agentwallet-mcp 1.13.14 → 1.13.15

package/build/index.js

@@ -827,7 +827,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.13.14',
+    version: '1.13.15',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. ${anyLocalMode()
         ? 'This server runs in LOCAL (self-custody) mode: the operator supplied the key, signing happens in this process, and the only spend guards are the environment caps (AGENTWALLET_MAX_TX_NATIVE / _TOKEN / _SOL per transaction, AGENTWALLET_MAX_AUTOPAY and AGENTWALLET_AUTOPAY_ASSETS for x402, AGENTWALLET_X402_MAX_TIMEOUT for authorization windows). There is no server-side pause, daily limit or approval email; pause_wallet, unpause_wallet and delete_wallet are refused.'

package/build/local-solana.js

@@ -99,13 +99,28 @@ const DEFAULT_SOLANA_RPC = {
     901: 'https://api.devnet.solana.com',
     902: 'https://api.testnet.solana.com',
 };
+/** A Solana RPC over plain http to anything but loopback exposes every query and lets an on-path host answer; refused like an EVM one (round 7). */
+function assertSolanaScheme(url, name) {
+    let u;
+    try {
+        u = new URL(url);
+    }
+    catch {
+        throw new Error(`${name} is not a URL: "${url}".`);
+    }
+    const loopback = u.hostname === 'localhost' || u.hostname === '127.0.0.1' || u.hostname === '[::1]';
+    if (u.protocol !== 'https:' && !(u.protocol === 'http:' && loopback)) {
+        throw new Error(`${name} must be https (got ${u.protocol}//${u.host}); plain http is allowed only for localhost.`);
+    }
+    return url;
+}
 export function resolveSolanaRpc(chainId = 900) {
     const perChain = (process.env[`AGENTWALLET_SOLANA_RPC_${chainId}`] || '').trim();
     if (perChain)
-        return perChain;
+        return assertSolanaScheme(perChain, `AGENTWALLET_SOLANA_RPC_${chainId}`);
     const explicit = (process.env.AGENTWALLET_SOLANA_RPC || '').trim();
     if (explicit)
-        return explicit;
+        return assertSolanaScheme(explicit, 'AGENTWALLET_SOLANA_RPC');
     if (Object.keys(process.env).some(k => /^AGENTWALLET_SOLANA_RPC_\d+$/.test(k) && (process.env[k] || '').trim())) {
         throw new Error(`No Solana RPC for chain ${chainId}: AGENTWALLET_SOLANA_RPC_<chainId> is set for another cluster, so the public default is not used. Set AGENTWALLET_SOLANA_RPC_${chainId} or AGENTWALLET_SOLANA_RPC.`);
     }

package/package.json

@@ -5,7 +5,7 @@
     "type": "git",
     "url": "git+https://github.com/hifriendbot/agentwallet-mcp.git"
   },
-  "version": "1.13.14",
+  "version": "1.13.15",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",