agentwallet-mcp 1.13.4 → 1.13.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (15) hide show
  1. package/README.md +1 -1
  2. package/build/index.js +248 -162
  3. package/build/local-solana.d.ts +2 -0
  4. package/build/local-solana.js +55 -9
  5. package/build/local-wallet.d.ts +23 -0
  6. package/build/local-wallet.js +67 -32
  7. package/build/ssrf-guard.d.ts +2 -0
  8. package/build/ssrf-guard.js +9 -1
  9. package/build/x402-eip3009.d.ts +12 -0
  10. package/build/x402-eip3009.js +73 -4
  11. package/build/x402-payment.d.ts +11 -0
  12. package/build/x402-payment.js +78 -14
  13. package/build/x402-permit2.d.ts +5 -4
  14. package/build/x402-permit2.js +13 -7
  15. package/package.json +2 -2
package/README.md CHANGED
@@ -66,7 +66,7 @@ Set either key, or both. They are independent: run EVM locally and Solana hosted
66
66
 
67
67
  Local signing uses [viem](https://viem.sh) for EVM and `@solana/web3.js` for Solana, plus `bs58` for key parsing. SPL instructions are built by hand rather than with `@solana/spl-token`, because that package pulls in `bigint-buffer`, which carries a high severity buffer overflow advisory. A wallet has no business shipping that to save a dozen lines of instruction encoding.
68
68
 
69
- `npm audit` currently reports issues inside `@modelcontextprotocol/sdk`'s HTTP transport dependencies. This server speaks stdio, so that code never loads, and the SDK is not something this package can patch. Run the audit yourself. Publishing a tree you can inspect is the point.
69
+ `npm audit` reports no advisories as of 1.13.5; the overrides in package.json keep two advisories under `@solana/web3.js`'s jayson closed. Earlier releases carried advisories inside `@modelcontextprotocol/sdk`'s HTTP transport dependencies. This server speaks stdio, so that code never loads, and the SDK is not something this package can patch. Run the audit yourself. Publishing a tree you can inspect is the point.
70
70
 
71
71
  <p align="center">
72
72
  <img src="assets/demo.svg" alt="AgentWallet demo, AI agent pays x402 invoice automatically" width="800">