns operations count, tier info, remaining quota, and fees.', {}, async () => {

package/build/local-solana.js

@@ -106,6 +106,9 @@ export function resolveSolanaRpc(chainId = 900) {
     const explicit = (process.env.AGENTWALLET_SOLANA_RPC || '').trim();
     if (explicit)
         return explicit;
+    if (Object.keys(process.env).some(k => /^AGENTWALLET_SOLANA_RPC_\d+$/.test(k) && (process.env[k] || '').trim())) {
+        throw new Error(`No Solana RPC for chain ${chainId}: AGENTWALLET_SOLANA_RPC_<chainId> is set for another cluster, so the public default is not used. Set AGENTWALLET_SOLANA_RPC_${chainId} or AGENTWALLET_SOLANA_RPC.`);
+    }
     const fallback = DEFAULT_SOLANA_RPC[chainId];
     if (fallback)
         return fallback;

package/build/local-wallet.d.ts

@@ -90,6 +90,11 @@ export interface LocalSendResult {
  * differing only in that immutable were blocked (18) and sent (77).
  */
 type DecimalsProbe = number | 'unusable' | 'not-a-token' | 'unreachable';
+/**
+ * Decimals for `token`: the trusted registry, then the contract's own
+ * decimals() (cached on success). See DecimalsProbe for the other outcomes.
+ */
+export declare function probeTokenDecimals(chainId: number, token: Address): Promise<DecimalsProbe>;
 /** An eth_call failure is a revert only when the node says so; every other failure is "could not ask". */
 export declare function classifyDecimalsError(err: unknown): DecimalsProbe;
 export declare function permit2AddressFor(chainId: number): string;

package/build/local-wallet.js

@@ -113,6 +113,12 @@ export function resolveRpcUrl(chainId) {
     const generic = (process.env.AGENTWALLET_RPC_URL || '').trim();
     if (generic)
         return assertRpcScheme(generic, 'AGENTWALLET_RPC_URL');
+    // An operator who named a node for any chain wants control of all of them:
+    // a chain they did not name must not fall through to a public endpoint
+    // (a devnet default answered a real simulation in round 5).
+    if (Object.keys(process.env).some(k => /^AGENTWALLET_RPC_\d+$/.test(k) && (process.env[k] || '').trim())) {
+        throw new Error(`No RPC endpoint for chain ${chainId}: AGENTWALLET_RPC_<chainId> is set for other chains, so the public default is not used. Set AGENTWALLET_RPC_${chainId} or AGENTWALLET_RPC_URL.`);
+    }
     const fallback = DEFAULT_RPC[chainId];
     if (fallback)
         return fallback;
@@ -186,6 +192,7 @@ function assertWithinNativeCap(valueWei) {
 }
 /* ── Read operations ─────────────────────────────────────────────── */
 export async function localNativeBalance(chainId) {
+    await assertRpcServesChain(chainId); // reads used to skip the check and report another chain's balance (round 5)
     const { pub } = clients(chainId);
     const address = getLocalAddress();
     const wei = await pub.getBalance({ address });
@@ -200,6 +207,7 @@ const ERC20_ABI = parseAbi([
     'function allowance(address,address) view returns (uint256)',
 ]);
 export async function localTokenBalance(chainId, token) {
+    await assertRpcServesChain(chainId);
     const { pub } = clients(chainId);
     const address = getLocalAddress();
     const [raw, decimalsRaw, symbol] = await Promise.all([
@@ -252,7 +260,7 @@ const decimalsCache = new Map();
  * Decimals for `token`: the trusted registry, then the contract's own
  * decimals() (cached on success). See DecimalsProbe for the other outcomes.
  */
-async function probeTokenDecimals(chainId, token) {
+export async function probeTokenDecimals(chainId, token) {
     const known = lookupTrustedDecimals(chainId, token);
     if (typeof known === 'number')
         return known;
@@ -326,12 +334,19 @@ const PERMIT2_SELECTORS = new Set(['87517c45', '2b67b570', '2a2d80d1', '36c78516
    and so read as "not a token" to the cap, which let setApprovalForAll to an
    attacker through uncapped (2026-10-04 round 2, verified on a live
    collection). Nothing prices an NFT, so these are refused outright. */
-const NFT_SELECTORS = new Set(['a22cb465', '42842e0e', 'b88d4fde', 'f242432a', '2eb2c2d6']);
+const NFT_SELECTORS = new Set(['a22cb465', '42842e0e', 'b88d4fde', 'f242432a', '2eb2c2d6', '959b8c3f']); // plus ERC-777 authorizeOperator: an unbounded delegation
 const CAP_LAYOUTS = {
     a9059cbb: { amountIndex: 1, what: 'token transfer' }, // transfer(address,uint256)
     '23b872dd': { amountIndex: 2, what: 'token transfer' }, // transferFrom(address,address,uint256)
     '095ea7b3': { amountIndex: 1, what: 'approval' }, // approve(address,uint256)
     '39509351': { amountIndex: 1, what: 'allowance increase' }, // increaseAllowance(address,uint256)
+    // ERC-677 and ERC-777 value movers: priced like transfer, so a contract that
+    // declines decimals() is evaluated at 0 decimals instead of waved through
+    // (transferAndCall(attacker, 1e24) on a not-a-token target, round 5).
+    '4000aea0': { amountIndex: 1, what: 'token transfer (transferAndCall)' }, // transferAndCall(address,uint256,bytes)
+    cae9ca51: { amountIndex: 1, what: 'approval (approveAndCall)' }, // approveAndCall(address,uint256,bytes)
+    '9bd9bbc6': { amountIndex: 1, what: 'token transfer (ERC-777 send)' }, // send(address,uint256,bytes)
+    '62ad1b83': { amountIndex: 2, what: 'token transfer (ERC-777 operatorSend)' }, // operatorSend(address,address,uint256,bytes,bytes)
     '87517c45': { amountIndex: 2, tokenIndex: 0, what: 'Permit2 approval' }, // Permit2.approve(address,address,uint160,uint48)
     // WETH9 calls, priced only when `to` is the chain's own wrapped-native
     // contract (wrappedNativeOnly). deposit() carries its amount as msg.value,
@@ -626,12 +641,14 @@ export async function localSignAuthorization(chainId, asset, domain, auth) {
 }
 /** Read-only eth_call against the local RPC, same shape as the hosted /eth-call route. */
 export async function localEthCall(chainId, to, data) {
+    await assertRpcServesChain(chainId);
     const client = createPublicClient({ transport: http(resolveRpcUrl(chainId)) });
     const r = await client.call({ to, data });
     return { result: r.data ?? '0x' };
 }
 /** Read-only eth_getCode against the local RPC, same shape as the hosted /eth-get-code route. */
 export async function localGetCode(chainId, address) {
+    await assertRpcServesChain(chainId);
     const client = createPublicClient({ transport: http(resolveRpcUrl(chainId)) });
     const code = await client.getCode({ address });
     return { code: code ?? '0x' };

