agentwallet-mcp 1.13.3 → 1.13.4

package/build/index.js

@@ -12,8 +12,8 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { z } from 'zod';
-import { assertPublicUrl, safeFetch, FINAL_URL_HEADER } from './ssrf-guard.js';
-import { deriveX402Payment, isWithinCap, lookupTrustedDecimals, assertDeclaredDecimals, nativeDecimals, SOLANA_CHAIN_IDS, assetLabel, autopayAssetAllowed, autopayEnvCap, effectiveAutopayCap, maxAuthWindowSeconds, parseDecimalPins, approvalRefusal, } from './x402-payment.js';
+import { assertPublicUrl, safeFetch, finalUrlOf } from './ssrf-guard.js';
+import { deriveX402Payment, isWithinCap, lookupTrustedDecimals, assertDeclaredDecimals, nativeDecimals, SOLANA_CHAIN_IDS, assetLabel, autopayAssetAllowed, autopayEnvCap, effectiveAutopayCap, maxAuthWindowSeconds, parseDecimalPins, approvalRefusal, authorizationResource, } from './x402-payment.js';
 import { isLocalMode, getLocalAddress, localWalletRecord, localSend, localNativeBalance, localTokenBalance, localSignMessage, resolveRpcUrl, } from './local-wallet.js';
 import { localSignAuthorization, localEthCall, localGetCode, localSignPermit2Upto } from './local-wallet.js';
 import { WRAPPED_NATIVE } from './wrapped-native.js';
@@ -561,7 +561,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.13.3',
+    version: '1.13.4',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. ${anyLocalMode()
         ? 'This server runs in LOCAL (self-custody) mode: the operator supplied the key, signing happens in this process, and the only spend guards are the AGENTWALLET_MAX_TX_* environment caps. There is no server-side pause, daily limit or approval email; pause_wallet, unpause_wallet and delete_wallet are refused.'
@@ -1290,7 +1290,7 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     // A 402 that arrived through a cross-origin redirect cannot be paid here: the
     // payment header would be stripped on the same hop and the money would go
     // to whoever the redirecting server named. The agent should call the final URL.
-    const servedFrom = initialRes.headers.get(FINAL_URL_HEADER) || url;
+    const servedFrom = finalUrlOf(initialRes, url); // recorded by safeFetch itself, never read from a header the server could set
     if (new URL(servedFrom).origin !== new URL(url).origin) {
         return jsonResponse({ status: 402, payment_required: true, payment_made: false,
             error: `The endpoint redirected to another origin (${new URL(servedFrom).origin}) before asking for payment. Call pay_x402 with that URL directly if you trust it.`,
@@ -1420,7 +1420,10 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     let permit2ApprovalTx = null;
     let payerDelegationInfo = null;
     let authorizationReused = false;
-    const cacheKey = [wallet_id, chainId, tokenAddress.toLowerCase(), option.payTo.toLowerCase(), rawAmount, option.scheme, new URL(url).origin + new URL(url).pathname].join('|');
+    // The resource is the whole URL including its query: /buy?id=1 and /buy?id=2
+    // are different purchases, and reusing the first signature for the second
+    // would report a payment the second resource never received.
+    const cacheKey = [wallet_id, chainId, tokenAddress.toLowerCase(), option.payTo.toLowerCase(), rawAmount, option.scheme, authorizationResource(url)].join('|');
     const cachedAuth = fresh_authorization ? undefined : signedPayments.get(cacheKey);
     for (const [k, v] of signedPayments)
         if (v.until <= Date.now())
@@ -1518,7 +1521,7 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     // A second 402 means the facilitator declined (unfunded payer, expired window, bad domain...). v2 servers
     // put the reason in a fresh PAYMENT-REQUIRED header, v1 servers in the body; surface it instead of {}.
     let retryError = null;
-    const retryServedFrom = retryRes.headers.get(FINAL_URL_HEADER) || url;
+    const retryServedFrom = finalUrlOf(retryRes, url);
     const retryCrossOrigin = new URL(retryServedFrom).origin !== new URL(url).origin;
     if (retryCrossOrigin) {
         retryError = `The paid request was redirected to another origin (${new URL(retryServedFrom).origin}); the payment header is never forwarded across origins, so this response did not see the payment.`;

package/build/local-wallet.js

@@ -294,7 +294,9 @@ const CAP_LAYOUTS = {
  * checked, and unpriced calldata aimed at a token contract or at Permit2 is
  * refused, because any state change there can move funds. Calls to other
  * contracts (routers, bridges) still pass: they can only pull what an approval
- * already allowed, and approvals are what this guard bounds.
+ * already allows. Approvals granted through this guard are bounded by it; an
+ * allowance that existed before the cap was set, or was granted elsewhere, is
+ * not, and a router call can spend up to that allowance (noted 2026-10-04).
  *
  * Reported privately 2026-09-27: that refusal also caught our own wrap_eth and
  * unwrap_eth, whose WETH deposit() / withdraw(uint256) calldata was unpriced,
@@ -335,7 +337,7 @@ async function assertWithinTokenCap(chainId, to, data, valueWei = 0n) {
                 `or deposit/withdraw on the chain's wrapped-native contract, ` +
                 `or set AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS=1 to allow it deliberately.`);
         }
-        return; // an ordinary contract call; it can only pull what an approval already allowed
+        return; // an ordinary contract call; it can only pull what an existing approval allows (see the note above)
     }
     const wordAt = (i) => hex.slice(8 + i * 64, 8 + (i + 1) * 64);
     let amount;

