agentwallet-mcp 1.13.13 → 1.13.15

package/build/index.js

@@ -25,7 +25,7 @@ import { assertPublicUrl, safeFetch, finalUrlOf } from './ssrf-guard.js';
 import { deriveX402Payment, isWithinCap, lookupTrustedDecimals, assertDeclaredDecimals, nativeDecimals, SOLANA_CHAIN_IDS, assetLabel, autopayAssetAllowed, autopayEnvCap, effectiveAutopayCap, maxAuthWindowSeconds, parseDecimalPins, approvalRefusal, authorizationResource, resolveNetworkChainId, normalizeRawAmount, parseAutopayAssets, assetSupportsExact, approvalResourceUrl, } from './x402-payment.js';
 import { createHash } from 'node:crypto';
 import { isLocalMode, getLocalAddress, localWalletRecord, localSend, localNativeBalance, localTokenBalance, localSignMessage, resolveRpcUrl, } from './local-wallet.js';
-import { localSignAuthorization, localEthCall, localGetCode, localSignPermit2Upto, probeTokenDecimals } from './local-wallet.js';
+import { localSignAuthorization, localEthCall, localGetCode, localSignPermit2Upto, probeTokenDecimals, assertRpcServesChain } from './local-wallet.js';
 import { WRAPPED_NATIVE } from './wrapped-native.js';
 import { buildUptoAuthorization, uptoPayload, permit2AllowanceCalldata, permit2ApproveCalldata, decodeUint, permit2Address, } from './x402-permit2.js';
 import { assessTokenRisk } from './token-risk.js';
@@ -827,7 +827,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.13.13',
+    version: '1.13.15',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. ${anyLocalMode()
         ? 'This server runs in LOCAL (self-custody) mode: the operator supplied the key, signing happens in this process, and the only spend guards are the environment caps (AGENTWALLET_MAX_TX_NATIVE / _TOKEN / _SOL per transaction, AGENTWALLET_MAX_AUTOPAY and AGENTWALLET_AUTOPAY_ASSETS for x402, AGENTWALLET_X402_MAX_TIMEOUT for authorization windows). There is no server-side pause, daily limit or approval email; pause_wallet, unpause_wallet and delete_wallet are refused.'
@@ -1347,6 +1347,9 @@ tool('get_token_info', 'Get the name, symbol, and decimals of any ERC-20 token b
     token: z.string().regex(/^0x[a-fA-F0-9]{40}$/).describe('ERC-20 token contract address'),
     chain_id: z.number().int().describe('Chain ID'),
 }, async ({ token, chain_id }) => {
+    // A node serving another chain used to be swallowed by the three catch() calls below into name "Unknown" (round 6); it is an error.
+    if (isLocalMode() && !isSolanaChain(chain_id))
+        await assertRpcServesChain(chain_id);
     if (isSolanaChain(chain_id)) {
         throw new Error('get_token_info is not supported on Solana. Use Solana token metadata programs to query SPL token details.');
     }
@@ -1914,7 +1917,8 @@ tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the server
     let claimedAboveMax = false;
     if (claimedStr && /^\d+(\.\d+)?$/.test(claimedStr)) {
         try {
-            claimedAboveMax = (/^\d+$/.test(claimedStr) && BigInt(claimedStr) > BigInt(rawAmount)) || BigInt(parseUnits(claimedStr, trustedDecimals)) > BigInt(rawAmount);
+            // An integer claim is read as base units, a decimal one as human units; reading an integer both ways flagged every honest base-unit claim (round 6).
+            claimedAboveMax = /^\d+$/.test(claimedStr) ? BigInt(claimedStr) > BigInt(rawAmount) : BigInt(parseUnits(claimedStr, trustedDecimals)) > BigInt(rawAmount);
         }
         catch {
             claimedAboveMax = false;

package/build/local-solana.js

@@ -99,13 +99,28 @@ const DEFAULT_SOLANA_RPC = {
     901: 'https://api.devnet.solana.com',
     902: 'https://api.testnet.solana.com',
 };
+/** A Solana RPC over plain http to anything but loopback exposes every query and lets an on-path host answer; refused like an EVM one (round 7). */
+function assertSolanaScheme(url, name) {
+    let u;
+    try {
+        u = new URL(url);
+    }
+    catch {
+        throw new Error(`${name} is not a URL: "${url}".`);
+    }
+    const loopback = u.hostname === 'localhost' || u.hostname === '127.0.0.1' || u.hostname === '[::1]';
+    if (u.protocol !== 'https:' && !(u.protocol === 'http:' && loopback)) {
+        throw new Error(`${name} must be https (got ${u.protocol}//${u.host}); plain http is allowed only for localhost.`);
+    }
+    return url;
+}
 export function resolveSolanaRpc(chainId = 900) {
     const perChain = (process.env[`AGENTWALLET_SOLANA_RPC_${chainId}`] || '').trim();
     if (perChain)
-        return perChain;
+        return assertSolanaScheme(perChain, `AGENTWALLET_SOLANA_RPC_${chainId}`);
     const explicit = (process.env.AGENTWALLET_SOLANA_RPC || '').trim();
     if (explicit)
-        return explicit;
+        return assertSolanaScheme(explicit, 'AGENTWALLET_SOLANA_RPC');
     if (Object.keys(process.env).some(k => /^AGENTWALLET_SOLANA_RPC_\d+$/.test(k) && (process.env[k] || '').trim())) {
         throw new Error(`No Solana RPC for chain ${chainId}: AGENTWALLET_SOLANA_RPC_<chainId> is set for another cluster, so the public default is not used. Set AGENTWALLET_SOLANA_RPC_${chainId} or AGENTWALLET_SOLANA_RPC.`);
     }

package/package.json

@@ -1,8 +1,11 @@
 {
   "name": "agentwallet-mcp",
   "mcpName": "io.github.hifriendbot/agentwallet",
-  "repository": { "type": "git", "url": "https://github.com/hifriendbot/agentwallet-mcp" },
-  "version": "1.13.13",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/hifriendbot/agentwallet-mcp.git"
+  },
+  "version": "1.13.15",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",