package/build/ssrf-guard.js

@@ -363,7 +363,8 @@ export function buildFetchedResponse(status, statusText, serverHeaders, body, fi
         headers.push([k, v]);
     }
     headers.push([FINAL_URL_HEADER, finalUrl]);
-    const out = new Response(body, { status, statusText, headers });
+    // A reason phrase with bytes above 0xFF (undici decodes it as UTF-8 with U+FFFD) is not a ByteString and threw (round 5).
+    const out = new Response(body, { status, statusText: statusText.replace(/[^\x20-\x7e]/g, ''), headers });
     finalUrls.set(out, finalUrl);
     return out;
 }

package/build/x402-payment.js

@@ -143,7 +143,7 @@ export function autopayAssetAllowed(chainId, asset) {
     const label = assetLabel(chainId, asset);
     return {
         allowed: false, via: 'none',
-        reason: `x402 blocked: this endpoint wants payment in ${label}${asset ? ` (${asset})` : ''} on chain ${chainId}, which is not a stablecoin ` +
+        reason: `x402 blocked: this endpoint wants payment in ${String(label).slice(0, 40)}${asset ? ` (${asset.slice(0, 80)})` : ''} on chain ${chainId}, which is not a stablecoin ` +
             `AGENTWALLET_MAX_AUTOPAY can price and is not on the operator's AGENTWALLET_AUTOPAY_ASSETS list for chain ${chainId}. ` +
             `Only the operator can change that list; do not edit the environment or config to add it.`,
     };

package/package.json

@@ -2,7 +2,7 @@
   "name": "agentwallet-mcp",
   "mcpName": "io.github.hifriendbot/agentwallet",
   "repository": { "type": "git", "url": "https://github.com/hifriendbot/agentwallet-mcp" },
-  "version": "1.13.11",
+  "version": "1.13.12",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",
@@ -17,7 +17,7 @@
   "scripts": {
     "build": "tsc",
     "start": "node build/index.js",
-    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs && node test/ata-rent-size.test.mjs && node test/final-url-guard.test.mjs && node test/audit-1135.test.mjs && node test/local-no-autopay.test.mjs && node test/audit-1136.test.mjs && node test/delete-confirm.test.mjs && node test/audit-1138.test.mjs && node test/audit-1139.test.mjs && node test/audit-11310.test.mjs && node test/audit-11311.test.mjs",
+    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs && node test/ata-rent-size.test.mjs && node test/final-url-guard.test.mjs && node test/audit-1135.test.mjs && node test/local-no-autopay.test.mjs && node test/audit-1136.test.mjs && node test/delete-confirm.test.mjs && node test/audit-1138.test.mjs && node test/audit-1139.test.mjs && node test/audit-11310.test.mjs && node test/audit-11311.test.mjs && node test/audit-11312.test.mjs",
     "prepublishOnly": "npm run build"
   },
   "keywords": [