package/build/ssrf-guard.d.ts

@@ -98,6 +98,14 @@ export declare function headersForRedirect(headers: HeadersInit | undefined, fro
 export declare const MAX_RESPONSE_BYTES: number;
 /** Header safeFetch adds to every response: the URL the body actually came from, after redirects. */
 export declare const FINAL_URL_HEADER = "x-agw-final-url";
+/** The URL a safeFetch response actually came from, after every redirect. Only safeFetch can set it. */
+export declare function finalUrlOf(res: Response, fallback: string): string;
+/**
+ * The synthetic Response safeFetch hands back: the server's headers minus the
+ * transfer-level ones (the body is already decoded) and minus any header only
+ * this client may set, plus the final URL, which is also recorded out of band.
+ */
+export declare function buildFetchedResponse(status: number, statusText: string, serverHeaders: Iterable<[string, string]>, body: ArrayBuffer | null, finalUrl: string): Response;
 /**
  * fetch() that validates the target, and every redirect hop, against
  * resolvePublicUrl, and connects only to the addresses that validation

package/build/ssrf-guard.js

@@ -330,6 +330,36 @@ export function headersForRedirect(headers, from, to, bodyDropped) {
 export const MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
 /** Header safeFetch adds to every response: the URL the body actually came from, after redirects. */
 export const FINAL_URL_HEADER = 'x-agw-final-url';
+/* The final URL is also recorded here, keyed by the Response object, and
+   finalUrlOf() reads this rather than the header. A server could send a
+   header of the same name (it was copied straight through and read back
+   as the real one, 2026-10-04 report); nothing a server sends can reach
+   this map. */
+const finalUrls = new WeakMap();
+/** The URL a safeFetch response actually came from, after every redirect. Only safeFetch can set it. */
+export function finalUrlOf(res, fallback) {
+    return finalUrls.get(res) ?? fallback;
+}
+/** Response headers that only this client may set on what it hands back. */
+const CLIENT_ONLY_RESPONSE_HEADERS = new Set([FINAL_URL_HEADER]);
+/**
+ * The synthetic Response safeFetch hands back: the server's headers minus the
+ * transfer-level ones (the body is already decoded) and minus any header only
+ * this client may set, plus the final URL, which is also recorded out of band.
+ */
+export function buildFetchedResponse(status, statusText, serverHeaders, body, finalUrl) {
+    const headers = [];
+    for (const [k, v] of serverHeaders) {
+        const name = k.toLowerCase();
+        if (name === 'content-encoding' || name === 'content-length' || CLIENT_ONLY_RESPONSE_HEADERS.has(name))
+            continue;
+        headers.push([k, v]);
+    }
+    headers.push([FINAL_URL_HEADER, finalUrl]);
+    const out = new Response(body, { status, statusText, headers });
+    finalUrls.set(out, finalUrl);
+    return out;
+}
 /** Read a body stream into memory, refusing past `limit` decoded bytes. */
 async function readBounded(stream, limit) {
     if (!stream)
@@ -389,20 +419,14 @@ export async function safeFetch(url, options = {}, maxHops = 3) {
             status = res.status;
             statusText = res.statusText;
             headers = [];
-            for (const [k, v] of res.headers) {
-                // The body below is already decoded, so the transfer-level description
-                // of it would be wrong if carried over.
-                if (k === 'content-encoding' || k === 'content-length')
-                    continue;
+            for (const [k, v] of res.headers)
                 headers.push([k, v]);
-            }
             body = NULL_BODY_STATUS.has(status) ? null : await readBounded(res.body, MAX_RESPONSE_BYTES);
         }
         finally {
             await agent.destroy();
         }
-        headers.push([FINAL_URL_HEADER, current]);
-        const out = new Response(body, { status, statusText, headers });
+        const out = buildFetchedResponse(status, statusText, headers, body, current);
         const isRedirect = status >= 300 && status < 400 && out.headers.has('location');
         if (!isRedirect)
             return out;

package/build/x402-payment.d.ts

@@ -191,6 +191,12 @@ export interface ApprovalWant {
  * outright, before any lookup. For a hosted wallet every bound field is checked
  * here, the wallet included, and the server checks them again when it signs.
  */
+/**
+ * The part of a URL that names the resource an authorization was signed for:
+ * origin, path and query. /buy?id=1 and /buy?id=2 are different purchases
+ * (2026-10-04 report); the fragment is never sent, so it is left out.
+ */
+export declare function authorizationResource(url: string): string;
 export declare function approvalRefusal(approvalId: string, row: ApprovalRow | null | undefined, want: ApprovalWant, localMode: boolean): {
     error: string;
     approval_status?: string | null;

package/build/x402-payment.js

@@ -334,6 +334,15 @@ export function isWithinCap(rawAmountRequired, trustedDecimals, capHuman) {
  * outright, before any lookup. For a hosted wallet every bound field is checked
  * here, the wallet included, and the server checks them again when it signs.
  */
+/**
+ * The part of a URL that names the resource an authorization was signed for:
+ * origin, path and query. /buy?id=1 and /buy?id=2 are different purchases
+ * (2026-10-04 report); the fragment is never sent, so it is left out.
+ */
+export function authorizationResource(url) {
+    const u = new URL(url);
+    return u.origin + u.pathname + u.search;
+}
 export function approvalRefusal(approvalId, row, want, localMode) {
     if (localMode) {
         return {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agentwallet-mcp",
   "mcpName": "io.github.hifriendbot/agentwallet",
-  "version": "1.13.3",
+  "version": "1.13.4",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",
@@ -16,7 +16,7 @@
   "scripts": {
     "build": "tsc",
     "start": "node build/index.js",
-    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs && node test/ata-rent-size.test.mjs",
+    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs && node test/ata-rent-size.test.mjs && node test/final-url-guard.test.mjs",
     "prepublishOnly": "npm run build"
   },
   "keywords": [